Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
r3zg12.msi

Overview

General Information

Sample Name:r3zg12.msi
Analysis ID:878465
MD5:665afc8f8b7972f427fe1bd90d263032
SHA1:cc36e48f383750eb9416961b52ee3100b6e30688
SHA256:d764436caf7114d880f982d208bd9514a433772dcac851f27c510d1597e26edd
Tags:msi
Infos:

Detection

Qbot
Score:92
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected Qbot
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Writes to foreign memory regions
Allocates memory in foreign processes
Injects a PE file into a foreign processes
C2 URLs / IPs found in malware configuration
Sample uses string decryption to hide its real strings
Potentially malicious time measurement code found
Queries the volume information (name, serial number etc) of a device
Yara signature match
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Found inlined nop instructions (likely shell or obfuscated code)
Modifies existing windows services
PE file contains an invalid checksum
Drops PE files
Contains functionality to read the PEB
Connects to several IPs in different countries
Launches processes in debugging mode, may be used to hinder debugging
Checks for available system drives (often done to infect USB drives)
Creates or modifies windows services
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

  • System is w7x64
  • msiexec.exe (PID: 2364 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\r3zg12.msi" MD5: AC2E7152124CEED36846BD1B6592A00F)
  • msiexec.exe (PID: 2184 cmdline: C:\Windows\system32\msiexec.exe /V MD5: AC2E7152124CEED36846BD1B6592A00F)
    • rundll32.exe (PID: 3244 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: DD81D91FF3B0763C392422865C9AC12E)
      • rundll32.exe (PID: 3260 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: 51138BEEA3E2C21EC44D0932C71762A8)
        • wermgr.exe (PID: 3332 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: C9905EA4C326DAB778B9297BA5BD1889)
    • wscript.exe (PID: 3252 cmdline: wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs MD5: 045451FA238A75305CC26AC982472367)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
QakBot, qbotQbotQBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.
  • GOLD CABIN
https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
{"Bot id": "obama265", "Campaign": "1685436052", "Version": "404.1320", "C2 list": ["103.42.86.42:995", "174.4.89.3:443", "161.142.103.187:995", "78.160.146.127:443", "84.35.26.14:995", "12.172.173.82:20", "70.28.50.223:2078", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "103.123.223.133:443", "94.207.104.225:443", "89.114.140.100:443", "213.64.33.61:2222", "86.176.144.234:2222", "72.134.124.16:443", "47.34.30.133:443", "109.50.149.241:2222", "85.104.105.67:443", "81.111.108.123:443", "86.173.2.12:2222", "188.28.19.84:443", "41.228.224.161:995", "12.172.173.82:50001", "178.175.187.254:443", "65.95.141.84:2222", "205.237.67.69:995", "83.110.223.61:443", "193.253.100.236:2222", "27.0.48.233:443", "102.159.188.125:443", "71.38.155.217:443", "58.186.75.42:443", "76.178.148.107:2222", "70.28.50.223:2087", "114.143.176.236:443", "51.14.29.227:2222", "59.28.84.65:443", "173.88.135.179:443", "103.144.201.56:2078", "96.87.28.170:2222", "105.184.103.97:995", "176.142.207.63:443", "151.62.238.176:443", "12.172.173.82:32101", "122.186.210.254:443", "82.125.44.236:2222", "84.108.200.161:443", "76.16.49.134:443", "70.28.50.223:32100", "12.172.173.82:465", "76.170.252.153:995", "184.182.66.109:443", "78.92.133.215:443", "50.68.204.71:993", "186.75.95.6:443", "113.11.92.30:443", "70.28.50.223:3389", "98.145.23.67:443", "85.57.212.13:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "69.242.31.249:443", "81.101.185.146:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "86.195.14.72:2222", "81.229.117.95:2222", "220.240.164.182:443", "73.29.92.128:443", "12.172.173.82:21", "96.56.197.26:2222", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "124.122.47.148:443", "122.184.143.86:443", "92.186.69.229:2222", "70.28.50.223:2083", "89.129.109.27:2222", "147.147.30.126:2222", "125.99.76.102:443", "88.126.94.4:50000", "151.65.167.77:443", "86.132.236.117:443", "92.154.17.149:2222", "223.166.13.95:995", "89.36.206.69:995", "96.56.197.26:2083", "78.18.105.11:443", "82.127.153.75:2222", "90.78.147.141:2222", "82.131.141.209:443", "183.87.163.165:443", "92.9.45.20:2222", "80.6.50.34:443", "80.12.88.148:2222", "69.133.162.35:443", "172.115.17.50:443", "95.45.50.93:2222", "12.172.173.82:2087", "103.140.174.20:2222", "24.198.114.130:995", "50.68.204.71:443", "69.119.123.159:2222", "64.121.161.102:443", "2.82.8.80:443", "184.181.75.148:443", "70.112.206.5:443", "198.2.51.242:993", "2.36.64.159:2078", "79.77.142.22:2222", "84.215.202.8:443", "147.219.4.194:443", "116.74.164.81:443", "70.28.50.223:2078"]}
SourceRuleDescriptionAuthorStrings
00000007.00000002.1071797162.000000000029D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Qbot_1Yara detected QbotJoe Security
    00000007.00000002.1072022431.0000000000E3D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_Qbot_1Yara detected QbotJoe Security
      decrypted.memstrJoeSecurity_QbotYara detected QbotJoe Security
        SourceRuleDescriptionAuthorStrings
        7.2.rundll32.exe.1c0000.0.unpackMAL_QakBot_ConfigExtraction_Feb23QakBot Config Extractionkevoreilly
        • 0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9
        • 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
        7.2.rundll32.exe.1c0000.0.unpackJoeSecurity_Qbot_1Yara detected QbotJoe Security
          7.2.rundll32.exe.2aa328.1.raw.unpackMAL_QakBot_ConfigExtraction_Feb23QakBot Config Extractionkevoreilly
          • 0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9
          • 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
          7.2.rundll32.exe.2aa328.1.raw.unpackJoeSecurity_Qbot_1Yara detected QbotJoe Security
            7.2.rundll32.exe.2aa328.1.unpackMAL_QakBot_ConfigExtraction_Feb23QakBot Config Extractionkevoreilly
            • 0xdf71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9
            • 0x9b97:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
            Click to see the 1 entries
            No Sigma rule has matched
            No Snort rule has matched

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Source: 00000007.00000002.1071797162.000000000029D000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Qbot {"Bot id": "obama265", "Campaign": "1685436052", "Version": "404.1320", "C2 list": ["103.42.86.42:995", "174.4.89.3:443", "161.142.103.187:995", "78.160.146.127:443", "84.35.26.14:995", "12.172.173.82:20", "70.28.50.223:2078", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "103.123.223.133:443", "94.207.104.225:443", "89.114.140.100:443", "213.64.33.61:2222", "86.176.144.234:2222", "72.134.124.16:443", "47.34.30.133:443", "109.50.149.241:2222", "85.104.105.67:443", "81.111.108.123:443", "86.173.2.12:2222", "188.28.19.84:443", "41.228.224.161:995", "12.172.173.82:50001", "178.175.187.254:443", "65.95.141.84:2222", "205.237.67.69:995", "83.110.223.61:443", "193.253.100.236:2222", "27.0.48.233:443", "102.159.188.125:443", "71.38.155.217:443", "58.186.75.42:443", "76.178.148.107:2222", "70.28.50.223:2087", "114.143.176.236:443", "51.14.29.227:2222", "59.28.84.65:443", "173.88.135.179:443", "103.144.201.56:2078", "96.87.28.170:2222", "105.184.103.97:995", "176.142.207.63:443", "151.62.238.176:443", "12.172.173.82:32101", "122.186.210.254:443", "82.125.44.236:2222", "84.108.200.161:443", "76.16.49.134:443", "70.28.50.223:32100", "12.172.173.82:465", "76.170.252.153:995", "184.182.66.109:443", "78.92.133.215:443", "50.68.204.71:993", "186.75.95.6:443", "113.11.92.30:443", "70.28.50.223:3389", "98.145.23.67:443", "85.57.212.13:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "69.242.31.249:443", "81.101.185.146:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "86.195.14.72:2222", "81.229.117.95:2222", "220.240.164.182:443", "73.29.92.128:443", "12.172.173.82:21", "96.56.197.26:2222", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "124.122.47.148:443", "122.184.143.86:443", "92.186.69.229:2222", "70.28.50.223:2083", "89.129.109.27:2222", "147.147.30.126:2222", "125.99.76.102:443", "88.126.94.4:50000", "151.65.167.77:443", "86.132.236.117:443", "92.154.17.149:2222", "223.166.13.95:995", "89.36.206.69:995", "96.56.197.26:2083", "78.18.105.11:443", "82.127.153.75:2222", "90.78.147.141:2222", "82.131.141.209:443", "183.87.163.165:443", "92.9.45.20:2222", "80.6.50.34:443", "80.12.88.148:2222", "69.133.162.35:443", "172.115.17.50:443", "95.45.50.93:2222", "12.172.173.82:2087", "103.140.174.20:2222", "24.198.114.130:995", "50.68.204.71:443", "69.119.123.159:2222", "64.121.161.102:443", "2.82.8.80:443", "184.181.75.148:443", "70.112.206.5:443", "198.2.51.242:993", "2.36.64.159:2078", "79.77.142.22:2222", "84.215.202.8:443", "147.219.4.194:443", "116.74.164.81:443", "70.28.50.223:2078"]}
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: error res='%s' err=%d len=%u
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: netstat -nao
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: runas
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ipconfig /all
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: net localgroup
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: nltest /domain_trusts /all_trusts
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %s %04x.%u %04x.%u res: %s seh_test: %u consts_test: %d vmdetected: %d createprocess: %d
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Microsoft
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SELF_TEST_1
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: p%08x
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Self test FAILED!!!
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Self test OK.
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: /t5
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: whoami /all
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: cmd
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: microsoft.com,google.com,cisco.com,oracle.com,verisign.com,broadcom.com,yahoo.com,xfinity.com,irs.gov,linkedin.com
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ERROR: GetModuleFileNameW() failed with error: ERROR_INSUFFICIENT_BUFFER
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: route print
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: .lnk
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: "%s\system32\schtasks.exe" /Create /ST %02u:%02u /RU "NT AUTHORITY\SYSTEM" /SC ONCE /tr "%s" /Z /ET %02u:%02u /tn %s
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: arp -a
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %s "$%s = \"%s\"; & $%s"
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: net share
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: cmd.exe /c set
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Self check
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %u;%u;%u;
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: /c ping.exe -n 6 127.0.0.1 & type "%s\System32\calc.exe" > "%s"
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ProfileImagePath
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: at.exe %u:%u "%s" /I
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ProgramData
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Self check ok!
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: powershell.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: qwinsta
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: net view
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%s
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Component_08
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Start screenshot
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: schtasks.exe /Delete /F /TN %u
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: appidapi.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %s \"$%s = \\\"%s\\\\; & $%s\"
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: c:\ProgramData
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Component_07
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: powershell.exe -encodedCommand %S
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ERROR: GetModuleFileNameW() failed with error: %u
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: powershell.exe -encodedCommand
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SoNuce]ugdiB3c[doMuce2s81*uXmcvP
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: \System32\WindowsPowerShell\v1.0\powershell.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN %u /TR "%s" /NP /F
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: error res='%s' err=%d len=%u
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: netstat -nao
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: runas
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ipconfig /all
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %u.%u.%u.%u.%u.%u.%04x
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\explorer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SystemRoot
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: cscript.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: MBAMService.exe;mbamgui.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\xwizard.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\wermgr.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: C:\INTERNAL\__empty
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: .dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_PhysicalMemory
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ALLUSERSPROFILE
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: image/jpeg
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: LocalLow
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: displayName
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: shlwapi.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\WerFault.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: CommandLine
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: kernel32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SubmitSamplesConsent
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: 1234567890
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: wbj.go
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\wextract.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_DiskDrive
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: vkise.exe;isesrv.exe;cmdagent.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: System32
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Name
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\WerFault.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: WRSA.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: c:\\
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SpyNetReporting
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: FALSE
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: aswhookx.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Packages
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SonicWallClientProtectionService.exe;SWDash.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: application/x-shockwave-flash
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: RepUx.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\mspaint.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Winsta0
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\wermgr.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: avp.exe;kavtray.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: root\SecurityCenter2
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: MsMpEng.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: userenv.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: csc_ui.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: \\.\pipe\
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: pstorec.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: NTUSER.DAT
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: from
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\sethc.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: netapi32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\Utilman.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: gdi32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: setupapi.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SELECT * FROM Win32_Processor
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: iphlpapi.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Caption
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: CrAmTray.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_ComputerSystem
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: user32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: xagtnotif.exe;AppUIMonitor.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\dxdiag.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: \sf2.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\grpconv.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: egui.exe;ekrn.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Software\Microsoft
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %S.%06d
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: bcrypt.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SELECT * FROM AntiVirusProduct
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\SndVol.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\explorer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\Utilman.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: wtsapi32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\xwizard.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: shell32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: TRUE
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_Bios
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SELECT * FROM Win32_OperatingSystem
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\mobsync.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: c:\hiberfil.sysss
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: */*
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: abcdefghijklmnopqrstuvwxyz
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ByteFence.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: type=0x%04X
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: snxhk_border_mywnd
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ROOT\CIMV2
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: https
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\explorer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: fshoster32.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: kernelbase.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: regsvr32.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %s\system32\
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Content-Type: application/x-www-form-urlencoded
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_Process
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: rundll32.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: LOCALAPPDATA
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: cmd.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: APPDATA
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: select
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: .exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: mcshield.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: advapi32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ws2_32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: .cfg
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_Product
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: WQL
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: wininet.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: LastBootUpTime
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: S:(ML;;NW;;;LW)
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: urlmon.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Create
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_PnPEntity
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\grpconv.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Initializing database...
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\SearchIndexer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: winsta0\default
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: .dat
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: WBJ_IGNORE
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: next
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\AtBroker.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: wpcap.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\sethc.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: image/pjpeg
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: fmon.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\SndVol.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: vbs
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: aswhooka.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SysWOW64
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\mspaint.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: mpr.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: image/gif
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: crypt32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ntdll.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: open
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\explorer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: CSFalconService.exe;CSFalconContainer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\wextract.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\mobsync.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %u.%u.%u.%u.%u.%u.%04x
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\explorer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SystemRoot
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: cscript.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: MBAMService.exe;mbamgui.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\xwizard.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\wermgr.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: C:\INTERNAL\__empty
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: .dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_PhysicalMemory
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ALLUSERSPROFILE
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: image/jpeg
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: LocalLow
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: displayName
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: shlwapi.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\WerFault.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: CommandLine
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: kernel32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SubmitSamplesConsent
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: 1234567890
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: wbj.go
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\wextract.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_DiskDrive
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: vkise.exe;isesrv.exe;cmdagent.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: System32
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Name
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\WerFault.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: WRSA.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: c:\\
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SpyNetReporting
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: FALSE
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: aswhookx.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Packages
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SonicWallClientProtectionService.exe;SWDash.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: application/x-shockwave-flash
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: RepUx.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\mspaint.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Winsta0
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\wermgr.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: avp.exe;kavtray.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: root\SecurityCenter2
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: MsMpEng.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: userenv.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: csc_ui.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: \\.\pipe\
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: pstorec.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: NTUSER.DAT
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: from
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\sethc.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: netapi32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\Utilman.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: gdi32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: setupapi.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SELECT * FROM Win32_Processor
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: iphlpapi.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Caption
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: CrAmTray.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_ComputerSystem
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: user32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: xagtnotif.exe;AppUIMonitor.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\dxdiag.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: \sf2.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\grpconv.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: egui.exe;ekrn.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Software\Microsoft
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %S.%06d
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: bcrypt.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SELECT * FROM AntiVirusProduct
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\SndVol.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\explorer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\Utilman.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: wtsapi32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\xwizard.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: shell32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: TRUE
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_Bios
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SELECT * FROM Win32_OperatingSystem
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\mobsync.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: c:\hiberfil.sysss
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: */*
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: abcdefghijklmnopqrstuvwxyz
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ByteFence.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: type=0x%04X
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: snxhk_border_mywnd
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ROOT\CIMV2
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: https
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\explorer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: fshoster32.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: kernelbase.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: regsvr32.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %s\system32\
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Content-Type: application/x-www-form-urlencoded
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_Process
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: rundll32.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: LOCALAPPDATA
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: cmd.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: APPDATA
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: select
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: .exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: mcshield.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: advapi32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ws2_32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: .cfg
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_Product
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: WQL
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: wininet.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: LastBootUpTime
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: S:(ML;;NW;;;LW)
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: urlmon.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Create
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Win32_PnPEntity
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\grpconv.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Initializing database...
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\SearchIndexer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: winsta0\default
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: .dat
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: WBJ_IGNORE
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: next
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\AtBroker.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: wpcap.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\sethc.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: image/pjpeg
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: fmon.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\SndVol.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: vbs
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: aswhooka.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: SysWOW64
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\mspaint.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: mpr.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: image/gif
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: crypt32.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: ntdll.dll
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: open
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\explorer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: CSFalconService.exe;CSFalconContainer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\wextract.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\System32\mobsync.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpackString decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000C0B0 mv_cast5_crypt2,7_2_1000C0B0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000B0D0 mv_camellia_crypt,7_2_1000B0D0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10013100 mv_encryption_init_info_alloc,mv_mallocz,mv_mallocz,mv_mallocz,mv_mallocz,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_calloc,7_2_10013100
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000C1B0 mv_cast5_crypt,7_2_1000C1B0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100132D0 mv_encryption_init_info_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,7_2_100132D0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10002480 mv_aes_ctr_crypt,mv_aes_crypt,7_2_10002480
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10013480 mv_encryption_init_info_get_side_data,mv_encryption_init_info_alloc,mv_free,mv_free,mv_free,mv_free,mv_free,7_2_10013480
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100084B0 mv_blowfish_crypt,mv_blowfish_crypt_ecb,mv_blowfish_crypt_ecb,7_2_100084B0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10032510 mv_get_random_seed,BCryptOpenAlgorithmProvider,BCryptGenRandom,BCryptCloseAlgorithmProvider,mvpriv_open,_read,_close,mvpriv_open,_read,_close,clock,clock,mv_sha_init,mv_sha_update,mv_sha_final,mv_log,abort,7_2_10032510
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10002523 mv_aes_crypt,7_2_10002523
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004D590 mv_twofish_crypt,7_2_1004D590
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001363B mv_encryption_init_info_alloc,7_2_1001363B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000867B mv_blowfish_crypt_ecb,7_2_1000867B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100136FB mv_encryption_init_info_alloc,7_2_100136FB
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10013860 mv_encryption_init_info_add_side_data,mv_malloc,mv_malloc,7_2_10013860
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004A990 mv_tea_crypt,7_2_1004A990
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100339C0 mv_rc4_crypt,7_2_100339C0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10012A70 mv_encryption_info_alloc,mv_mallocz,mv_mallocz,mv_mallocz,mv_calloc,mv_free,mv_free,mv_free,mv_free,7_2_10012A70
            Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
            Source: C:\Windows\SysWOW64\wermgr.exeFile opened: c:Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4x nop then push ebx7_2_1008B470
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4x nop then mov eax, dword ptr [esp+08h]7_2_1008B700

            Networking

            barindex
            Source: Malware configuration extractorIPs: 103.42.86.42:995
            Source: Malware configuration extractorIPs: 174.4.89.3:443
            Source: Malware configuration extractorIPs: 161.142.103.187:995
            Source: Malware configuration extractorIPs: 78.160.146.127:443
            Source: Malware configuration extractorIPs: 84.35.26.14:995
            Source: Malware configuration extractorIPs: 12.172.173.82:20
            Source: Malware configuration extractorIPs: 70.28.50.223:2078
            Source: Malware configuration extractorIPs: 124.149.143.189:2222
            Source: Malware configuration extractorIPs: 70.160.67.203:443
            Source: Malware configuration extractorIPs: 186.64.67.30:443
            Source: Malware configuration extractorIPs: 103.123.223.133:443
            Source: Malware configuration extractorIPs: 94.207.104.225:443
            Source: Malware configuration extractorIPs: 89.114.140.100:443
            Source: Malware configuration extractorIPs: 213.64.33.61:2222
            Source: Malware configuration extractorIPs: 86.176.144.234:2222
            Source: Malware configuration extractorIPs: 72.134.124.16:443
            Source: Malware configuration extractorIPs: 47.34.30.133:443
            Source: Malware configuration extractorIPs: 109.50.149.241:2222
            Source: Malware configuration extractorIPs: 85.104.105.67:443
            Source: Malware configuration extractorIPs: 81.111.108.123:443
            Source: Malware configuration extractorIPs: 86.173.2.12:2222
            Source: Malware configuration extractorIPs: 188.28.19.84:443
            Source: Malware configuration extractorIPs: 41.228.224.161:995
            Source: Malware configuration extractorIPs: 12.172.173.82:50001
            Source: Malware configuration extractorIPs: 178.175.187.254:443
            Source: Malware configuration extractorIPs: 65.95.141.84:2222
            Source: Malware configuration extractorIPs: 205.237.67.69:995
            Source: Malware configuration extractorIPs: 83.110.223.61:443
            Source: Malware configuration extractorIPs: 193.253.100.236:2222
            Source: Malware configuration extractorIPs: 27.0.48.233:443
            Source: Malware configuration extractorIPs: 102.159.188.125:443
            Source: Malware configuration extractorIPs: 71.38.155.217:443
            Source: Malware configuration extractorIPs: 58.186.75.42:443
            Source: Malware configuration extractorIPs: 76.178.148.107:2222
            Source: Malware configuration extractorIPs: 70.28.50.223:2087
            Source: Malware configuration extractorIPs: 114.143.176.236:443
            Source: Malware configuration extractorIPs: 51.14.29.227:2222
            Source: Malware configuration extractorIPs: 59.28.84.65:443
            Source: Malware configuration extractorIPs: 173.88.135.179:443
            Source: Malware configuration extractorIPs: 103.144.201.56:2078
            Source: Malware configuration extractorIPs: 96.87.28.170:2222
            Source: Malware configuration extractorIPs: 105.184.103.97:995
            Source: Malware configuration extractorIPs: 176.142.207.63:443
            Source: Malware configuration extractorIPs: 151.62.238.176:443
            Source: Malware configuration extractorIPs: 12.172.173.82:32101
            Source: Malware configuration extractorIPs: 122.186.210.254:443
            Source: Malware configuration extractorIPs: 82.125.44.236:2222
            Source: Malware configuration extractorIPs: 84.108.200.161:443
            Source: Malware configuration extractorIPs: 76.16.49.134:443
            Source: Malware configuration extractorIPs: 70.28.50.223:32100
            Source: Malware configuration extractorIPs: 12.172.173.82:465
            Source: Malware configuration extractorIPs: 76.170.252.153:995
            Source: Malware configuration extractorIPs: 184.182.66.109:443
            Source: Malware configuration extractorIPs: 78.92.133.215:443
            Source: Malware configuration extractorIPs: 50.68.204.71:993
            Source: Malware configuration extractorIPs: 186.75.95.6:443
            Source: Malware configuration extractorIPs: 113.11.92.30:443
            Source: Malware configuration extractorIPs: 70.28.50.223:3389
            Source: Malware configuration extractorIPs: 98.145.23.67:443
            Source: Malware configuration extractorIPs: 85.57.212.13:3389
            Source: Malware configuration extractorIPs: 50.68.186.195:443
            Source: Malware configuration extractorIPs: 47.205.25.170:443
            Source: Malware configuration extractorIPs: 12.172.173.82:993
            Source: Malware configuration extractorIPs: 12.172.173.82:22
            Source: Malware configuration extractorIPs: 69.242.31.249:443
            Source: Malware configuration extractorIPs: 81.101.185.146:443
            Source: Malware configuration extractorIPs: 79.168.224.165:2222
            Source: Malware configuration extractorIPs: 75.143.236.149:443
            Source: Malware configuration extractorIPs: 14.192.241.76:995
            Source: Malware configuration extractorIPs: 86.195.14.72:2222
            Source: Malware configuration extractorIPs: 81.229.117.95:2222
            Source: Malware configuration extractorIPs: 220.240.164.182:443
            Source: Malware configuration extractorIPs: 73.29.92.128:443
            Source: Malware configuration extractorIPs: 12.172.173.82:21
            Source: Malware configuration extractorIPs: 96.56.197.26:2222
            Source: Malware configuration extractorIPs: 75.109.111.89:443
            Source: Malware configuration extractorIPs: 76.86.31.59:443
            Source: Malware configuration extractorIPs: 201.244.108.183:995
            Source: Malware configuration extractorIPs: 68.203.69.96:443
            Source: Malware configuration extractorIPs: 124.122.47.148:443
            Source: Malware configuration extractorIPs: 122.184.143.86:443
            Source: Malware configuration extractorIPs: 92.186.69.229:2222
            Source: Malware configuration extractorIPs: 70.28.50.223:2083
            Source: Malware configuration extractorIPs: 89.129.109.27:2222
            Source: Malware configuration extractorIPs: 147.147.30.126:2222
            Source: Malware configuration extractorIPs: 125.99.76.102:443
            Source: Malware configuration extractorIPs: 88.126.94.4:50000
            Source: Malware configuration extractorIPs: 151.65.167.77:443
            Source: Malware configuration extractorIPs: 86.132.236.117:443
            Source: Malware configuration extractorIPs: 92.154.17.149:2222
            Source: Malware configuration extractorIPs: 223.166.13.95:995
            Source: Malware configuration extractorIPs: 89.36.206.69:995
            Source: Malware configuration extractorIPs: 96.56.197.26:2083
            Source: Malware configuration extractorIPs: 78.18.105.11:443
            Source: Malware configuration extractorIPs: 82.127.153.75:2222
            Source: Malware configuration extractorIPs: 90.78.147.141:2222
            Source: Malware configuration extractorIPs: 82.131.141.209:443
            Source: Malware configuration extractorIPs: 183.87.163.165:443
            Source: Malware configuration extractorIPs: 92.9.45.20:2222
            Source: Malware configuration extractorIPs: 80.6.50.34:443
            Source: Malware configuration extractorIPs: 80.12.88.148:2222
            Source: Malware configuration extractorIPs: 69.133.162.35:443
            Source: Malware configuration extractorIPs: 172.115.17.50:443
            Source: Malware configuration extractorIPs: 95.45.50.93:2222
            Source: Malware configuration extractorIPs: 12.172.173.82:2087
            Source: Malware configuration extractorIPs: 103.140.174.20:2222
            Source: Malware configuration extractorIPs: 24.198.114.130:995
            Source: Malware configuration extractorIPs: 50.68.204.71:443
            Source: Malware configuration extractorIPs: 69.119.123.159:2222
            Source: Malware configuration extractorIPs: 64.121.161.102:443
            Source: Malware configuration extractorIPs: 2.82.8.80:443
            Source: Malware configuration extractorIPs: 184.181.75.148:443
            Source: Malware configuration extractorIPs: 70.112.206.5:443
            Source: Malware configuration extractorIPs: 198.2.51.242:993
            Source: Malware configuration extractorIPs: 2.36.64.159:2078
            Source: Malware configuration extractorIPs: 79.77.142.22:2222
            Source: Malware configuration extractorIPs: 84.215.202.8:443
            Source: Malware configuration extractorIPs: 147.219.4.194:443
            Source: Malware configuration extractorIPs: 116.74.164.81:443
            Source: Malware configuration extractorIPs: 70.28.50.223:2078
            Source: Joe Sandbox ViewASN Name: MEO-RESIDENCIALPT MEO-RESIDENCIALPT
            Source: Joe Sandbox ViewIP Address: 2.82.8.80 2.82.8.80
            Source: unknownNetwork traffic detected: IP country count 30
            Source: rundll32.exe, rundll32.exe, 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmp, main.dll.2.drString found in binary or memory: https://streams.videolan.org/upload/
            Source: 7.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPEMatched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
            Source: 7.2.rundll32.exe.2aa328.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
            Source: 7.2.rundll32.exe.2aa328.1.unpack, type: UNPACKEDPEMatched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
            Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\725f13.ipiJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\725f12.msiJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100790107_2_10079010
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000D0607_2_1000D060
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100810917_2_10081091
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000B0D07_2_1000B0D0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1007A0F37_2_1007A0F3
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100981187_2_10098118
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1002F1107_2_1002F110
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100081447_2_10008144
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100A415E7_2_100A415E
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100A615C7_2_100A615C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100881947_2_10088194
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100101D07_2_100101D0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001021B7_2_1001021B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100072707_2_10007270
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1002B2707_2_1002B270
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004B2B07_2_1004B2B0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100752F07_2_100752F0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100842F07_2_100842F0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100863107_2_10086310
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1007D3477_2_1007D347
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100213407_2_10021340
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1002C3907_2_1002C390
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004D3B07_2_1004D3B0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004E3E07_2_1004E3E0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1007C4157_2_1007C415
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1002C4287_2_1002C428
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100134807_2_10013480
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000D4D07_2_1000D4D0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100774E27_2_100774E2
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004C5007_2_1004C500
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1007D5117_2_1007D511
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100255507_2_10025550
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100825507_2_10082550
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100285907_2_10028590
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004D5907_2_1004D590
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100105C07_2_100105C0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004D5C17_2_1004D5C1
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1007C5E17_2_1007C5E1
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1008A6407_2_1008A640
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000164B7_2_1000164B
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100A566C7_2_100A566C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100806607_2_10080660
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100276907_2_10027690
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100666917_2_10066691
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100A46FC7_2_100A46FC
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100556F87_2_100556F8
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100247007_2_10024700
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100877487_2_10087748
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100797407_2_10079740
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100107507_2_10010750
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100307507_2_10030750
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100877507_2_10087750
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000E7607_2_1000E760
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100217607_2_10021760
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100107787_2_10010778
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100A57A57_2_100A57A5
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100767C07_2_100767C0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100857F07_2_100857F0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000B8307_2_1000B830
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100208307_2_10020830
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100A58437_2_100A5843
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100328907_2_10032890
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100218A07_2_100218A0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100019007_2_10001900
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1007F9007_2_1007F900
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000D9107_2_1000D910
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100109807_2_10010980
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004A9907_2_1004A990
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001099C7_2_1001099C
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_100499A07_2_100499A0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000C9F07_2_1000C9F0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000FA007_2_1000FA00
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1004BA007_2_1004BA00
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000AA107_2_1000AA10
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10007A507_2_10007A50
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1007CAB77_2_1007CAB7
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1001EAB07_2_1001EAB0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000EAC07_2_1000EAC0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000FAE07_2_1000FAE0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1000FAF77_2_1000FAF7
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10081AF07_2_10081AF0
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10020B007_2_10020B00
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10078B107_2_10078B10
            Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 77620000 page execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 77740000 page execute and read and writeJump to behavior
            Source: C:\Windows\System32\rundll32.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\r3zg12.msi"
            Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
            Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
            Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,nextJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbsJump to behavior
            Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,nextJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exeJump to behavior
            Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPluginJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\~DFCE21E83529306783.TMPJump to behavior
            Source: classification engineClassification label: mal92.troj.evad.winMSI@10/11@0/100
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
            Source: C:\Windows\SysWOW64\wermgr.exeMutant created: \Sessions\1\BaseNamedObjects\{7DD17790-B8AD-4410-A157-17ED3BEC62EE}
            Source: C:\Windows\SysWOW64\wermgr.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{7DD17790-B8AD-4410-A157-17ED3BEC62EE}
            Source: C:\Windows\SysWOW64\wermgr.exeMutant created: \Sessions\1\BaseNamedObjects\{4F34BA3E-DAF6-44F5-9C34-3488F9C4B308}
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1008C51C push es; ret 7_2_1008C521
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1008C5CA push es; ret 7_2_1008C5CB
            Source: main.dll.2.drStatic PE information: real checksum: 0xe9e0f should be: 0xee24d
            Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dllJump to dropped file
            Source: C:\Windows\System32\msiexec.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestoreJump to behavior
            Source: C:\Windows\System32\msiexec.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisherJump to behavior

            Hooking and other Techniques for Hiding and Protection

            barindex
            Source: C:\Windows\SysWOW64\rundll32.exeMemory written: PID: 3332 base: BD2AFF value: E9 B4 E8 55 FF Jump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wscript.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\msiexec.exe TID: 2388Thread sleep time: -180000s >= -30000sJump to behavior
            Source: C:\Windows\System32\msiexec.exe TID: 3288Thread sleep time: -60000s >= -30000sJump to behavior
            Source: C:\Windows\System32\msiexec.exe TID: 2572Thread sleep time: -360000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exe TID: 3264Thread sleep count: 109 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10032510 rdtsc 7_2_10032510
            Source: C:\Windows\SysWOW64\rundll32.exeAPI coverage: 0.0 %
            Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
            Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior

            Anti Debugging

            barindex
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10032510 Start: 100327F5 End: 1003263E7_2_10032510
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_10032510 rdtsc 7_2_10032510
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_3_00142297 mov eax, dword ptr fs:[00000030h]7_3_00142297
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1002A9E9 mov eax, dword ptr fs:[00000030h]7_2_1002A9E9
            Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,nextJump to behavior

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Source: C:\Windows\SysWOW64\rundll32.exeMemory written: C:\Windows\SysWOW64\wermgr.exe base: 80000Jump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeMemory written: C:\Windows\SysWOW64\wermgr.exe base: 130000Jump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeMemory written: C:\Windows\SysWOW64\wermgr.exe base: BD2AFFJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: C:\Windows\SysWOW64\wermgr.exe base: 130000 protect: page execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: C:\Windows\SysWOW64\wermgr.exe base: 80000 protect: page read and writeJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeMemory written: C:\Windows\SysWOW64\wermgr.exe base: 130000 value starts with: 4D5AJump to behavior
            Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,nextJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exeJump to behavior
            Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\wermgr.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\wermgr.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1008B030 cpuid 7_2_1008B030
            Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: C:\Windows\SysWOW64\rundll32.exeCode function: 7_2_1008F660 GetTimeZoneInformation,GetModuleHandleA,GetProcAddress,7_2_1008F660

            Stealing of Sensitive Information

            barindex
            Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
            Source: Yara matchFile source: 7.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.rundll32.exe.2aa328.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.rundll32.exe.2aa328.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000007.00000002.1071797162.000000000029D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.1072022431.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

            Remote Access Functionality

            barindex
            Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
            Source: Yara matchFile source: 7.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.rundll32.exe.2aa328.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.rundll32.exe.2aa328.1.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000007.00000002.1071797162.000000000029D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.1072022431.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            1
            Replication Through Removable Media
            11
            Scripting
            2
            Windows Service
            2
            Windows Service
            11
            Masquerading
            1
            Credential API Hooking
            1
            System Time Discovery
            1
            Replication Through Removable Media
            1
            Credential API Hooking
            Exfiltration Over Other Network Medium2
            Encrypted Channel
            Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization Scripts311
            Process Injection
            1
            Virtualization/Sandbox Evasion
            LSASS Memory1
            Security Software Discovery
            Remote Desktop Protocol1
            Archive Collected Data
            Exfiltration Over Bluetooth1
            Application Layer Protocol
            Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
            Disable or Modify Tools
            Security Account Manager1
            Virtualization/Sandbox Evasion
            SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)311
            Process Injection
            NTDS1
            Process Discovery
            Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script11
            Scripting
            LSA Secrets11
            Peripheral Device Discovery
            SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.common2
            Obfuscated Files or Information
            Cached Domain Credentials23
            System Information Discovery
            VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup Items1
            Rundll32
            DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
            Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
            File Deletion
            Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 878465 Sample: r3zg12.msi Startdate: 30/05/2023 Architecture: WINDOWS Score: 92 25 2.36.64.159 VODAFONE-IT-ASNIT Italy 2->25 27 85.57.212.13 UNI2-ASES Spain 2->27 29 98 other IPs or domains 2->29 39 Found malware configuration 2->39 41 Yara detected Qbot 2->41 43 Sample uses string decryption to hide its real strings 2->43 45 C2 URLs / IPs found in malware configuration 2->45 9 msiexec.exe 81 25 2->9         started        12 msiexec.exe 3 2->12         started        signatures3 process4 file5 23 C:\Users\user\AppData\Local\...\main.dll, PE32 9->23 dropped 14 rundll32.exe 9->14         started        16 wscript.exe 9->16         started        process6 process7 18 rundll32.exe 14->18         started        signatures8 31 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 18->31 33 Writes to foreign memory regions 18->33 35 Allocates memory in foreign processes 18->35 37 2 other signatures 18->37 21 wermgr.exe 8 1 18->21         started        process9

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand
            SourceDetectionScannerLabelLink
            r3zg12.msi0%ReversingLabs
            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll0%ReversingLabs
            No Antivirus matches
            No Antivirus matches
            No Antivirus matches
            No contacted domains info
            NameSourceMaliciousAntivirus DetectionReputation
            https://streams.videolan.org/upload/rundll32.exe, rundll32.exe, 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmp, main.dll.2.drfalse
              high
              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs
              IPDomainCountryFlagASNASN NameMalicious
              2.82.8.80
              unknownPortugal
              3243MEO-RESIDENCIALPTtrue
              70.160.67.203
              unknownUnited States
              22773ASN-CXA-ALL-CCI-22773-RDCUStrue
              75.143.236.149
              unknownUnited States
              20115CHARTER-20115UStrue
              83.110.223.61
              unknownUnited Arab Emirates
              5384EMIRATES-INTERNETEmiratesInternetAEtrue
              86.195.14.72
              unknownFrance
              3215FranceTelecom-OrangeFRtrue
              84.215.202.8
              unknownNorway
              41164GET-NOGETNorwayNOtrue
              184.182.66.109
              unknownUnited States
              22773ASN-CXA-ALL-CCI-22773-RDCUStrue
              105.184.103.97
              unknownSouth Africa
              37457Telkom-InternetZAtrue
              92.186.69.229
              unknownFrance
              12479UNI2-ASEStrue
              174.4.89.3
              unknownCanada
              6327SHAWCAtrue
              161.142.103.187
              unknownMalaysia
              9930TTNET-MYTIMEdotComBerhadMYtrue
              114.143.176.236
              unknownIndia
              17762HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdINtrue
              14.192.241.76
              unknownMalaysia
              9534MAXIS-AS1-APBinariangBerhadMYtrue
              173.88.135.179
              unknownUnited States
              10796TWC-10796-MIDWESTUStrue
              84.108.200.161
              unknownIsrael
              8551BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneILtrue
              47.34.30.133
              unknownUnited States
              20115CHARTER-20115UStrue
              183.87.163.165
              unknownIndia
              132220JPRDIGITAL-INJPRDigitalPvtLtdINtrue
              124.149.143.189
              unknownAustralia
              7545TPG-INTERNET-APTPGTelecomLimitedAUtrue
              184.181.75.148
              unknownUnited States
              22773ASN-CXA-ALL-CCI-22773-RDCUStrue
              84.35.26.14
              unknownNetherlands
              21221INFOPACT-ASTheNetherlandsNLtrue
              73.29.92.128
              unknownUnited States
              7922COMCAST-7922UStrue
              68.203.69.96
              unknownUnited States
              11427TWC-11427-TEXASUStrue
              82.131.141.209
              unknownHungary
              20845DIGICABLEHUtrue
              64.121.161.102
              unknownUnited States
              6079RCN-ASUStrue
              178.175.187.254
              unknownMoldova Republic of
              43289TRABIAMDtrue
              96.56.197.26
              unknownUnited States
              6128CABLE-NET-1UStrue
              186.64.67.30
              unknownArgentina
              27953NODOSUDSAARtrue
              188.28.19.84
              unknownUnited Kingdom
              206067H3GUKGBtrue
              125.99.76.102
              unknownIndia
              17488HATHWAY-NET-APHathwayIPOverCableInternetINtrue
              81.101.185.146
              unknownUnited Kingdom
              5089NTLGBtrue
              86.176.144.234
              unknownUnited Kingdom
              2856BT-UK-ASBTnetUKRegionalnetworkGBtrue
              59.28.84.65
              unknownKorea Republic of
              4766KIXS-AS-KRKoreaTelecomKRtrue
              76.86.31.59
              unknownUnited States
              20001TWC-20001-PACWESTUStrue
              147.147.30.126
              unknownUnited Kingdom
              6871PLUSNETUKInternetServiceProviderGBtrue
              96.87.28.170
              unknownUnited States
              7922COMCAST-7922UStrue
              75.109.111.89
              unknownUnited States
              19108SUDDENLINK-COMMUNICATIONSUStrue
              78.92.133.215
              unknownHungary
              5483MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHUtrue
              124.122.47.148
              unknownThailand
              17552TRUE-AS-APTrueInternetCoLtdTHtrue
              88.126.94.4
              unknownFrance
              12322PROXADFRtrue
              51.14.29.227
              unknownUnited Kingdom
              2856BT-UK-ASBTnetUKRegionalnetworkGBtrue
              85.57.212.13
              unknownSpain
              12479UNI2-ASEStrue
              47.205.25.170
              unknownUnited States
              5650FRONTIER-FRTRUStrue
              95.45.50.93
              unknownIreland
              5466EIRCOMInternetHouseIEtrue
              80.12.88.148
              unknownFrance
              3215FranceTelecom-OrangeFRtrue
              81.111.108.123
              unknownUnited Kingdom
              5089NTLGBtrue
              69.133.162.35
              unknownUnited States
              11426TWC-11426-CAROLINASUStrue
              86.132.236.117
              unknownUnited Kingdom
              2856BT-UK-ASBTnetUKRegionalnetworkGBtrue
              151.62.238.176
              unknownItaly
              1267ASN-WINDTREIUNETEUtrue
              70.112.206.5
              unknownUnited States
              11427TWC-11427-TEXASUStrue
              41.228.224.161
              unknownTunisia
              37693TUNISIANATNtrue
              205.237.67.69
              unknownCanada
              11290CC-3272CAtrue
              102.159.188.125
              unknownTunisia
              37705TOPNETTNtrue
              151.65.167.77
              unknownItaly
              1267ASN-WINDTREIUNETEUtrue
              76.178.148.107
              unknownUnited States
              10838OCEANIC-INTERNET-RRUStrue
              89.36.206.69
              unknownItaly
              48544TECNOADSL-ASITtrue
              69.242.31.249
              unknownUnited States
              7922COMCAST-7922UStrue
              85.104.105.67
              unknownTurkey
              9121TTNETTRtrue
              94.207.104.225
              unknownUnited Arab Emirates
              15802DU-AS1AEtrue
              193.253.100.236
              unknownFrance
              3215FranceTelecom-OrangeFRtrue
              76.16.49.134
              unknownUnited States
              7922COMCAST-7922UStrue
              201.244.108.183
              unknownColombia
              19429ETB-ColombiaCOtrue
              103.42.86.42
              unknownIndia
              133660EDIGITAL-ASE-InfrastructureandEntertainmentIndiaPvtLttrue
              78.18.105.11
              unknownIreland
              2110AS-BTIREBTIrelandwaspreviouslyknownasEsatNetEUnettrue
              80.6.50.34
              unknownUnited Kingdom
              5089NTLGBtrue
              103.144.201.56
              unknownunknown
              139762MSSOLUTION-AS-APSolutionBDtrue
              27.0.48.233
              unknownIndia
              132573SAINGN-AS-INSAINGNNetworkServicesINtrue
              70.28.50.223
              unknownCanada
              577BACOMCAtrue
              98.145.23.67
              unknownUnited States
              20001TWC-20001-PACWESTUStrue
              82.125.44.236
              unknownFrance
              3215FranceTelecom-OrangeFRtrue
              81.229.117.95
              unknownSweden
              3301TELIANET-SWEDENTeliaCompanySEtrue
              89.129.109.27
              unknownSpain
              12479UNI2-ASEStrue
              122.186.210.254
              unknownIndia
              9498BBIL-APBHARTIAirtelLtdINtrue
              79.77.142.22
              unknownUnited Kingdom
              9105TISCALI-UKTalkTalkCommunicationsLimitedGBtrue
              90.78.147.141
              unknownFrance
              3215FranceTelecom-OrangeFRtrue
              122.184.143.86
              unknownIndia
              9498BBIL-APBHARTIAirtelLtdINtrue
              186.75.95.6
              unknownPanama
              11556CableWirelessPanamaPAtrue
              50.68.186.195
              unknownCanada
              6327SHAWCAtrue
              12.172.173.82
              unknownUnited States
              2386INS-ASUStrue
              213.64.33.61
              unknownSweden
              3301TELIANET-SWEDENTeliaCompanySEtrue
              79.168.224.165
              unknownPortugal
              2860NOS_COMUNICACOESPTtrue
              176.142.207.63
              unknownFrance
              5410BOUYGTEL-ISPFRtrue
              86.173.2.12
              unknownUnited Kingdom
              2856BT-UK-ASBTnetUKRegionalnetworkGBtrue
              92.154.17.149
              unknownFrance
              3215FranceTelecom-OrangeFRtrue
              78.160.146.127
              unknownTurkey
              9121TTNETTRtrue
              58.186.75.42
              unknownViet Nam
              18403FPT-AS-APTheCorporationforFinancingPromotingTechnolotrue
              223.166.13.95
              unknownChina
              17621CNCGROUP-SHChinaUnicomShanghainetworkCNtrue
              65.95.141.84
              unknownCanada
              577BACOMCAtrue
              50.68.204.71
              unknownCanada
              6327SHAWCAtrue
              71.38.155.217
              unknownUnited States
              209CENTURYLINK-US-LEGACY-QWESTUStrue
              220.240.164.182
              unknownAustralia
              7545TPG-INTERNET-APTPGTelecomLimitedAUtrue
              103.123.223.133
              unknownIndia
              138329KWS-AS-APKenstarWebSolutionsPrivateLimitedINtrue
              24.198.114.130
              unknownUnited States
              11351TWC-11351-NORTHEASTUStrue
              2.36.64.159
              unknownItaly
              30722VODAFONE-IT-ASNITtrue
              198.2.51.242
              unknownUnited States
              20001TWC-20001-PACWESTUStrue
              92.9.45.20
              unknownUnited Kingdom
              13285OPALTELECOM-ASTalkTalkCommunicationsLimitedGBtrue
              113.11.92.30
              unknownBangladesh
              7565BDCOM-BDRangsNiluSquare5thFloorHouse75Road5ADtrue
              109.50.149.241
              unknownPortugal
              2860NOS_COMUNICACOESPTtrue
              69.119.123.159
              unknownUnited States
              6128CABLE-NET-1UStrue
              172.115.17.50
              unknownUnited States
              20001TWC-20001-PACWESTUStrue
              147.219.4.194
              unknownUnited States
              1498DNIC-ASBLK-01498-01499UStrue
              Joe Sandbox Version:37.1.0 Beryl
              Analysis ID:878465
              Start date and time:2023-05-30 17:55:55 +02:00
              Joe Sandbox Product:CloudBasic
              Overall analysis duration:0h 8m 7s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:defaultwindowsofficecookbook.jbs
              Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
              Number of analysed new started processes analysed:9
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • HDC enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample file name:r3zg12.msi
              Detection:MAL
              Classification:mal92.troj.evad.winMSI@10/11@0/100
              EGA Information:
              • Successful, ratio: 100%
              HDC Information:Failed
              HCA Information:
              • Successful, ratio: 81%
              • Number of executed functions: 9
              • Number of non-executed functions: 276
              Cookbook Comments:
              • Found application associated with file extension: .msi
              • Close Viewer
              • Exclude process from analysis (whitelisted): dllhost.exe, VSSVC.exe, svchost.exe
              • Report size exceeded maximum capacity and may have missing disassembly code.
              • Report size getting too big, too many NtCreateFile calls found.
              • Report size getting too big, too many NtFsControlFile calls found.
              • Report size getting too big, too many NtOpenFile calls found.
              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
              • VT rate limit hit for: r3zg12.msi
              TimeTypeDescription
              17:57:02API Interceptor1844x Sleep call for process: msiexec.exe modified
              17:57:33API Interceptor23x Sleep call for process: rundll32.exe modified
              17:57:33API Interceptor247x Sleep call for process: wscript.exe modified
              17:57:37API Interceptor179x Sleep call for process: wermgr.exe modified
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              2.82.8.80main.dllGet hashmaliciousQbotBrowse
                graphically.dat.dllGet hashmaliciousQbotBrowse
                  kxyj5.dat.dllGet hashmaliciousQbotBrowse
                    PXNuYAPR.dat.dllGet hashmaliciousQbotBrowse
                      TB9mkKe4Qzu.dat.dllGet hashmaliciousQbotBrowse
                        leiotrichy.jsGet hashmaliciousQbotBrowse
                          a0UFMZnC6ltxphw.dat.dllGet hashmaliciousQbotBrowse
                            msfilter.dllGet hashmaliciousQbotBrowse
                              QPAWJ8VnpO.dllGet hashmaliciousQbotBrowse
                                Cjpxxx.jsGet hashmaliciousQbotBrowse
                                  analysis.dllGet hashmaliciousQbotBrowse
                                    ss3.dllGet hashmaliciousQbotBrowse
                                      Ffzknz.jsGet hashmaliciousQbotBrowse
                                        Onhytfnr.jsGet hashmaliciousQbotBrowse
                                          Hlyl.jsGet hashmaliciousQbotBrowse
                                            Emrd.jsGet hashmaliciousQbotBrowse
                                              XyU8ZgqTP.dllGet hashmaliciousCryptOne, QbotBrowse
                                                beautydomPorrigo.Reargument.dllGet hashmaliciousCryptOne, QbotBrowse
                                                  Qwvupnjn.jsGet hashmaliciousQbotBrowse
                                                    Friendlily.Allineate.dllGet hashmaliciousQbotBrowse
                                                      No context
                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      MEO-RESIDENCIALPTmain.dllGet hashmaliciousQbotBrowse
                                                      • 2.82.8.80
                                                      graphically.dat.dllGet hashmaliciousQbotBrowse
                                                      • 2.82.8.80
                                                      LEo7jDCX96.elfGet hashmaliciousMiraiBrowse
                                                      • 2.81.219.243
                                                      yvweY4vsVq.elfGet hashmaliciousMiraiBrowse
                                                      • 188.81.116.228
                                                      8C3RpG9eka.elfGet hashmaliciousMiraiBrowse
                                                      • 85.244.28.246
                                                      Pc8ewtsPRR.elfGet hashmaliciousMiraiBrowse
                                                      • 85.240.179.8
                                                      33cWz2DNq2.elfGet hashmaliciousMiraiBrowse
                                                      • 2.83.183.198
                                                      pu3jOk0Q9u.elfGet hashmaliciousMiraiBrowse
                                                      • 82.155.117.104
                                                      6mu5y2WWPK.elfGet hashmaliciousMiraiBrowse
                                                      • 85.246.119.61
                                                      A6BM2Ru5xc.elfGet hashmaliciousMiraiBrowse
                                                      • 37.189.107.20
                                                      43acf3.msiGet hashmaliciousQbotBrowse
                                                      • 188.83.251.100
                                                      43acf3.msiGet hashmaliciousQbotBrowse
                                                      • 188.83.251.100
                                                      666.dat.dllGet hashmaliciousQbotBrowse
                                                      • 188.83.251.100
                                                      UnhookAverment.jsGet hashmaliciousUnknownBrowse
                                                      • 188.251.219.243
                                                      kxyj5.dat.dllGet hashmaliciousQbotBrowse
                                                      • 2.82.8.80
                                                      PXNuYAPR.dat.dllGet hashmaliciousQbotBrowse
                                                      • 2.82.8.80
                                                      TB9mkKe4Qzu.dat.dllGet hashmaliciousQbotBrowse
                                                      • 2.82.8.80
                                                      leiotrichy.jsGet hashmaliciousQbotBrowse
                                                      • 2.82.8.80
                                                      a0UFMZnC6ltxphw.dat.dllGet hashmaliciousQbotBrowse
                                                      • 2.82.8.80
                                                      nBUpGo3m42.elfGet hashmaliciousUnknownBrowse
                                                      • 144.67.82.14
                                                      No context
                                                      No context
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):8650
                                                      Entropy (8bit):5.53533566252833
                                                      Encrypted:false
                                                      SSDEEP:96:ke6Ke2crqUNPw9CsAqWUNPw9C6jvogU/AqmHVP0cdxnG3ciuHsjfLwCUVp3B2BJB:kqeH9wgS9wgvcnY3UVpi
                                                      MD5:C3EE277FD29FA58F348CE837640A6248
                                                      SHA1:9A776BC167BD6816A2F16488D1CA279144076CE2
                                                      SHA-256:5C577159B0F56A406D538702FC2E0E56F66E43CDF0E39C4BFB5F4681317B4A45
                                                      SHA-512:51EE05D5D9CD3A78ACB82F44E746B33F0DD0E2E93AAF77AC0FA95C594D65A8E270F97A703FEE8236BD4C0F660C1B80364D14A0AF117D17C60FC4AB676B9E56F2
                                                      Malicious:false
                                                      Preview:...@IXOS.@.....@..V.@.....@.....@.....@.....@.....@......&.{BADFC54D-C40E-45B2-8055-C154444F1F83}'.Adobe Acrobat PDF Browser Plugin 4.8.25..r3zg12.msi.@.....@.....@.....@........&.{880CDD59-0C2C-49AC-BA45-82BB01CD8BD1}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}&.{BADFC54D-C40E-45B2-8055-C154444F1F83}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..:.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\....B.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll....D.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs....WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@....%.Software\AdobeAcrobatPDFBrowserPlugin...@....(.&...AdobeAcrobatPDFBro
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                      Category:dropped
                                                      Size (bytes):952832
                                                      Entropy (8bit):6.765768694509863
                                                      Encrypted:false
                                                      SSDEEP:24576:UkgLxg2eMP8EN8Vo7zgDQ9uo4iZSBi/u3wXqx9jKVM5qx0YJ:x/jDQMo49wpq
                                                      MD5:5E107608DD00957472DB2C1FCC77599D
                                                      SHA1:D9BFA3E88CA0F86182CB84D4008AC6B346B755E9
                                                      SHA-256:185737016A01E84BF88523A4681723B4F2D0D22520E77B76740CC3C6323E38BF
                                                      SHA-512:22DFAE946F939EB361CEF49ED6EB953097A23A31BE0E97E6B7D31D3B2152C2371DA44E9E6BDD369E7145856BA75369FEA4DEAB18FA035E2A2CBD1E7D4E23CAF4
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m..d...........#...8...................................................... ...........@... .........................hC......<............................ ...?..........................$J.......................................................text...4...........................`.0`.data...............................@.0..rdata..|...........................@.0@.bss....D....p.......>................0..edata..hC.......D...>..............@.0@.idata..<...........................@.0..CRT....0...........................@.0..tls................................@.0..rsrc...b...........................@.0..reloc...?.......@...J..............@.0B................................................................................................................................................................................................................................
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:ASCII text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):132
                                                      Entropy (8bit):4.599233980549996
                                                      Encrypted:false
                                                      SSDEEP:3:LwBxFkvH4dGmMKLVKRLGPz4VAFkvH4dGmMKLVKRLGH:cHFkvYdlZKRLi7FkvYdlZKRL4
                                                      MD5:0D4C9F15CE74465C59AE36A27F98C817
                                                      SHA1:9CCE8EEFA4D3D9C5E161C5DBB860CFE1489C6B1A
                                                      SHA-256:D24E3399060B51F3A1C9D41A67DE2601888A35C99DA8DB70070D757BB3F1913A
                                                      SHA-512:9BED0EAFC2CF2A2360850CA1070FFB04AC14F04C78379485998A93F45012B5C11CC7F6F68129F65B8B5F90437CB965908C6A1BB9D83A56B068D6BDE1D5FDAD1F
                                                      Malicious:false
                                                      Preview:MsgBox "Adobe Acrobat PDF Browser Plugin installation error 0x00000328", 16, "Adobe Acrobat PDF Browser Plugin installation error"..
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):512
                                                      Entropy (8bit):0.0
                                                      Encrypted:false
                                                      SSDEEP:3::
                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                      Malicious:false
                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):32768
                                                      Entropy (8bit):0.06947604271114201
                                                      Encrypted:false
                                                      SSDEEP:6:2/9LG7iVCnLG7iVrKOzPLHKOGljlnucCRjQVky6lS:2F0i8n0itFzDHFZRRS
                                                      MD5:D429E7962EAB07E07C545C296E8B0F35
                                                      SHA1:9AC331509B3E15434194BAECFA89488D380435FC
                                                      SHA-256:14064733FE0126C92AE648CE46DD3AF9820F19CA4F87B6FFCD9134C3A4FD19EE
                                                      SHA-512:BF7726A85BAFFE69B531188332BBE26F1ADFF215BAB9CB3FFA26B2FC1A6D6D337328E1670526C5040AF4C6F39E838456DE85834EBB97A704A641A76132970259
                                                      Malicious:false
                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):69632
                                                      Entropy (8bit):0.12150165085044722
                                                      Encrypted:false
                                                      SSDEEP:24:jIAWMQQt7E818lOdWmDqqrb9ipVIdWmDqqrb9ipV7VIwGklrkgV+rRH:cAWMNC818lEOMSoOMS5RrV
                                                      MD5:152881F8DC204D99AEBA2705A3782FCB
                                                      SHA1:660CC21C9CAC248ABAEDB2BA0C5584BCA6336755
                                                      SHA-256:9BF23AB3B18670ADA93F47C692FADA5B6652AC14C1887F6D78932E237B141BE6
                                                      SHA-512:DC0C2C8B8A2BAE9227538E8AECC236B9ED99E5BFFDC2E848B13303ECEE8215E20ECCE5764193847093708A90F8860AA96A5BD302228E83194706612C054D54B9
                                                      Malicious:false
                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {880CDD59-0C2C-49AC-BA45-82BB01CD8BD1}, Create Time/Date: Tue May 30 14:29:16 2023, Last Saved Time/Date: Tue May 30 14:29:16 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
                                                      Category:dropped
                                                      Size (bytes):507904
                                                      Entropy (8bit):7.919635795804226
                                                      Encrypted:false
                                                      SSDEEP:12288:vn+NgINNEcfjVRMigNFoILI8KviLjvhAN+S0w3:vnX9gjVRMDqH8fL1+35
                                                      MD5:665AFC8F8B7972F427FE1BD90D263032
                                                      SHA1:CC36E48F383750EB9416961B52EE3100B6E30688
                                                      SHA-256:D764436CAF7114D880F982D208BD9514A433772DCAC851F27C510D1597E26EDD
                                                      SHA-512:D30110DC240790A1F0C15DF31069D361F80DF327C258DD3305E70EB9EE3814C285AB6290E88E4072B375F7DAC3D183D22ABA29CB94FDD7DB937C4399C18AD37E
                                                      Malicious:false
                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                      Category:dropped
                                                      Size (bytes):20480
                                                      Entropy (8bit):1.5290834806885116
                                                      Encrypted:false
                                                      SSDEEP:24:JoFC/lym6cpmUHCAjluSwPc+rVdWmDqqrb9ipV7VIwGklrkgsdWmDqqrb9ipVi8d:K0+cDHBluIEOMS5RrmOMSI818lnAWMN
                                                      MD5:F79FA452955160DEA66B355C79633348
                                                      SHA1:DF8591F44D592B2DED4CC19C50944D0C9C7A1EA2
                                                      SHA-256:98D499E3EE487BC8A41B4339F34E48ADF45D504D743F381DBA3979CF4B63BA46
                                                      SHA-512:663F75D95F9B059DDAC7AFFA125891EF193463A15B631B2E587E5DCF10D29EB770542080317BB493C75972C197B291A271EEB7E3CD8DE720135D24BB10D28A93
                                                      Malicious:false
                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {880CDD59-0C2C-49AC-BA45-82BB01CD8BD1}, Create Time/Date: Tue May 30 14:29:16 2023, Last Saved Time/Date: Tue May 30 14:29:16 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
                                                      Category:dropped
                                                      Size (bytes):507904
                                                      Entropy (8bit):7.919635795804226
                                                      Encrypted:false
                                                      SSDEEP:12288:vn+NgINNEcfjVRMigNFoILI8KviLjvhAN+S0w3:vnX9gjVRMDqH8fL1+35
                                                      MD5:665AFC8F8B7972F427FE1BD90D263032
                                                      SHA1:CC36E48F383750EB9416961B52EE3100B6E30688
                                                      SHA-256:D764436CAF7114D880F982D208BD9514A433772DCAC851F27C510D1597E26EDD
                                                      SHA-512:D30110DC240790A1F0C15DF31069D361F80DF327C258DD3305E70EB9EE3814C285AB6290E88E4072B375F7DAC3D183D22ABA29CB94FDD7DB937C4399C18AD37E
                                                      Malicious:false
                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):2138
                                                      Entropy (8bit):5.574222322102891
                                                      Encrypted:false
                                                      SSDEEP:48:VT5zj3JwCP3NDufgzYjRBoD8SY1eU/Fn9nhaEVlt+Xtu2:V/rYjrAueGnaEPi
                                                      MD5:D677AFC93165EECE0A0BF927F0813BC0
                                                      SHA1:374BAA5C81F013F5A665D23376BE78FD27A97A26
                                                      SHA-256:9C430E95C05E227034C66BBFE82596D108E698689CE7146E1A64139674C29607
                                                      SHA-512:27A88CACD02BB8AE072098411E8F52C22FC91FF0B6B2BECE3FED8910E531BF16BCFF408D63E062BA400D548893C2DBFEBAAA1B894248E149640047D535AC43B8
                                                      Malicious:false
                                                      Preview:...@IXOS.@.....@..V.@.....@.....@.....@.....@.....@......&.{BADFC54D-C40E-45B2-8055-C154444F1F83}'.Adobe Acrobat PDF Browser Plugin 4.8.25..r3zg12.msi.@.....@.....@.....@........&.{880CDD59-0C2C-49AC-BA45-82BB01CD8BD1}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}F.01:\Software\AdobeAcrobatPDFBrowserPlugin\AdobeAcrobatPDFBrowserPlugin.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@......:.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\..).1\xssanpen\|AdobeAcrobatPDFBrowserPlugin\......Please insert the disk: ..media3.cab.@.....@......C:\Windows\Installer\725f12.msi.........@........main.dll..dll_main..main.dll.@.....@.....@.......@...
                                                      Process:C:\Windows\System32\msiexec.exe
                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                      Category:dropped
                                                      Size (bytes):20480
                                                      Entropy (8bit):1.1629135735710199
                                                      Encrypted:false
                                                      SSDEEP:12:JSbX72FjRAGiLIlHVRpth/7777777777777777777777777vDHFZRwpSl0i8Q:J3QI5p0F
                                                      MD5:43D53436CE3F850800B0ACC9CDAA39B9
                                                      SHA1:E7C780CC0555D1E5A10AF2B0736C1985D2294758
                                                      SHA-256:913C3DA22ABBA627ECFB121EF494CDC045D0BD6659BE7C8F2FD2328A45ED879C
                                                      SHA-512:6D41E88A82F3515194869BCC7D66EE28E6A2FFF9B3861A5CC10D5A60F8175E61C20C34AB9C00F7978053C21803C6337FA6FCD156F4A4FB69183ED21551916138
                                                      Malicious:false
                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                      File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {880CDD59-0C2C-49AC-BA45-82BB01CD8BD1}, Create Time/Date: Tue May 30 14:29:16 2023, Last Saved Time/Date: Tue May 30 14:29:16 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
                                                      Entropy (8bit):7.919635795804226
                                                      TrID:
                                                      • Generic OLE2 / Multistream Compound File (8008/1) 100.00%
                                                      File name:r3zg12.msi
                                                      File size:507904
                                                      MD5:665afc8f8b7972f427fe1bd90d263032
                                                      SHA1:cc36e48f383750eb9416961b52ee3100b6e30688
                                                      SHA256:d764436caf7114d880f982d208bd9514a433772dcac851f27c510d1597e26edd
                                                      SHA512:d30110dc240790a1f0c15df31069d361f80df327c258dd3305e70eb9ee3814c285ab6290e88e4072b375f7dac3d183d22aba29cb94fdd7db937c4399c18ad37e
                                                      SSDEEP:12288:vn+NgINNEcfjVRMigNFoILI8KviLjvhAN+S0w3:vnX9gjVRMDqH8fL1+35
                                                      TLSH:21B42359660A6371C4C826B2E73E77CFAAA27C5507038433C33B72DE1D775B81A663A1
                                                      File Content Preview:........................>......................................................................................................................................................................................................................................
                                                      Icon Hash:2d2e3797b32b2b99
                                                      No network behavior found

                                                      Click to jump to process

                                                      Click to jump to process

                                                      Click to dive into process behavior distribution

                                                      Click to jump to process

                                                      Target ID:1
                                                      Start time:17:57:02
                                                      Start date:30/05/2023
                                                      Path:C:\Windows\System32\msiexec.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\r3zg12.msi"
                                                      Imagebase:0xff920000
                                                      File size:128512 bytes
                                                      MD5 hash:AC2E7152124CEED36846BD1B6592A00F
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate

                                                      Target ID:2
                                                      Start time:17:57:02
                                                      Start date:30/05/2023
                                                      Path:C:\Windows\System32\msiexec.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\msiexec.exe /V
                                                      Imagebase:0xff920000
                                                      File size:128512 bytes
                                                      MD5 hash:AC2E7152124CEED36846BD1B6592A00F
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate

                                                      Target ID:5
                                                      Start time:17:57:33
                                                      Start date:30/05/2023
                                                      Path:C:\Windows\System32\rundll32.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
                                                      Imagebase:0xff470000
                                                      File size:45568 bytes
                                                      MD5 hash:DD81D91FF3B0763C392422865C9AC12E
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high

                                                      Target ID:6
                                                      Start time:17:57:33
                                                      Start date:30/05/2023
                                                      Path:C:\Windows\System32\wscript.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
                                                      Imagebase:0xff120000
                                                      File size:168960 bytes
                                                      MD5 hash:045451FA238A75305CC26AC982472367
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high

                                                      Target ID:7
                                                      Start time:17:57:33
                                                      Start date:30/05/2023
                                                      Path:C:\Windows\SysWOW64\rundll32.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
                                                      Imagebase:0xf20000
                                                      File size:44544 bytes
                                                      MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000007.00000002.1071797162.000000000029D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      • Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000007.00000002.1072022431.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                      Reputation:high

                                                      Target ID:8
                                                      Start time:17:57:36
                                                      Start date:30/05/2023
                                                      Path:C:\Windows\SysWOW64\wermgr.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:C:\Windows\SysWOW64\wermgr.exe
                                                      Imagebase:0xbd0000
                                                      File size:53760 bytes
                                                      MD5 hash:C9905EA4C326DAB778B9297BA5BD1889
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate

                                                      Reset < >

                                                        Execution Graph

                                                        Execution Coverage:0%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:0%
                                                        Total number of Nodes:3
                                                        Total number of Limit Nodes:0
                                                        execution_graph 25875 1002a53a 25876 1002a4e1 VirtualFree 25875->25876 25878 1002a4c0 25876->25878
                                                        APIs
                                                        • VirtualAlloc.KERNELBASE(?), ref: 0014051C
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000003.1063312095.0000000000140000.00000020.00001000.00020000.00000000.sdmp, Offset: 00140000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_3_140000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: AllocVirtual
                                                        • String ID:
                                                        • API String ID: 4275171209-0
                                                        • Opcode ID: 647806292e40d76c1808ca0a8b573877cb0d1ed87da1151593330ae6246e7e91
                                                        • Instruction ID: 27e355549d852db66a4cd370efb1ce8f2395748067a56472404ef13e5ae811e6
                                                        • Opcode Fuzzy Hash: 647806292e40d76c1808ca0a8b573877cb0d1ed87da1151593330ae6246e7e91
                                                        • Instruction Fuzzy Hash: B411C2B2C0830CEFDB16C661DCC476C76B6EB18305F6A4465EB0A5B2A2D7314D80EB11
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000003.1063312095.0000000000140000.00000020.00001000.00020000.00000000.sdmp, Offset: 00140000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_3_140000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0092f584a839dd62b4c13f44ce63d536f0c9e1244b20ab5f9c8e56308dbb263e
                                                        • Instruction ID: a053743cef4bd735bd5b14cf70b708faf7ca001e3603b17efc2bc712accf2a8c
                                                        • Opcode Fuzzy Hash: 0092f584a839dd62b4c13f44ce63d536f0c9e1244b20ab5f9c8e56308dbb263e
                                                        • Instruction Fuzzy Hash: BB3180B5E44209FBDF14EBA4D884FAE7A75FB18300FA50451EA06E7272D3754EC0AB91
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • GetNativeSystemInfo.KERNEL32(?), ref: 001407D5
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000003.1063312095.0000000000140000.00000020.00001000.00020000.00000000.sdmp, Offset: 00140000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_3_140000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: InfoNativeSystem
                                                        • String ID:
                                                        • API String ID: 1721193555-0
                                                        • Opcode ID: 67133743171ce9d8cdc9a07f765dc30c570cf60d44af1830f195452f5f9a1b35
                                                        • Instruction ID: 78e6e0ae57b4d1a3c959cb82fa6b2bfbdf1194d418460cfea674f0321a7c7318
                                                        • Opcode Fuzzy Hash: 67133743171ce9d8cdc9a07f765dc30c570cf60d44af1830f195452f5f9a1b35
                                                        • Instruction Fuzzy Hash: E9014F34909249DFCB5ACF95C884EBDB7B0BF08321F2648D5F616AB262D731A984DF10
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000003.1063312095.0000000000140000.00000020.00001000.00020000.00000000.sdmp, Offset: 00140000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_3_140000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: AllocateHeap
                                                        • String ID:
                                                        • API String ID: 1279760036-0
                                                        • Opcode ID: fdae159f5b63167561a356be9577cc6a5469f915a5d238255440c61cf8b3ecaf
                                                        • Instruction ID: 4b3e27603ee011902e3ff9a13a60a971c18b2d5a338361bcf22a0eafe9cf47a1
                                                        • Opcode Fuzzy Hash: fdae159f5b63167561a356be9577cc6a5469f915a5d238255440c61cf8b3ecaf
                                                        • Instruction Fuzzy Hash: 8CE04FB4D45609EACF04CBD0D4893FCB7F0AB10369F310416D407A6120E3304AC4EA40
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • VirtualProtect.KERNELBASE(?,?,?), ref: 00140BBB
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000003.1063312095.0000000000140000.00000020.00001000.00020000.00000000.sdmp, Offset: 00140000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_3_140000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ProtectVirtual
                                                        • String ID:
                                                        • API String ID: 544645111-0
                                                        • Opcode ID: 2efa1e35d57d1254694c6657700579f5ecd92471f7d6fffa99b604cb6f312ba0
                                                        • Instruction ID: 7eafc19db980dcb1700854d9244444da7c6afc6fa30759d400f38187670920e1
                                                        • Opcode Fuzzy Hash: 2efa1e35d57d1254694c6657700579f5ecd92471f7d6fffa99b604cb6f312ba0
                                                        • Instruction Fuzzy Hash: E1E0ECB9910108EFDB1ACB41CD84EBDB775FB18300F654480E90573220C3319E00AF24
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • VirtualProtect.KERNELBASE(?,?,?), ref: 00140BBB
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000003.1063312095.0000000000140000.00000020.00001000.00020000.00000000.sdmp, Offset: 00140000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_3_140000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ProtectVirtual
                                                        • String ID:
                                                        • API String ID: 544645111-0
                                                        • Opcode ID: 11959dc47cbe69a1d1983ee25c8494f456e1724cc526d44f32103389f00dccd7
                                                        • Instruction ID: 51e5814c2ee4fd19d5acfbca512b3fb1280bb9fb7cf3e7128f84e06256abc519
                                                        • Opcode Fuzzy Hash: 11959dc47cbe69a1d1983ee25c8494f456e1724cc526d44f32103389f00dccd7
                                                        • Instruction Fuzzy Hash: 6EB01221404B45C3EB6B16514648BB8AF70EB0631CF56C8C4C7CB5081B8B348848BB75
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 0 1002a53a-1002a806 VirtualFree 18 1002a59b-1002a59f 0->18 19 1002a5a1-1002a5a4 18->19 20 1002a5a9-1002a5ac 18->20 19->20
                                                        APIs
                                                        • VirtualFree.KERNELBASE(?,00007E7E,00007E7E), ref: 1002A5FE
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: FreeVirtual
                                                        • String ID:
                                                        • API String ID: 1263568516-0
                                                        • Opcode ID: d2d32f6414cb2bdb90e2278249cfc263d5e95a1b9243a6c2b3b9ae838f1e9570
                                                        • Instruction ID: ee5bacc9b31a87c68dd149840c7c0cb0e2f944a2a3b9815833a80f196adc5e09
                                                        • Opcode Fuzzy Hash: d2d32f6414cb2bdb90e2278249cfc263d5e95a1b9243a6c2b3b9ae838f1e9570
                                                        • Instruction Fuzzy Hash: 88215B30D08929EFDF65CF84E988A8E7BB1FB06314FA040A1ED04A6111CB719ED0FB40
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • VirtualFree.KERNELBASE(?,00007E7E,00007E7E), ref: 1002A5FE
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: FreeVirtual
                                                        • String ID:
                                                        • API String ID: 1263568516-0
                                                        • Opcode ID: a838df6ee52d58e2f5186a0d0d75b5f2ffc51b907e2f04fbf32939c20e722116
                                                        • Instruction ID: 278c5a9de3e714cf87e1ab2279faa75398506c58c2b692d3dc3f64c22d89b254
                                                        • Opcode Fuzzy Hash: a838df6ee52d58e2f5186a0d0d75b5f2ffc51b907e2f04fbf32939c20e722116
                                                        • Instruction Fuzzy Hash: 54F05E71909515EFDF61DE40FC8878E3AB1FB86304FA44521FD1961151DB759AD0F640
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • VirtualAlloc.KERNELBASE(00002F24,?,00002F24), ref: 001404CD
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000003.1063312095.0000000000140000.00000020.00001000.00020000.00000000.sdmp, Offset: 00140000, based on PE: false
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_3_140000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: AllocVirtual
                                                        • String ID:
                                                        • API String ID: 4275171209-0
                                                        • Opcode ID: 459ceca762080cf357c362edab4f1ee4805586002f586a962786011784d06284
                                                        • Instruction ID: a6064cda4d43678d0e7d924c6475403f503da6b05ce221b3a9b3519c54ffbecd
                                                        • Opcode Fuzzy Hash: 459ceca762080cf357c362edab4f1ee4805586002f586a962786011784d06284
                                                        • Instruction Fuzzy Hash: 6CD01270C04348FFDB498E908A84BAC79B5EB08309F320414A30A67162C3340F50E600
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_get_cpu_flags.MAIN ref: 100A61C1
                                                        • mv_fast_realloc.MAIN ref: 100A640E
                                                        • mv_bprint_init.MAIN ref: 100A6504
                                                        • mv_bprintf.MAIN ref: 100A6538
                                                        • mv_bprintf.MAIN ref: 100A65C8
                                                        • mv_bprintf.MAIN ref: 100A65D8
                                                          • Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DAAB
                                                          • Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DB07
                                                          • Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DB2B
                                                          • Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DB5A
                                                          • Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DB99
                                                          • Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DBB9
                                                        • mv_bprintf.MAIN ref: 100A6611
                                                        • mv_bprintf.MAIN ref: 100A6636
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf$mv_bprint_initmv_fast_reallocmv_get_cpu_flags
                                                        • String ID: %s$($any$fft_double$fft_float$fft_int32$forward$inverse$mdct_double$mdct_float$mdct_int32$rdft_double$rdft_float$rdft_int32$unknown
                                                        • API String ID: 3119210720-3272017958
                                                        • Opcode ID: 25040e6d6a9753b456abe214fbca7a930a5edd2d292909d605851bf2564771d6
                                                        • Instruction ID: 8e365c97db9984c6de8945a7e442cfdf49085734b6247471425ef2e3cf29c5ab
                                                        • Opcode Fuzzy Hash: 25040e6d6a9753b456abe214fbca7a930a5edd2d292909d605851bf2564771d6
                                                        • Instruction Fuzzy Hash: 6A521275A09741CFCB50CF68C88065EBBF2FBC8250F658A2DE8999B354D735E981CB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_small_strptime
                                                        • String ID: %H%M%S$%H:%M$%H:%M:%S$%J:%M:%S$%M:%S$%Y - %m - %d$%Y%m%d$gfff$now
                                                        • API String ID: 1704653723-929505383
                                                        • Opcode ID: 02e139faec9299b2c862389e2453493f24e0b8e412685161cdfeeff446f18a58
                                                        • Instruction ID: 646b59ec4b146e931ed9e50608571c6f79c7907caae039c014e067c05dcc172a
                                                        • Opcode Fuzzy Hash: 02e139faec9299b2c862389e2453493f24e0b8e412685161cdfeeff446f18a58
                                                        • Instruction Fuzzy Hash: 8042F471A083458FD714CF28D48076AFBE2EFC5384F95897EE889C7352E631D9468B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf
                                                        • String ID: %d channels$%d channels ($@%s$AMBI%d$NONE$USR%d
                                                        • API String ID: 3083893021-1306170362
                                                        • Opcode ID: efc4cf4070b613ff96981b1c53d9dde21975b7a6fb51727448d4ce29c3f6a9dc
                                                        • Instruction ID: a65011a6159dd3c9d8d2b84384c130b43f4f86832dc80880a9240f1aa98400e9
                                                        • Opcode Fuzzy Hash: efc4cf4070b613ff96981b1c53d9dde21975b7a6fb51727448d4ce29c3f6a9dc
                                                        • Instruction Fuzzy Hash: E6B1A675A087468BD704EF68C48062EB7E1FF98394F15882EE989C7345EB31ED44CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: Crypt$AlgorithmProvider_close_readmvpriv_open$CloseOpenRandomclock
                                                        • String ID: Microsoft Primitive Provider$N$RNG
                                                        • API String ID: 4139849330-2077157618
                                                        • Opcode ID: 18afe3c33630559fbd0355b581881ae8f3aa94268538246d15ca1b824b2066d5
                                                        • Instruction ID: 296a7b6315f8af7d09067326692401f592c87ee6f10d7706e56fdac5cef6b261
                                                        • Opcode Fuzzy Hash: 18afe3c33630559fbd0355b581881ae8f3aa94268538246d15ca1b824b2066d5
                                                        • Instruction Fuzzy Hash: 55918E75A093108FE304EF38C9C061ABBE2EFC9312F95893EE9889B355E675D944CB51
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cbd52e100bb25c0641e34a9b4921baf3855db5dcfffc71db4c92606c3f5dca5a
                                                        • Instruction ID: 64132198df639edcb8f9d9942dd31ac045c1fee33f6b38aeafb66a389db015b7
                                                        • Opcode Fuzzy Hash: cbd52e100bb25c0641e34a9b4921baf3855db5dcfffc71db4c92606c3f5dca5a
                                                        • Instruction Fuzzy Hash: 2851AE79A04B518FCB10EF79D4C595AF7E0FF48214F41892DE9A98B309EB30F9858B91
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_opt_find2
                                                        • String ID: %d%*1[:/]%d%c$-$The "%s" option is deprecated: %s$Unable to parse option value "%s"$all$const_values array too small for %s$default$max$min$none
                                                        • API String ID: 2189843566-679463259
                                                        • Opcode ID: 4759d47900ada6b9e9bf303824872e064e666305b03fd95eb96eca29edeb881a
                                                        • Instruction ID: 478a8a207ff5b5307f9cfef852e9a26e9f05da79b4c8f966c849b1b138e3b10c
                                                        • Opcode Fuzzy Hash: 4759d47900ada6b9e9bf303824872e064e666305b03fd95eb96eca29edeb881a
                                                        • Instruction Fuzzy Hash: CF023475A087498FC390DF69D08065BFBE5FFC9350F918A2EE9D987250EB35D8448B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_tree_find$mv_tree_insert
                                                        • String ID:
                                                        • API String ID: 3047205218-0
                                                        • Opcode ID: 80c4f16b25e93cf13fac10a13682a04c4d944ea14c030e41bdf2d1b908fff40c
                                                        • Instruction ID: a50688713867d27fbf14d738fefbaa6eb2d970f68efb82bc5577a16e2e7c4afa
                                                        • Opcode Fuzzy Hash: 80c4f16b25e93cf13fac10a13682a04c4d944ea14c030e41bdf2d1b908fff40c
                                                        • Instruction Fuzzy Hash: 7152CF75A087499FC344DF1AC08091AFBE2FFC8654F658A2DE889DB315E730E9418F86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_image_get_buffer_size.MAIN ref: 10020869
                                                          • Part of subcall function 10020660: mv_pix_fmt_desc_get.MAIN ref: 1002067F
                                                          • Part of subcall function 10020660: mv_image_get_linesize.MAIN ref: 100206B4
                                                          • Part of subcall function 10020660: mv_image_fill_linesizes.MAIN(?), ref: 10020748
                                                          • Part of subcall function 10020660: mv_image_fill_plane_sizes.MAIN(?), ref: 100207AB
                                                        • mv_pix_fmt_desc_get.MAIN ref: 10020873
                                                        • mv_image_fill_linesizes.MAIN ref: 1002090C
                                                        • mv_log.MAIN ref: 10020AE8
                                                        • abort.MSVCRT ref: 10020AED
                                                        • mv_pix_fmt_desc_get.MAIN ref: 10020B14
                                                        • mv_pix_fmt_count_planes.MAIN ref: 10020B1E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_pix_fmt_desc_get$mv_image_fill_linesizes$abortmv_image_fill_plane_sizesmv_image_get_buffer_sizemv_image_get_linesizemv_logmv_pix_fmt_count_planes
                                                        • String ID: $Assertion %s failed at %s:%d
                                                        • API String ID: 1281078460-3513380740
                                                        • Opcode ID: c6aa44ff7cc2dd3ec536464cbf8ee4c7033008b01ecee55ae96f81af4c4c6a53
                                                        • Instruction ID: 773bde96130699db78e658d80479c0383b6257f66772b6af4f59ee2ed46427a0
                                                        • Opcode Fuzzy Hash: c6aa44ff7cc2dd3ec536464cbf8ee4c7033008b01ecee55ae96f81af4c4c6a53
                                                        • Instruction Fuzzy Hash: E9427E75A083858FC760CF28D48069EBBE2FFC8354F96892DF99997312D771E9418B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mallocz$mv_calloc
                                                        • String ID:
                                                        • API String ID: 1417229449-0
                                                        • Opcode ID: 11c5df3fdc17ecbdb580f76e82102d0b651416b72ae8ebbfb0f71fad63a734a3
                                                        • Instruction ID: 5eac887c21a6c61861bed7af62f95aa57474651100df0996b3e61034f298f0f1
                                                        • Opcode Fuzzy Hash: 11c5df3fdc17ecbdb580f76e82102d0b651416b72ae8ebbfb0f71fad63a734a3
                                                        • Instruction Fuzzy Hash: 4151F574605B529BC750EF69D88061AF7E0FF48794F42892CE9958B309EB34F890CBD2
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log
                                                        • String ID:
                                                        • API String ID: 2418673259-399585960
                                                        • Opcode ID: 22cdb019eb22855181cd6e508c806dde92fa5c269c700c41bc7c92eb19578fc7
                                                        • Instruction ID: 2a63a735ee4446ece5056bc05f6be1e2204befa447e9d9112aa6660a5f998af8
                                                        • Opcode Fuzzy Hash: 22cdb019eb22855181cd6e508c806dde92fa5c269c700c41bc7c92eb19578fc7
                                                        • Instruction Fuzzy Hash: C7F10974A083468FC754CF29C480A4BB7E1FF88354F61892EE999D7312E770E9458B86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_expr_parse_and_evalmv_opt_find2
                                                        • String ID: all$default$max$min$none
                                                        • API String ID: 1085414910-3292705889
                                                        • Opcode ID: 4ac8a3243c0db78ed30247e43ff312a6be18ac279b61e635c90502b5a9933884
                                                        • Instruction ID: 18531c70e26c900463f27e75ba25a0c49568f7c26c871f4daec10b5f5a2a946d
                                                        • Opcode Fuzzy Hash: 4ac8a3243c0db78ed30247e43ff312a6be18ac279b61e635c90502b5a9933884
                                                        • Instruction Fuzzy Hash: FD512574A097458BC391EF68E04079BBBE5FFC9354F618A2EE8C8C7200EB71D8448B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mallocz$mv_calloc
                                                        • String ID:
                                                        • API String ID: 1417229449-0
                                                        • Opcode ID: 120c092516309b251ece8b0e79d11a8b170fe8de52fc652575ee7012228408d0
                                                        • Instruction ID: 92956a2d1d3baa5ba05d42f33decdb2ad021b9d4684d2735edf6a3dd4ed8fbb8
                                                        • Opcode Fuzzy Hash: 120c092516309b251ece8b0e79d11a8b170fe8de52fc652575ee7012228408d0
                                                        • Instruction Fuzzy Hash: 0421F4B89087508BCB44DF2595C011BBBE0FF88654F82496DED849B30AE734EA61CB86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: abortmv_bprint_charsmv_bprintfmv_channel_layout_describe_bprintmv_log
                                                        • String ID: ambisonic %d
                                                        • API String ID: 3836754782-1019176007
                                                        • Opcode ID: b34a5ce10fbd8834e3f4ae1ba03fa64c57cec5e69a3d579a25b9253d3ac1963c
                                                        • Instruction ID: fcb70f02e0754f6f7d847351f1522eb27181b5797a445abb94d138a7096ea4de
                                                        • Opcode Fuzzy Hash: b34a5ce10fbd8834e3f4ae1ba03fa64c57cec5e69a3d579a25b9253d3ac1963c
                                                        • Instruction Fuzzy Hash: B66182B3B246054BE704DE28C88135DB6D2EBD8274F0DC63EE98AD7749EA34DD418792
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_encryption_init_info_alloc.MAIN ref: 10013562
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_encryption_init_info_alloc
                                                        • String ID:
                                                        • API String ID: 3189372936-0
                                                        • Opcode ID: 40eb082df2a873b27e792bc7caffd1106743bd01b0e16bd1d615b7bb6c7bfb03
                                                        • Instruction ID: a1e043498c3c16070c5ce0a7d842a7d55674a9d60fbffb8ceeaa7ba958246eb1
                                                        • Opcode Fuzzy Hash: 40eb082df2a873b27e792bc7caffd1106743bd01b0e16bd1d615b7bb6c7bfb03
                                                        • Instruction Fuzzy Hash: ACB169B1A083418FC764CF29C58461BFBE2FFC8254F56896DE9899B350E731E981CB52
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strlen
                                                        • String ID: %d.%06d$%d:%02d.%06d$%lld:%02d:%02d.%06d$INT64_MAX$INT64_MIN
                                                        • API String ID: 39653677-2240581584
                                                        • Opcode ID: 0fc159dbdf919121d5ae85b4b67d03e61a1cce094bcc318245b853e9ada1757b
                                                        • Instruction ID: c54e951a0f1896a6386a6c5c1f669f1c3c64ce07789a61242c38440661c84367
                                                        • Opcode Fuzzy Hash: 0fc159dbdf919121d5ae85b4b67d03e61a1cce094bcc318245b853e9ada1757b
                                                        • Instruction Fuzzy Hash: A8A16D76A193118FC308CF6DC44421EFBE6EBC8350F998A2EF488D7364DA74D9058B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: %d channels
                                                        • API String ID: 0-1351059727
                                                        • Opcode ID: 125e0846f57f9b032cdce6562afb1258b5259d1002a50140fed6246712bc4ce9
                                                        • Instruction ID: fbd93282e394e78ed831cdfa1163249771b383e02731abb89eb949a6102d5748
                                                        • Opcode Fuzzy Hash: 125e0846f57f9b032cdce6562afb1258b5259d1002a50140fed6246712bc4ce9
                                                        • Instruction Fuzzy Hash: 5551B776B147458BD308DF68D85121EB7E2FBD43A0F58C82DE586C7345DA35ED428782
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 355135263088e94a10b3081d7ca45438585c75b071c068879c5feec0f380323f
                                                        • Instruction ID: 51e70f272ae0093965207845ec1cb951f05259167ff59344558e7544d7b47f58
                                                        • Opcode Fuzzy Hash: 355135263088e94a10b3081d7ca45438585c75b071c068879c5feec0f380323f
                                                        • Instruction Fuzzy Hash: 69C19E71A087858BD350CF2D888064EBBE1FFC9294F198A2EF9D8C7355E675D9448B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_pix_fmt_desc_get.MAIN ref: 10020B14
                                                        • mv_pix_fmt_count_planes.MAIN ref: 10020B1E
                                                        • mv_write_image_line.MAIN(?), ref: 10020D5C
                                                        • mv_image_get_linesize.MAIN ref: 10020DA4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_image_get_linesizemv_pix_fmt_count_planesmv_pix_fmt_desc_getmv_write_image_line
                                                        • String ID: $Assertion %s failed at %s:%d
                                                        • API String ID: 2742463661-3513380740
                                                        • Opcode ID: dfac4c9c3e2b2a6659d2d83ec8970682280816447ca476019a7c42da2599a3de
                                                        • Instruction ID: 7291b42ecfa30c9ded9631a3f5ec54be9a0a2bb908f309bcd4ce331d09022d6a
                                                        • Opcode Fuzzy Hash: dfac4c9c3e2b2a6659d2d83ec8970682280816447ca476019a7c42da2599a3de
                                                        • Instruction Fuzzy Hash: 0F7129759093458BC761DF69E48029AFBE2FFC8354F968D2EE899C7211D770E8408B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: .$@$gfff$gfff
                                                        • API String ID: 0-2633265772
                                                        • Opcode ID: 1a96870f25700b4f619f96355033705c23d8640121cae616d73658099f59e725
                                                        • Instruction ID: 88ed55b374b91f7029d25279d4dc518c5e58f5803cb7bd7bc1eaa9a5779130ae
                                                        • Opcode Fuzzy Hash: 1a96870f25700b4f619f96355033705c23d8640121cae616d73658099f59e725
                                                        • Instruction Fuzzy Hash: D0A16E71A04746CBD704CE29C88430BBBE1EF84794F19C92DE8989B355E770EE49DB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • GetTimeZoneInformation.KERNEL32 ref: 1008F681
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: InformationTimeZone
                                                        • String ID:
                                                        • API String ID: 565725191-0
                                                        • Opcode ID: b69c75700f75219a74068cccd1dca2d98ce45db577427034a577193da62bee99
                                                        • Instruction ID: 644768b22c3724b228d8b808f31f7f684975bc292c311e4257fcfe74704407b1
                                                        • Opcode Fuzzy Hash: b69c75700f75219a74068cccd1dca2d98ce45db577427034a577193da62bee99
                                                        • Instruction Fuzzy Hash: D32125B08093119FDB10EF34D5C936ABBE0FF88354F018A2DE88587254E778D884CB52
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-227171996
                                                        • Opcode ID: 6fd3c9181117af1588f895db508848a7fe2041e06b4ede146a6400b05576f826
                                                        • Instruction ID: 27a4ed98bf9c25b7b0ab4f703cc1de2c0a71aadacb2ac3823d64191068bff582
                                                        • Opcode Fuzzy Hash: 6fd3c9181117af1588f895db508848a7fe2041e06b4ede146a6400b05576f826
                                                        • Instruction Fuzzy Hash: 78E224B1B003598FDB28CF2DC991389B7E6BB8C310F09863EAC89D7755D6789D458B81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: gfff$gfff$gfff
                                                        • API String ID: 0-4275324669
                                                        • Opcode ID: fe7beb6bbb1309a31ac6102e863e5a24cddba949dbada84ffe1642a77b23e691
                                                        • Instruction ID: 6e38d88d3cd0efd9d9cd182852fcce1d7090011af53c37e374a65a5619e36939
                                                        • Opcode Fuzzy Hash: fe7beb6bbb1309a31ac6102e863e5a24cddba949dbada84ffe1642a77b23e691
                                                        • Instruction Fuzzy Hash: 10719532B047164BD358CE2ECD8020ABBD7EBC8350F598A3DE599CB395DA70ED158B81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-227171996
                                                        • Opcode ID: a91a1251ad0a0e377302b14c4af55ce309aa8aa50d665d79167b33421984c126
                                                        • Instruction ID: 972c1d3150a0c6be4cbba2329d1db571b0fd8e8f06b051dbdb6a50c66f540437
                                                        • Opcode Fuzzy Hash: a91a1251ad0a0e377302b14c4af55ce309aa8aa50d665d79167b33421984c126
                                                        • Instruction Fuzzy Hash: 7F72F675B047069FC70CDE2DC891399F7E5BB8C310F09C63EA89A83745DB78A9598B81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-227171996
                                                        • Opcode ID: 190c9ede49d876a345d641f98c1cb4f45a22d81b33dfb6ccf71ac0a7e3213ad1
                                                        • Instruction ID: 8fc681939e9e3bb15c4cfec1c3dbff6a6facdc0add524c48ef0f17546c9d919b
                                                        • Opcode Fuzzy Hash: 190c9ede49d876a345d641f98c1cb4f45a22d81b33dfb6ccf71ac0a7e3213ad1
                                                        • Instruction Fuzzy Hash: 587238B1B003558FDB28CF2DC881389B7E6BBCC310F09C63EA949DB755D6749A498B85
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-227171996
                                                        • Opcode ID: b4afbf0de2936a940502192aa127a54f7e5d45448a1c3de9945ab114a676ba9a
                                                        • Instruction ID: 7ea1a9c3d22071ba8789d8348bc838f98b70990652e341448c655628b0634421
                                                        • Opcode Fuzzy Hash: b4afbf0de2936a940502192aa127a54f7e5d45448a1c3de9945ab114a676ba9a
                                                        • Instruction Fuzzy Hash: 63622475B043488FDB68CE2DC9913C9B7E2BB8C310F09863EA88DDB745D6789D458B81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-227171996
                                                        • Opcode ID: 16f6de066b279db5e54fcd4adaf93d1368a37d6b99bafdb5bc801e57391512ac
                                                        • Instruction ID: ce981d1cc0724b58033acc55b46a376f784f2f1e6f2710373a118482dca14d85
                                                        • Opcode Fuzzy Hash: 16f6de066b279db5e54fcd4adaf93d1368a37d6b99bafdb5bc801e57391512ac
                                                        • Instruction Fuzzy Hash: C2623671B003598FDB28CF2DC9913C9B6E6BBCC310F09863EA889DB755D6749E458B81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-227171996
                                                        • Opcode ID: 948bf2bd23e64e35a61d3ded842bee3e0d4ec94bc0de09769f67e650174ebafe
                                                        • Instruction ID: b19f2a14b5ade5b0b8083f0bfe019e2d0c6b2526b01c4da696241c83efedee47
                                                        • Opcode Fuzzy Hash: 948bf2bd23e64e35a61d3ded842bee3e0d4ec94bc0de09769f67e650174ebafe
                                                        • Instruction Fuzzy Hash: 98622B71B002598FDB28CE2DC9813CDB6E6BBCC314F09C53EA889DB755DA749E458B81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-227171996
                                                        • Opcode ID: f0cd3dabb9e9b6583c0ed00182b844eedfd5536ca59a638b0eb35a6b9abb8002
                                                        • Instruction ID: 034730f4c7d74994eeddd26650854f6c448e29a341e3b0a91aca4cb0aa753e9a
                                                        • Opcode Fuzzy Hash: f0cd3dabb9e9b6583c0ed00182b844eedfd5536ca59a638b0eb35a6b9abb8002
                                                        • Instruction Fuzzy Hash: 6E623671B003598FDB28CF2DC9913C9B6E6BBCC310F09863EA889DB755D6749E458B81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-227171996
                                                        • Opcode ID: 2adc38692b4dba453ddc0daa820c9e46ea653bb0c5d31e5813356c9d36655b72
                                                        • Instruction ID: 88364c6e534ce9109b01b87a12bc7110fb245ac6aa888d6aecf88a9e786e3146
                                                        • Opcode Fuzzy Hash: 2adc38692b4dba453ddc0daa820c9e46ea653bb0c5d31e5813356c9d36655b72
                                                        • Instruction Fuzzy Hash: 7D623A71B002598FDB28CF2DCD8538DB6E6BBCC314F0AC23AA949DB754D6749E458B84
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-227171996
                                                        • Opcode ID: 7bb440087b05080476a02e4a1ddb46d1ca10b6288ac3f83932febcf60076a0ba
                                                        • Instruction ID: 034d2c67b359ae69a957bb0842cf7cad10bcd7b786eb12866f5fd0dccb38987e
                                                        • Opcode Fuzzy Hash: 7bb440087b05080476a02e4a1ddb46d1ca10b6288ac3f83932febcf60076a0ba
                                                        • Instruction Fuzzy Hash: B26248B1B002598FCB28CE2DCD953CDB6E6BBCC314F09823EA949DB745D6749E458B84
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_malloc
                                                        • String ID:
                                                        • API String ID: 3797683224-0
                                                        • Opcode ID: d0f46ac01df2d66eedf7921aeb8116c9143c8572b1c9a41cb75b5c2ebe5f539e
                                                        • Instruction ID: d9cd303cd0cdd735b109894e0513b1deaf0e71c410b9c65df79ef7a199e1e6cc
                                                        • Opcode Fuzzy Hash: d0f46ac01df2d66eedf7921aeb8116c9143c8572b1c9a41cb75b5c2ebe5f539e
                                                        • Instruction Fuzzy Hash: B3718CB2A042568BCB14CF28C88175AB7E2FF84354F66C568ED899F341E671ED81CB81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_blowfish_crypt_ecb.MAIN ref: 10008642
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_blowfish_crypt_ecb
                                                        • String ID:
                                                        • API String ID: 997994871-0
                                                        • Opcode ID: e25778ea9fdb925930b24f7ee5b61e2c5b198a0ae9bacbd401b09897083a4e10
                                                        • Instruction ID: d8ffb9ab9be6425fb2f2151958634ca33b63df147d529954a2eeef9d18f7c60e
                                                        • Opcode Fuzzy Hash: e25778ea9fdb925930b24f7ee5b61e2c5b198a0ae9bacbd401b09897083a4e10
                                                        • Instruction Fuzzy Hash: 537145B19097818BC709CF29D5C846AFBE1FFC9245F118A5EE8DC87344E270AA04CB62
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: <
                                                        • API String ID: 0-4251816714
                                                        • Opcode ID: c7787c3b14f80e01f53518ebbce28839c2deec08409873a47eabaf8b3c714c82
                                                        • Instruction ID: 3fd6811098af7138a6a9628f140dfff3b7bdce2196f1c46684414acbc60ce241
                                                        • Opcode Fuzzy Hash: c7787c3b14f80e01f53518ebbce28839c2deec08409873a47eabaf8b3c714c82
                                                        • Instruction Fuzzy Hash: 83B20675A083458FC318CF6DC881B4AFBE2BBC8354F198A3EE58987765D674E845CB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID: 0-3916222277
                                                        • Opcode ID: 641a198c02e26966d2062e0053ab908e5e5a277c8f98988520ef612f009bed59
                                                        • Instruction ID: 43e44a4b83fab764415e1025b301afb79c6204bc9dcc01db161338078a8a8597
                                                        • Opcode Fuzzy Hash: 641a198c02e26966d2062e0053ab908e5e5a277c8f98988520ef612f009bed59
                                                        • Instruction Fuzzy Hash: AC920676B047148FC718CE29D98024AFBE2BBCC314F1A8A3EAD9993755D674ED058F81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mod_i
                                                        • String ID:
                                                        • API String ID: 416848386-0
                                                        • Opcode ID: a8d4099fe6c0eb055b727cce64fe07889f2056542eb8a35ea18b6c28ee92d382
                                                        • Instruction ID: 1978e8aa041b561afe43b5e1e9d69cc5e5589bc87bfac444af9f8de18395159f
                                                        • Opcode Fuzzy Hash: a8d4099fe6c0eb055b727cce64fe07889f2056542eb8a35ea18b6c28ee92d382
                                                        • Instruction Fuzzy Hash: CE623875A083A18BD324CF69C04066EF7E2FFC8750F568A1EE9D997390D774A840CB96
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-3993045852
                                                        • Opcode ID: fe4a0db042f0e8aae59756d567f16e575c9402a786daae64c0709e6c3677e7bd
                                                        • Instruction ID: 2178077c91711aa46356c5d4d239d896c71c523479eaa19c43c4ee5b4459259c
                                                        • Opcode Fuzzy Hash: fe4a0db042f0e8aae59756d567f16e575c9402a786daae64c0709e6c3677e7bd
                                                        • Instruction Fuzzy Hash: 3D823575B083418FD718CF2DC88175AF7E6BBC8314F098A2EE98AD7755D674E8448B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 8
                                                        • API String ID: 0-4194326291
                                                        • Opcode ID: 4bb01df27a01def8c24a3064336be394080f429d78acff62f573d229e26dba3e
                                                        • Instruction ID: 659be22c3e52018aa2745c097637c4ffca2e202117ad66bf3827cb74a2e1471d
                                                        • Opcode Fuzzy Hash: 4bb01df27a01def8c24a3064336be394080f429d78acff62f573d229e26dba3e
                                                        • Instruction Fuzzy Hash: 6A6202757083058FC748CF6DC89175AF7E6BBCC304F098A3EA98AC7765D678A8458B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-3993045852
                                                        • Opcode ID: aa70a164bd52ec31f03b4266804eca02e75dabac3be788ef91e1de1e2c1590b5
                                                        • Instruction ID: ce5b39af18f764baa09b40a2238384aa5d89d39e9ed9e4e5b8039b7fba20e69b
                                                        • Opcode Fuzzy Hash: aa70a164bd52ec31f03b4266804eca02e75dabac3be788ef91e1de1e2c1590b5
                                                        • Instruction Fuzzy Hash: 28523875A083458FC728CF2DC58075AFBE6FBC8304F098A2EE98997755D674A944CF82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_gcd
                                                        • String ID:
                                                        • API String ID: 2848192316-0
                                                        • Opcode ID: 94c61de4151f85b2e349843c83d37783726b6990a1d380f2b046a8bb30d58925
                                                        • Instruction ID: bae91829bd6a7d55044bc074d33ea4c9e53b069e54380698bce3da439848f8c3
                                                        • Opcode Fuzzy Hash: 94c61de4151f85b2e349843c83d37783726b6990a1d380f2b046a8bb30d58925
                                                        • Instruction Fuzzy Hash: A3F1CE75A083518FC358CF2AC48061AFBE6BFC8750F559A2EF998D7360D670E8458F82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: (
                                                        • API String ID: 0-3887548279
                                                        • Opcode ID: 162831e4797be57d8b0c67c98ae7b1737106273c419fc07e23e37c8db0e1006c
                                                        • Instruction ID: c9b53467aca63bfb1ff6328fb2ba50d2d2c897da2dfc5778b259f989fe58c822
                                                        • Opcode Fuzzy Hash: 162831e4797be57d8b0c67c98ae7b1737106273c419fc07e23e37c8db0e1006c
                                                        • Instruction Fuzzy Hash: 2032E175A083058FC708CF29C98175AF7E6BBC8314F098A3EA989D7766D674ED058B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,1001B0CD), ref: 1001EAC6
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_pix_fmt_desc_get
                                                        • String ID:
                                                        • API String ID: 2427544746-0
                                                        • Opcode ID: b892691f4f349c96ba1384667e915caf21722faef09a2027f66083ef5ed52c75
                                                        • Instruction ID: 783a62940874baa8ec3945e1bd9358386c9619e9dd1953521893957c1d9dab46
                                                        • Opcode Fuzzy Hash: b892691f4f349c96ba1384667e915caf21722faef09a2027f66083ef5ed52c75
                                                        • Instruction Fuzzy Hash: BDA1D27070839A8FD748DF29C85166EBBD1EB84350F154A3EE866CF791EA31ED858B40
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: $
                                                        • API String ID: 0-3993045852
                                                        • Opcode ID: 1b42ee59f21a204cb6b077af68c2de368fdd964a749b776b237f483907014f4d
                                                        • Instruction ID: 260964c7a2cfbcc0de303297e479b20c25a7b76d0ed562b33145cefc6d544c56
                                                        • Opcode Fuzzy Hash: 1b42ee59f21a204cb6b077af68c2de368fdd964a749b776b237f483907014f4d
                                                        • Instruction Fuzzy Hash: B6322776A083458FC318CF6DC98075AF7E6FBC8304F098A2EE98997755D674A845CF82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8
                                                        • mv_d2q.MAIN ref: 1002B5CC
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmp$mv_d2q
                                                        • String ID:
                                                        • API String ID: 1563177686-0
                                                        • Opcode ID: 45c5f2c89ee507ef39802a9a888517dd343027a0df61cf4b6a57416ffd5af97e
                                                        • Instruction ID: 1f0a7b361e8469cdb879426936d90b34354dbc15308211f32f0c3676d5f7708e
                                                        • Opcode Fuzzy Hash: 45c5f2c89ee507ef39802a9a888517dd343027a0df61cf4b6a57416ffd5af97e
                                                        • Instruction Fuzzy Hash: 19715C34608F46CFC356DF38D08060AF7B1FF86340F968B99E9566B256EB31E8859B41
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_encryption_init_info_alloc.MAIN ref: 10013562
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_encryption_init_info_alloc
                                                        • String ID:
                                                        • API String ID: 3189372936-0
                                                        • Opcode ID: cd6924afccd7b87e315566fc0b34ac7627ccdbad5b7df46105264a39c2b01be1
                                                        • Instruction ID: 78d0e82bed4cec982bfd679939fa63163902b3eee1ff480991edcad54221ee49
                                                        • Opcode Fuzzy Hash: cd6924afccd7b87e315566fc0b34ac7627ccdbad5b7df46105264a39c2b01be1
                                                        • Instruction Fuzzy Hash: 1951F5B1A087419FC744CF29C58451ABBE2FFC8654F56CA2DF889A7350D731ED458B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_encryption_init_info_alloc.MAIN ref: 10013562
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_encryption_init_info_alloc
                                                        • String ID:
                                                        • API String ID: 3189372936-0
                                                        • Opcode ID: ef5d398cf4f7091da99b035e9d0245d92d88978e73b2c3d1eb8e068e5064dbea
                                                        • Instruction ID: 95a8c643b77e51546d68e8d33e3f4ed292e5d24ad01eeb6ce01257d6c0bf5d32
                                                        • Opcode Fuzzy Hash: ef5d398cf4f7091da99b035e9d0245d92d88978e73b2c3d1eb8e068e5064dbea
                                                        • Instruction Fuzzy Hash: 2D5128B1A087419FC744CF29C58461AFBE2FFC8654F56C92DE889AB350D731ED428B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_aes_crypt
                                                        • String ID:
                                                        • API String ID: 1547198422-0
                                                        • Opcode ID: a76755bfb4d6463656838ecde433fd04cde547babbb3dbb5163c6ebd5a4d3b10
                                                        • Instruction ID: 6533aa27bc2eace4d46e94b1d96a72d5c0883edd5f4be066e5c3eb9db2eb8fbd
                                                        • Opcode Fuzzy Hash: a76755bfb4d6463656838ecde433fd04cde547babbb3dbb5163c6ebd5a4d3b10
                                                        • Instruction Fuzzy Hash: 81419D3510D7C18FD301CF69848054AFFE1FF99288F198A6DE8D993306D260EA09CBA2
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_channel_layout_index_from_string.MAIN ref: 1000EAD6
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_channel_layout_index_from_string
                                                        • String ID:
                                                        • API String ID: 1941520394-0
                                                        • Opcode ID: b5427e202f8ac7429ec52a8e90e2a2ab38b9bd65bff75006616c9072962c14a1
                                                        • Instruction ID: dd8c77e47ba7934b60b61c42e329a9640ddafb1186b5f9bdd33cfe49ccecab15
                                                        • Opcode Fuzzy Hash: b5427e202f8ac7429ec52a8e90e2a2ab38b9bd65bff75006616c9072962c14a1
                                                        • Instruction Fuzzy Hash: 6331E4B7F1476A0BE7209999DCC0216B3C0EB88270B4E863DDE5AA7786F551BD1582C1
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_aes_crypt
                                                        • String ID:
                                                        • API String ID: 1547198422-0
                                                        • Opcode ID: 3928a72eaf0bdf75db777ef61b97453f1547db555a5c878ed5744eb0c7f909a7
                                                        • Instruction ID: b15eea7d1e62e16a03610dfd725cbd08b0199710858140edd711ee624ae9ea9b
                                                        • Opcode Fuzzy Hash: 3928a72eaf0bdf75db777ef61b97453f1547db555a5c878ed5744eb0c7f909a7
                                                        • Instruction Fuzzy Hash: DC31C47610D7C18FD302CB6990C0099FFE1FF99248F198AADE4DD93706D264EA19CB62
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: ((((
                                                        • API String ID: 0-443828677
                                                        • Opcode ID: 4973b07765d4ec89b018a8d06673ab4f666873d277b7ebb3a3bf4dc23d5cb217
                                                        • Instruction ID: 0194c72f9be4bebdfae36609316a9b213b64d1e624968bee424045f40660fc3c
                                                        • Opcode Fuzzy Hash: 4973b07765d4ec89b018a8d06673ab4f666873d277b7ebb3a3bf4dc23d5cb217
                                                        • Instruction Fuzzy Hash: 18C1942810D3D18AD745CF7880A05AFBFE2AFDA245F455D6DE4D997302C32A890DDB63
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_blowfish_crypt_ecb.MAIN ref: 100086C2
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_blowfish_crypt_ecb
                                                        • String ID:
                                                        • API String ID: 997994871-0
                                                        • Opcode ID: acf8950ea6c148c44c64157bc22eca501f0550abc9d144bf7c67352d16790dd9
                                                        • Instruction ID: 3ce9d50094e6346554c2820e15aae8c95f0dca09f8e32c6084807ed2f7b375be
                                                        • Opcode Fuzzy Hash: acf8950ea6c148c44c64157bc22eca501f0550abc9d144bf7c67352d16790dd9
                                                        • Instruction Fuzzy Hash: 26019DB59093448FC709CF18E48842AFBE0FB8C355F11892EF8CCA7740E774AA448B46
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 9%lld
                                                        • API String ID: 0-1067827528
                                                        • Opcode ID: bcdcc6efd6621e1f85b7218b7b67dfd4e03329ea09515bb0419dbee41511919b
                                                        • Instruction ID: 101352dd42f6db591cdfd1097ab698e3354d26ef9933b018def11634da6c13ef
                                                        • Opcode Fuzzy Hash: bcdcc6efd6621e1f85b7218b7b67dfd4e03329ea09515bb0419dbee41511919b
                                                        • Instruction Fuzzy Hash: AB613D76A187158FD308DF29D88025AF7E2FBC8310F49892DF999DB351E674EC059B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 9%lld
                                                        • API String ID: 0-1067827528
                                                        • Opcode ID: 5513a2eee4d2361defe977553411883ee58bb0119317c7a243b664d72bd759ad
                                                        • Instruction ID: d0a6a35fac9b25aaf09e145393e53881d6b3ad243d3648f8ad8ecf29fe2e883f
                                                        • Opcode Fuzzy Hash: 5513a2eee4d2361defe977553411883ee58bb0119317c7a243b664d72bd759ad
                                                        • Instruction Fuzzy Hash: DB515976A187158FD308DF19C88025AF7E2FBC8350F4A892DE999DB351E670EC159B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 9%lld
                                                        • API String ID: 0-1067827528
                                                        • Opcode ID: 0fa6dd96bcb8b49d32427fa14dca801b7d20183067ebe2f5af9251743fd18f1c
                                                        • Instruction ID: 07c5791c45fa29d35386c44efcc7358132a53f75d1a9a2a1ef31ce81eb8ddbf6
                                                        • Opcode Fuzzy Hash: 0fa6dd96bcb8b49d32427fa14dca801b7d20183067ebe2f5af9251743fd18f1c
                                                        • Instruction Fuzzy Hash: F6513876A187158FD308DF19D88025AF7E2FBC8310F49892DFA999B351E774EC059B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 9%lld
                                                        • API String ID: 0-1067827528
                                                        • Opcode ID: 456f62df167c221b4f35950558ada73559cb89ee4e5f1ccf327e946437bed8b3
                                                        • Instruction ID: f07b37fba5f5260aea86cb94400ce6e638a8eff9ebd999678f623fdff0880617
                                                        • Opcode Fuzzy Hash: 456f62df167c221b4f35950558ada73559cb89ee4e5f1ccf327e946437bed8b3
                                                        • Instruction Fuzzy Hash: 97516B76A187158FD308DF19C88025AF7E2FBC8350F4A892DE999DB351D770EC159B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: %02u:%02u:%02u%c%02u
                                                        • API String ID: 0-3773705257
                                                        • Opcode ID: 2318787c02257443c440dfa009ff6961f21b6026df1628d6fdca24855cc61d32
                                                        • Instruction ID: be09c1d04eb864e1d0c66810dd1fbff98504cdf9198dbc8e4368de8c9c13ae5b
                                                        • Opcode Fuzzy Hash: 2318787c02257443c440dfa009ff6961f21b6026df1628d6fdca24855cc61d32
                                                        • Instruction Fuzzy Hash: 25516BB16087458FC754CF29C48066AB7E2FBC8345F50492EF4C9C7392E675D909CB46
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: *
                                                        • API String ID: 0-163128923
                                                        • Opcode ID: f7bbd7721ca75eba7fa29301916c8371da0f62bce0992595b79b08e752eb8dc5
                                                        • Instruction ID: c15c81efb2fd65274e57c9dcba0b9463b5106a8dfd25bbab1057f7fea26fdb11
                                                        • Opcode Fuzzy Hash: f7bbd7721ca75eba7fa29301916c8371da0f62bce0992595b79b08e752eb8dc5
                                                        • Instruction Fuzzy Hash: 94413CB6E083515FD340CE29C88125AF7E1EBC8754F5A892EF8D8DB351E674EC518B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: bffe5be5ea0cf8eb244358c7295bde7d5fedb614219cf83f2f51a3cfabbc894a
                                                        • Instruction ID: 93fe30d614f698e6f7524963f1120bb93ea648e144f849a3bf42169f72f169c8
                                                        • Opcode Fuzzy Hash: bffe5be5ea0cf8eb244358c7295bde7d5fedb614219cf83f2f51a3cfabbc894a
                                                        • Instruction Fuzzy Hash: 7F622172B012148FD749CF2DC895384B7EAABC8710F0E827ADC4DDFB5ADA3899458B54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d6db034cff99af1e7203ee44394934ffb7567196ced3806a0dc990b907df53bb
                                                        • Instruction ID: aff783430aa08d586327c987e6b98b0e0f6b454682ab812075f4302f75d353d4
                                                        • Opcode Fuzzy Hash: d6db034cff99af1e7203ee44394934ffb7567196ced3806a0dc990b907df53bb
                                                        • Instruction Fuzzy Hash: D632503274471D4BC708EEE9DC811D5B3D2BB88614F49813C9E15D3706FBB8BA6A96C8
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ecc47b0294c599dff906ad907c3cacd309aa326f7ee51b28907f233fc23d8642
                                                        • Instruction ID: 14305647c684428e38f4d4ef692b208b9fdd6583e9eb12280074a993664fc603
                                                        • Opcode Fuzzy Hash: ecc47b0294c599dff906ad907c3cacd309aa326f7ee51b28907f233fc23d8642
                                                        • Instruction Fuzzy Hash: F4420575B083458FC718CF6DC99075AF7E6BBCC304F098A3EE98A83765D674A8458B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 14eaf38118c7a759d371acee2a165523bb4c76873ad4d0c9062ae67b0ecb1890
                                                        • Instruction ID: ad852b38171cb1c4d6d317ab4e6fcc7a614a1a6681d72d6e7d093d2c3d42b063
                                                        • Opcode Fuzzy Hash: 14eaf38118c7a759d371acee2a165523bb4c76873ad4d0c9062ae67b0ecb1890
                                                        • Instruction Fuzzy Hash: E7227A32A093568FCB15DF29C89051AB7F1FF89316F19892DE9D99B210D270FE05DB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 33419a9aeb14ce56b4ab0fd1bc83750a17983b722cf78c8c468c2c97687aa838
                                                        • Instruction ID: 3194deff8c1016480bd4981d57c44dc359412b19884f203e35b39e086724ce96
                                                        • Opcode Fuzzy Hash: 33419a9aeb14ce56b4ab0fd1bc83750a17983b722cf78c8c468c2c97687aa838
                                                        • Instruction Fuzzy Hash: D342DE756087409FC754CF29C58099AFBE2BFCE250F16C92EE899C7356D630E942CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0e67863a46a38232c1c98f3bbb28cce13b0c6a915783b56d779cb3c3c48640e6
                                                        • Instruction ID: 6d42d01cb552ea32de216882ba5b35338e805864c61f81a166e561337f25913f
                                                        • Opcode Fuzzy Hash: 0e67863a46a38232c1c98f3bbb28cce13b0c6a915783b56d779cb3c3c48640e6
                                                        • Instruction Fuzzy Hash: D5423F31A18F548EC327DF39C46066BF7A9BFDB280F01C71EE85A6B621DB31A5468741
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 15ee1f807265c2448a5d30af4e3355bf754649fac8893e35c5f8cfddf926455e
                                                        • Instruction ID: 7174ebee63d6dac74c7d8e3f892b5b6b3bbf86c4982769087327a44f26b8845a
                                                        • Opcode Fuzzy Hash: 15ee1f807265c2448a5d30af4e3355bf754649fac8893e35c5f8cfddf926455e
                                                        • Instruction Fuzzy Hash: C3422431928B498FC712CF7BC48016ABBE1BFDE340F29CB1AE95467275D730B4959A81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: daa19670d3522c833027b14a21b852b8c85cf28517cca30d9fd8a4cb5d6ff739
                                                        • Instruction ID: 44859fa2464e6453f4b820bd8b2f52594cd8254e22ee146d3a9af27ba666f937
                                                        • Opcode Fuzzy Hash: daa19670d3522c833027b14a21b852b8c85cf28517cca30d9fd8a4cb5d6ff739
                                                        • Instruction Fuzzy Hash: 39325E31900A7DCFE748EF59C8D4826B3A1FB5E71078B469BDA8627261C330F911DBA5
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5cf90d1ec7f19272728b93ae722b4d7a072b3c1b91d2b09d409b5cad2029abf1
                                                        • Instruction ID: 0ebc0afddda2170bd2b3075ce7c9f010085fa9f9e3ca4f134125014cc1f34513
                                                        • Opcode Fuzzy Hash: 5cf90d1ec7f19272728b93ae722b4d7a072b3c1b91d2b09d409b5cad2029abf1
                                                        • Instruction Fuzzy Hash: B0220975A083458FC718CF2DC88075AF7E5FBC8304F098A2EE98A97755D734A945CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d96f62cfcfe5e8f43553fb10e8c7896314ef3273b4a86c5c7ff97399bd6d748f
                                                        • Instruction ID: 9e1727fd26884bf5191195720f30de30c932b0be7b7d484b7602d5863f15af54
                                                        • Opcode Fuzzy Hash: d96f62cfcfe5e8f43553fb10e8c7896314ef3273b4a86c5c7ff97399bd6d748f
                                                        • Instruction Fuzzy Hash: C4120375B043158FC708CF6DC98074AF7E6BBCC714F0A8A2EE88993765D674AC458B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 253541403ddb90a967318677e255df3c3d66526af601f855756530808c7de0cf
                                                        • Instruction ID: 7fd1eb89d7e446ca535b3a7c4e5df40feba04e1f10e452d83e5af9dd3013d807
                                                        • Opcode Fuzzy Hash: 253541403ddb90a967318677e255df3c3d66526af601f855756530808c7de0cf
                                                        • Instruction Fuzzy Hash: 6202D171A083458FC314CF28D48025ABBE2FFC6344F698A6ED8988F756D375D946CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 86a489710fe13c5f607167066acbb31749c07d198f3adc71dd6de5721242b9bd
                                                        • Instruction ID: a785d5b36ca4f2da05d37b54d5474f66753fb8429adb014802f9a6764e65f914
                                                        • Opcode Fuzzy Hash: 86a489710fe13c5f607167066acbb31749c07d198f3adc71dd6de5721242b9bd
                                                        • Instruction Fuzzy Hash: 0AF11C72A043148FC748CF2DC984749BBE6BBC8710F1A866EED48D775ADA74EC458B81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ff52c7ffbd1d9107fcbef65328e3878b9d8ec7e0a566bd5413746ddd724ee47a
                                                        • Instruction ID: 17bda300cafbee541834c927e7bcf7240875502bd3d5a4043446c7d08037228a
                                                        • Opcode Fuzzy Hash: ff52c7ffbd1d9107fcbef65328e3878b9d8ec7e0a566bd5413746ddd724ee47a
                                                        • Instruction Fuzzy Hash: 84E10775B083408FC304CE29D88060AFBF6EFC9364F598A2DF999D73A1D671E9458B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ce8d4379c629bcd2e40492a2a49cc2a68a8e13a90f0cec3b32964914661c2c3e
                                                        • Instruction ID: 68076dcebb193b58b9e24264a5a3b86d03840a9afd49eb0c7633087c8305a4f6
                                                        • Opcode Fuzzy Hash: ce8d4379c629bcd2e40492a2a49cc2a68a8e13a90f0cec3b32964914661c2c3e
                                                        • Instruction Fuzzy Hash: 63D1F2729183618BD710CE28C88136AB7E2EF85310F3989B9DC96CF356E335D845D795
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f315496cc42e06e35b9f9c064188ae51dc9ded88c6bc92d1747087161525bbd0
                                                        • Instruction ID: 7a853b8a20996199dba5b5a5e17ca19378e119ea9c999e0c2545a79d357b8191
                                                        • Opcode Fuzzy Hash: f315496cc42e06e35b9f9c064188ae51dc9ded88c6bc92d1747087161525bbd0
                                                        • Instruction Fuzzy Hash: 38F12575A083458FC718CF18C891B5AF7E6FBCC314F09892EE98A97762D734E9458B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fc127aefda8e8853143bf40c7bccf88c13436e1413f53e6a311513c7283cbfcc
                                                        • Instruction ID: dd9df089b2ede18d61b09027eb04b9aada35eebc959f886a42edaf749e851632
                                                        • Opcode Fuzzy Hash: fc127aefda8e8853143bf40c7bccf88c13436e1413f53e6a311513c7283cbfcc
                                                        • Instruction Fuzzy Hash: B002A1B4A18794CBD754CF29C58068ABBE1FBC9350F118A2EF9A887364D7749845CF82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c3b99305d6d228989113bd8aeb6dd86713a4088cf676f62655ee97cb44f0bb1a
                                                        • Instruction ID: 3d0870fb63785ee3d087e596b45700dc7f5735dee0ab32d5e0c75b3dd3c3cef2
                                                        • Opcode Fuzzy Hash: c3b99305d6d228989113bd8aeb6dd86713a4088cf676f62655ee97cb44f0bb1a
                                                        • Instruction Fuzzy Hash: 72E1F475B083458FC718CF6DC88075AF7E2FBC8704F098A3EE98997765D634A9458B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5a2f94ac762cd677dc8362f514d4668eefae1739862ad9c7aa78fec698a4c789
                                                        • Instruction ID: be10b61e0e400d7f3c7b246480c7663c1106f3f721ef33eb9267169c2a0f6ae4
                                                        • Opcode Fuzzy Hash: 5a2f94ac762cd677dc8362f514d4668eefae1739862ad9c7aa78fec698a4c789
                                                        • Instruction Fuzzy Hash: 1FC14D3160496CCFD75CEF29D8E48753393ABE831174B86ADD6034B3A5CA30B925DB94
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 28f94882668a57adb90dd1fc6bb69396616865b816e18890b60b974d0b6ce670
                                                        • Instruction ID: e9c25fcd0952e9e9d916294726128921c44990a4fb84a511dd07ae25fe2c2566
                                                        • Opcode Fuzzy Hash: 28f94882668a57adb90dd1fc6bb69396616865b816e18890b60b974d0b6ce670
                                                        • Instruction Fuzzy Hash: 09C140302087959FC745DF2AC4805A6FBF1EF9A200F49C55EE8D8CB346D634EA15DB91
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ee0655b07f9a60d7e6c93e24dd163bbcdd8dd7aa916f57eec32edbbdc4cc49b7
                                                        • Instruction ID: 1db670544306bd251aebef4a7dbe6716f8247bd2a01bbc6002f53e6d6edf3967
                                                        • Opcode Fuzzy Hash: ee0655b07f9a60d7e6c93e24dd163bbcdd8dd7aa916f57eec32edbbdc4cc49b7
                                                        • Instruction Fuzzy Hash: 7BA14C745083168BD750DF16E4442AFF7E0FF94B84F958A2EF898DB250E234D981DB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d016340bc325db1fd1648bbb37fa4be5db1333341c3535a9616d09fdc8b0c0ba
                                                        • Instruction ID: 5b61de884d90df82446b19460e85b2eea36a0198e06777fdadc74bd29ad9c96a
                                                        • Opcode Fuzzy Hash: d016340bc325db1fd1648bbb37fa4be5db1333341c3535a9616d09fdc8b0c0ba
                                                        • Instruction Fuzzy Hash: DDB15F302087959FC745DF2AC4805A6FBF1AF9A200F89C55EE8D8CB347D634EA15DBA1
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0fdca86bf5610cf8d83fc9a2a9123c7de6589e9a7e00ce3a8cca6f1a48dd3632
                                                        • Instruction ID: 8c294614796abfce7a9b313687c0130c20c351539878b9b69ed8c38673feebb7
                                                        • Opcode Fuzzy Hash: 0fdca86bf5610cf8d83fc9a2a9123c7de6589e9a7e00ce3a8cca6f1a48dd3632
                                                        • Instruction Fuzzy Hash: 2DA134356002118FD398DE1FD8D0D6A7393ABC432DF5BC26E9E445B3AACD38B4669790
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 930e695f6b8eca41130a53b596d6cf8baec4992ec9755c4dd3e6ab00923b5f85
                                                        • Instruction ID: ebf589678dd2b21f450bef16afd8acf277a4c86fda3af18da15dd9d105d6ad1f
                                                        • Opcode Fuzzy Hash: 930e695f6b8eca41130a53b596d6cf8baec4992ec9755c4dd3e6ab00923b5f85
                                                        • Instruction Fuzzy Hash: 0CA13C70E003198FD39CDE1ED850E7A73A3AFC8229B8B865E95464F2F6DD346461C798
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cdeefbb9b1cc8c6670991cf24b173620491e3b0587a273fc61fabb3fb5080e81
                                                        • Instruction ID: f4f4e952c433a0949d58c36d6cc90477ad4d8c83a35f662541151486efee236c
                                                        • Opcode Fuzzy Hash: cdeefbb9b1cc8c6670991cf24b173620491e3b0587a273fc61fabb3fb5080e81
                                                        • Instruction Fuzzy Hash: 076190716093959FC701CF69848055AFBF1FF9A200F19896EE9D8D7342D330EA15CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f7460696957a74314385251e6c6bcc12f45c6b26b427e07c74903d9ed9e685e2
                                                        • Instruction ID: a9fd71970cc6ae0704401159e34ccb1fdaf457640d2c7af12330d1c819c8daf0
                                                        • Opcode Fuzzy Hash: f7460696957a74314385251e6c6bcc12f45c6b26b427e07c74903d9ed9e685e2
                                                        • Instruction Fuzzy Hash: 8941B173F2582507E7188828CC05319B2C3DBE4271B1EC37AED59EB789E934ED1686C2
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 95de5cfb7fefc0799c9c6931d173e6ec651f50519c43e477457960f263de7522
                                                        • Instruction ID: a62b2dee07404cea211b2efb13baac961549e0bcf9cdcf768083b85999019a1a
                                                        • Opcode Fuzzy Hash: 95de5cfb7fefc0799c9c6931d173e6ec651f50519c43e477457960f263de7522
                                                        • Instruction Fuzzy Hash: B691D7755042628FDB40CF29C580692BBE1FF99320F5D85BAED989F31AD270A951CFA0
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8a242dc87f5c93d7af9d14441f2c5b7f2a550f65f8e3fc145424b163f276814f
                                                        • Instruction ID: df19a67aeb3eb1ac8f7c04359b992b1f8df16513256b81dfba3ade0116543761
                                                        • Opcode Fuzzy Hash: 8a242dc87f5c93d7af9d14441f2c5b7f2a550f65f8e3fc145424b163f276814f
                                                        • Instruction Fuzzy Hash: E571FCC55496F08DD70E8A3682F16F27FE00B67122F1D47EBAAD50F693C2298149EB35
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2e5339e86325d42bd6281c81f51f6f83cb80fe511d73c762a27f573bff63cef8
                                                        • Instruction ID: 40aabe202a40184f6c89db9be28c5e271f9100c876ec067dbcd78a5b86649b1c
                                                        • Opcode Fuzzy Hash: 2e5339e86325d42bd6281c81f51f6f83cb80fe511d73c762a27f573bff63cef8
                                                        • Instruction Fuzzy Hash: 5681CD745042528FDB94CF29C5C0A96BBE1FF99310F5988B9ED9C8F61AE230A941DF60
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7b576644014d14f1c54322c87fd66bbfde8640324f1e42ad5ea2fc848f20d65e
                                                        • Instruction ID: 3b5e75aad5a0c08e1416bd72158d909f1297ac2347114389bb20aec0d49765e5
                                                        • Opcode Fuzzy Hash: 7b576644014d14f1c54322c87fd66bbfde8640324f1e42ad5ea2fc848f20d65e
                                                        • Instruction Fuzzy Hash: 26516B71A043148FC314DF5AC480956B3E1FF8C218F8A896EDA855B363CB74B812CB94
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 6a2513f73ccef5aec2b55aaaa03c115ed443044f3c6124b9d960365810a0306e
                                                        • Instruction ID: abf727b3a972acfad7dcd21eee2ec69e4a3f2dc070b43d75464f4bdfea808785
                                                        • Opcode Fuzzy Hash: 6a2513f73ccef5aec2b55aaaa03c115ed443044f3c6124b9d960365810a0306e
                                                        • Instruction Fuzzy Hash: 1241E53AD097449FD325CE3484C6491B7A0FE86260B0A478FECD0571A3FB32945BC796
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 21e1bf70edc85c72b57ecd771a589712a2623989afca4d70576e69868d5c536e
                                                        • Instruction ID: 9aaf14044436f1b2b42603b9fb6b72ce4f3e40e728a04a0e74472568190d7af2
                                                        • Opcode Fuzzy Hash: 21e1bf70edc85c72b57ecd771a589712a2623989afca4d70576e69868d5c536e
                                                        • Instruction Fuzzy Hash: 5E419866B0833196E314ABEDF4C049DF2E1FED1BA1B824A69D2952F141D330D449C7E7
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 8b90650c6bf10e00771a62b178fc97b98f7b28062ca67f212be0d6454448b7df
                                                        • Instruction ID: a1ee27c0dc52f8c5174c005de0bcff99ec75529c3159a0a458bf5de33efdcca9
                                                        • Opcode Fuzzy Hash: 8b90650c6bf10e00771a62b178fc97b98f7b28062ca67f212be0d6454448b7df
                                                        • Instruction Fuzzy Hash: 70413E0914D3E44ECB8E9B3A00B58F67FE1AC5B11536EC1EFE9C60F293C619450AEB60
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 01961a118ebc83994ce737a496e9055b1f8ab46d9bbd015c8cfe35346e32c7fc
                                                        • Instruction ID: 6d93bd8323a72235920ba6e149a4a7bae96c73b66a2dfad555009d0c6ff0ce4f
                                                        • Opcode Fuzzy Hash: 01961a118ebc83994ce737a496e9055b1f8ab46d9bbd015c8cfe35346e32c7fc
                                                        • Instruction Fuzzy Hash: 5311D2B3F2453203E71CD4199C2136D828387E82B071FC23FDE47A7286EC609D5682D1
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 16418492506d26e88d9ea5ffe778ecedbadd0674902667d5b4f3f091e616a9e4
                                                        • Instruction ID: 959dd8b958685b2c602623f8f1487b2043f59aa88e98173f8505a8abe479dfa4
                                                        • Opcode Fuzzy Hash: 16418492506d26e88d9ea5ffe778ecedbadd0674902667d5b4f3f091e616a9e4
                                                        • Instruction Fuzzy Hash: 01214F33BA0CAB07D748CD7ACC823DA62D3E7C4209F49C6789556D7649D53DD8429680
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f3141d09b1683437dc047317c092a48923b199cea0971d17c0b8de08017b4ddf
                                                        • Instruction ID: 7401ec26052bbdd11a75dd464f743d8617a1d02d8098354ba99e3f62ca5db7ec
                                                        • Opcode Fuzzy Hash: f3141d09b1683437dc047317c092a48923b199cea0971d17c0b8de08017b4ddf
                                                        • Instruction Fuzzy Hash: A8219D73F300320BC728CD7D8C5825662C1D7C8295B4E8BB9EE58EF786E668DD419AC0
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: de151643a332339ce823666c471d4da1aa7b144928b0c7d3fd1e004a2c822b77
                                                        • Instruction ID: 192b5b8e635135c3962563ef613f7b52fce4010c0b042699b34e9086fceffb22
                                                        • Opcode Fuzzy Hash: de151643a332339ce823666c471d4da1aa7b144928b0c7d3fd1e004a2c822b77
                                                        • Instruction Fuzzy Hash: 38316F651087D85ECB11CF3544904EABFE09EAB581B09C49EF8E84B247C524EB09EB71
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c78873d4f70a7114040ce7729ab5ab63925d14f9cd724e7e38f810f9ad5a330b
                                                        • Instruction ID: 7615e6e647f5862a10f08712ea71b14590be4302af2179b17c0dfb1654340f57
                                                        • Opcode Fuzzy Hash: c78873d4f70a7114040ce7729ab5ab63925d14f9cd724e7e38f810f9ad5a330b
                                                        • Instruction Fuzzy Hash: FF2122726042658BCB14DE19C8D86AB73E2FBC9314F168A68E9C55F205C234F84ACBD1
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 21e8cd7bf255c7c8b941f54418a5bf7396c934417188cacc302b08a8026b8cc6
                                                        • Instruction ID: e42923ef10120b0fce72e2dfd62ff0f6b1e92c6f034ab2fe8244b6ba9566043e
                                                        • Opcode Fuzzy Hash: 21e8cd7bf255c7c8b941f54418a5bf7396c934417188cacc302b08a8026b8cc6
                                                        • Instruction Fuzzy Hash: 2F115E73E301320BC724CD7D8C4834262C1D788256B4E8BB5DE98EF342E268ED429AC0
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 2855c1fd0bc473689ac7151c799de4b67eb7dbd14f8e375b0c1984da4defb2b2
                                                        • Instruction ID: bb67aa5c3e79cddec5f4daef0c555e321a96bdb8e320fd3e56e053c9fc0aa2d4
                                                        • Opcode Fuzzy Hash: 2855c1fd0bc473689ac7151c799de4b67eb7dbd14f8e375b0c1984da4defb2b2
                                                        • Instruction Fuzzy Hash: 5A312DB1A146309BE358CF1AEDE462AF3E2E38C320F46416DD989933B1D9786C25C790
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ad436124cf0627712d9c57b5f9352303ce41f418a33c0e13c018656ee81bd46e
                                                        • Instruction ID: d55ec0bf4d8ccb7feddbac453193f8db4f74bc196d46466865d676d0862984f4
                                                        • Opcode Fuzzy Hash: ad436124cf0627712d9c57b5f9352303ce41f418a33c0e13c018656ee81bd46e
                                                        • Instruction Fuzzy Hash: DC21AD3400D7E05EC712DB66809007AFFE1AE97112F09C9EEE8E84B383D1399204DB23
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: fcfb03660752ab5eb4e93aa23948fa86d37fc4137dad975b936b97558449d880
                                                        • Instruction ID: 08507b88d5ea8c10eecfe47a9cb0e80ccc9b4415782bb3c2fd75addcbcacf11c
                                                        • Opcode Fuzzy Hash: fcfb03660752ab5eb4e93aa23948fa86d37fc4137dad975b936b97558449d880
                                                        • Instruction Fuzzy Hash: F411A235808B868BD315CF38C482465B7A0FFCA294F058759D99577153E731E88B8756
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 0c76c69a6e16dc7822b4f5a1a757f8ccc5bafd5d8a12991ea2ea248d2ead5663
                                                        • Instruction ID: cb6bd734151cd8d44044ce49627ebacfeb84b08cb3a248c712c7f8227f187652
                                                        • Opcode Fuzzy Hash: 0c76c69a6e16dc7822b4f5a1a757f8ccc5bafd5d8a12991ea2ea248d2ead5663
                                                        • Instruction Fuzzy Hash: 2321E471A08105DFCB68CF88E690A9DB7F5EF0A314FA00095E905AB612DB34EDC0EB56
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 123d4edf2cae72c4cb44158153aca10c35860e83f93e9ec1453424ef70596d6d
                                                        • Instruction ID: bcaa8491dccb865917a35a3d808823525e0e43ff59a73624eea8fea794acadd0
                                                        • Opcode Fuzzy Hash: 123d4edf2cae72c4cb44158153aca10c35860e83f93e9ec1453424ef70596d6d
                                                        • Instruction Fuzzy Hash: 141134326041618BCB15CE69C8D86AA73D2FBC9315F17C968E9C69F245C334F94ACBD0
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 9acf928a80fa7d5092a9227ffdde5a5ec425d920ddeb07c3dbf611afe1a34b73
                                                        • Instruction ID: 105999df1bb95d177b10598adac08acd804ba4400ef6563b978d1058cdfb1ef1
                                                        • Opcode Fuzzy Hash: 9acf928a80fa7d5092a9227ffdde5a5ec425d920ddeb07c3dbf611afe1a34b73
                                                        • Instruction Fuzzy Hash: E511254900D3D919DB469F3904748FBBFF1ACCB205F8969EBE8D146643C118915EE762
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ca7d7dad83a973bb790b37e6832e95b579524e0ac113e1f4aa988c8562b958bd
                                                        • Instruction ID: f8771a243a862af8759e5689c7b57640d36b1020b076dab7645bd5d8fe9118fc
                                                        • Opcode Fuzzy Hash: ca7d7dad83a973bb790b37e6832e95b579524e0ac113e1f4aa988c8562b958bd
                                                        • Instruction Fuzzy Hash: BDF0F676B1435947E900DF459C40B8BB7D9FFC42D8F16052EED48A3305C630BD0586A1
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 566e91d0b8d452359c7bb78fe999ee31250548b62ca49a35f0ac2a50155920e7
                                                        • Instruction ID: fb49bc79d4318df5132ff4e8978937c42cbf5c601f0cfd761cb428f5592a7514
                                                        • Opcode Fuzzy Hash: 566e91d0b8d452359c7bb78fe999ee31250548b62ca49a35f0ac2a50155920e7
                                                        • Instruction Fuzzy Hash: 19E0C9B62193159FE314DE09E8808A7FBECEBD8664B10492FF4C493300C231AC448BB1
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 84 10017162-10017164 85 1001717e-10017184 84->85 86 10017177-1001717c 85->86 87 10017186-10017189 85->87 86->85 88 1001719a-10017637 call 10015f80 86->88 87->86 89 1001718b-1001718d 87->89 91 10017170-10017172 89->91 92 1001718f-10017191 89->92 91->86 93 10017174-10017176 91->93 92->93 95 10017193-10017198 92->95 93->86 95->85 95->88
                                                        APIs
                                                        Strings
                                                        • Invalid chars '%s' at the end of expression '%s', xrefs: 1001726C
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mallocz
                                                        • String ID: Invalid chars '%s' at the end of expression '%s'
                                                        • API String ID: 1901900789-1422635149
                                                        • Opcode ID: b9b5404f8f7a3a855f615fbe720d284632f6c1f76810d66ba6a38d70fdf3f15c
                                                        • Instruction ID: bac24a0257c5d849bb0dbfe2b802779c263aec53df092acb8c93c3cd01452c15
                                                        • Opcode Fuzzy Hash: b9b5404f8f7a3a855f615fbe720d284632f6c1f76810d66ba6a38d70fdf3f15c
                                                        • Instruction Fuzzy Hash: CBE184B89097819FC780DF68C48191ABBF1FF88250F85586DF8C58B316E735E881CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        APIs
                                                        Strings
                                                        • Invalid chars '%s' at the end of expression '%s', xrefs: 1001726C
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$mv_expr_free$mv_log
                                                        • String ID: Invalid chars '%s' at the end of expression '%s'
                                                        • API String ID: 75827668-1422635149
                                                        • Opcode ID: 868f8d433a9d4ff7ca381ed327b9c79258ebc14a83ef6ba52564f0dccba394d0
                                                        • Instruction ID: 47d116fedaedebc931fd27d2d79ea71f155cf045d5fda504e80a0eb2e0d77697
                                                        • Opcode Fuzzy Hash: 868f8d433a9d4ff7ca381ed327b9c79258ebc14a83ef6ba52564f0dccba394d0
                                                        • Instruction Fuzzy Hash: 86C146B95097519FC784EFA8D48581EBBE0FF88350F85586DF8C18B316E735E8848B92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        APIs
                                                        • mv_expr_parse.MAIN ref: 10017862
                                                          • Part of subcall function 10017110: strlen.MSVCRT ref: 10017141
                                                          • Part of subcall function 10017110: mv_malloc.MAIN ref: 1001714A
                                                        • mv_expr_free.MAIN ref: 100178D7
                                                        • mv_expr_free.MAIN ref: 100178E6
                                                        • mv_expr_free.MAIN ref: 100178F5
                                                        • mv_freep.MAIN ref: 10017904
                                                        • mv_freep.MAIN ref: 1001790C
                                                        • mv_expr_free.MAIN ref: 10017926
                                                        • mv_expr_free.MAIN ref: 10017935
                                                        • mv_expr_free.MAIN ref: 10017944
                                                        • mv_freep.MAIN ref: 10017953
                                                        • mv_freep.MAIN ref: 1001795B
                                                        • mv_expr_free.MAIN ref: 10017975
                                                        • mv_expr_free.MAIN ref: 10017984
                                                        • mv_expr_free.MAIN ref: 10017993
                                                        • mv_freep.MAIN ref: 100179A2
                                                        • mv_freep.MAIN ref: 100179AA
                                                        • mv_freep.MAIN ref: 100179B9
                                                        • mv_freep.MAIN ref: 100179C5
                                                        • mv_expr_free.MAIN ref: 100179EE
                                                        • mv_freep.MAIN ref: 10017A1B
                                                        • mv_freep.MAIN ref: 10017A23
                                                        • mv_freep.MAIN ref: 10017A79
                                                        • mv_freep.MAIN ref: 10017A81
                                                        • mv_expr_free.MAIN ref: 10017A6A
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100159C5
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100159D1
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100159E0
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100159EC
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100159FB
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015A07
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015A16
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015A22
                                                        • mv_expr_free.MAIN ref: 10017A5B
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001584F
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001585B
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100158A2
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100158AE
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100158BD
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100158C9
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001591F
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001592B
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015972
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001597E
                                                        • mv_expr_free.MAIN ref: 10017A4C
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100156C6
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100156D5
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100156E1
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100156F0
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100156FC
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015770
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001577C
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001579A
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100157A6
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100157FC
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015808
                                                        • mv_freep.MAIN ref: 10017A90
                                                        • mv_freep.MAIN ref: 10017A9C
                                                        • mv_expr_free.MAIN ref: 10017AC5
                                                        • mv_expr_free.MAIN ref: 10017AD4
                                                        • mv_expr_free.MAIN ref: 10017AE3
                                                        • mv_freep.MAIN ref: 10017AF2
                                                        • mv_freep.MAIN ref: 10017AFA
                                                        • mv_expr_free.MAIN ref: 10017B14
                                                        • mv_expr_free.MAIN ref: 10017B23
                                                        • mv_expr_free.MAIN ref: 10017B32
                                                        • mv_freep.MAIN ref: 10017B41
                                                        • mv_freep.MAIN ref: 10017B49
                                                        • mv_expr_free.MAIN ref: 10017A32
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015588
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015594
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100155DB
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100155E7
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100155F6
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015602
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015667
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015673
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100156BA
                                                        • mv_expr_free.MAIN ref: 10017A0C
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001542C
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015438
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015447
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015453
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001549A
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100154A6
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100154B5
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100154C1
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015517
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015523
                                                        • mv_expr_free.MAIN ref: 100179FD
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100152FA
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015306
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 1001534D
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015359
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015368
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 10015374
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100153D9
                                                          • Part of subcall function 10015280: mv_freep.MAIN ref: 100153E5
                                                        • mv_expr_free.MAIN ref: 10017B63
                                                        • mv_expr_free.MAIN ref: 10017B72
                                                        • mv_expr_free.MAIN ref: 10017B81
                                                        • mv_freep.MAIN ref: 10017B90
                                                        • mv_freep.MAIN ref: 10017B98
                                                        • mv_freep.MAIN ref: 10017BA7
                                                        • mv_freep.MAIN ref: 10017BB3
                                                        • mv_freep.MAIN ref: 10017BC2
                                                        • mv_freep.MAIN ref: 10017BCE
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$mv_expr_free$mv_expr_parsemv_mallocstrlen
                                                        • String ID:
                                                        • API String ID: 1389959791-0
                                                        • Opcode ID: 8ed2cf0b96ea738395e10688aaa6a7ba80d46e84586e5b5581eb5791b7552261
                                                        • Instruction ID: 676c052f7482def6436772c87c2f32b108e761ae451283d38321aee012e0f911
                                                        • Opcode Fuzzy Hash: 8ed2cf0b96ea738395e10688aaa6a7ba80d46e84586e5b5581eb5791b7552261
                                                        • Instruction Fuzzy Hash: 1BD173B9A187418FC750EF68D48191ABBF0FF89214F45496DE9D48B315E736E8848F82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 242 1004e110-1004e124 243 1004e126-1004e136 242->243 243->243 244 1004e138-1004e170 mv_bprint_init mv_bprintf 243->244 245 1004e364-1004e373 244->245 246 1004e176 244->246 257 1004e380-1004e391 mv_bprintf 245->257 247 1004e320-1004e325 246->247 248 1004e180-1004e18c 246->248 249 1004e2e0-1004e2e5 246->249 250 1004e2c0-1004e2c5 246->250 251 1004e300-1004e305 246->251 252 1004e2f0-1004e2f5 246->252 253 1004e2d0-1004e2d5 246->253 254 1004e310-1004e315 246->254 255 1004e2b0-1004e2b5 246->255 256 1004e190-1004e1be mv_bprintf * 2 248->256 249->256 250->256 251->256 252->256 253->256 254->256 255->256 258 1004e1c0-1004e1d5 mv_bprintf 256->258 259 1004e1d8-1004e1db 256->259 258->259 259->257 260 1004e1e1-1004e226 mv_bprintf * 2 259->260 261 1004e3c0-1004e3d1 mv_bprintf 260->261 262 1004e22c-1004e22e 260->262 263 1004e257-1004e279 mv_bprintf call 1004da90 262->263 264 1004e230-1004e240 mv_bprintf 262->264 269 1004e3a0-1004e3b9 mv_bprintf 263->269 270 1004e27f-1004e2af mv_log 263->270 266 1004e245-1004e249 264->266 266->263 268 1004e24b-1004e251 266->268 268->263 271 1004e330-1004e348 mv_bprintf 268->271 271->262 272 1004e34e-1004e35f mv_bprintf 271->272 272->266
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_initmv_bprintf
                                                        • String ID: %s$%s - type: $%s, factors: [$, len: $, prio: %i$[%i, $], $any$fft_double$fft_float$fft_int32$mdct_double$mdct_float$mdct_int32$rdft_double$rdft_float$rdft_int32$unknown
                                                        • API String ID: 3566169034-155954179
                                                        • Opcode ID: 81df4f6659a1d45bf056d6d3f9a5766262a3584ff400d984b9363f1ccdd33eb0
                                                        • Instruction ID: a933a466284158a9cdbf5e2fa88c9023184ecaf356d014cc5bc8696811956cc8
                                                        • Opcode Fuzzy Hash: 81df4f6659a1d45bf056d6d3f9a5766262a3584ff400d984b9363f1ccdd33eb0
                                                        • Instruction Fuzzy Hash: 5051F7B8A08784CBD740EF29858191EBBE1FB84350F65892EE8C9CB355DB38DC409B46
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 273 10029950-10029958 274 1002942a-10029459 mv_log 273->274 275 1002995e-1002998a mv_log 273->275 276 1002945e-1002959d mv_log 274->276 275->276 277 100299d5-100299e3 call 10028940 275->277 279 1002959f-100295b8 mv_log 276->279 280 100295bd-100295ef 276->280 282 1002935a-10029373 mv_log 277->282 279->280 285 10029732-10029738 280->285 286 100295f5-10029606 280->286 284 10029378-1002939b mv_log 282->284 289 100293d0-100293d5 284->289 290 1002939d-100293a3 284->290 285->284 291 1002973e-10029741 285->291 287 100296c3-100296d0 286->287 288 1002960c-10029615 286->288 297 100296d2 287->297 298 100296fc-100296fe 287->298 288->287 292 1002961b-10029620 288->292 295 10029310-1002931a 289->295 296 100293db-100293de 289->296 290->289 293 100293a5-100293c9 call 10029240 290->293 291->284 294 10029747-1002974a 291->294 299 10029626-1002962e 292->299 300 1002971e-1002972d mv_freep * 2 292->300 293->289 302 10029798-1002979d 294->302 303 1002974c-10029750 294->303 296->289 309 1002928e-10029297 296->309 297->300 305 10029702-10029712 298->305 306 10029630-100296b7 mv_log call 10028940 mv_log call 10028940 mv_log 299->306 300->285 310 10029762-10029784 mv_log 302->310 311 1002979f-100297a0 302->311 303->302 308 10029752-10029755 303->308 312 10029714-1002971c 305->312 313 100296d8-100296fa mv_freep * 2 305->313 340 100296bd-100296c1 306->340 308->310 315 10029757-10029760 308->315 309->289 317 1002929d-100292a6 309->317 310->282 316 1002978a-1002978d 310->316 311->284 312->300 312->305 313->298 313->300 315->302 315->310 316->277 316->302 319 100297e6-100297f9 316->319 320 100299e8-10029a07 call 100290d0 316->320 321 100297a8-100297cd mv_log 316->321 322 10029a5e-10029a9c mv_d2q mv_log 316->322 323 100293e8-100293eb 317->323 324 100292ac-100292af 317->324 329 10029810-1002981d 319->329 330 100297fb-10029803 319->330 341 10029c0d-10029c37 mv_log 320->341 342 10029a0d-10029a3b mv_log mv_freep 320->342 321->282 322->282 323->289 327 100293ed-10029425 mv_log 323->327 324->289 328 100292b5-100292ca strcmp 324->328 328->289 333 100292d0-100292f6 mv_log 328->333 336 10029823-10029835 329->336 337 10029b64-10029b82 mv_log 329->337 334 10029af9-10029afe 330->334 335 10029809 330->335 333->274 343 100292fc 333->343 334->329 344 10029b04-10029b08 334->344 335->329 338 10029b87-10029ba5 mv_log 336->338 339 1002983b-10029847 336->339 337->282 338->282 345 10029bec-10029c08 mv_log 339->345 346 1002984d-10029859 339->346 340->287 341->282 342->282 343->295 344->329 347 10029b0e-10029b12 344->347 345->282 348 10029bcb-10029be7 mv_log 346->348 349 1002985f-1002986c 346->349 350 10029b14-10029b19 347->350 351 10029b28-10029b39 strcmp 347->351 348->282 354 10029872-100298a0 mv_log 349->354 355 10029baa-10029bc6 mv_log 349->355 350->329 352 10029b1f-10029b26 350->352 351->350 353 10029b3b-10029b4f 351->353 352->350 352->351 353->350 356 10029b51 353->356 354->282 355->282 356->337
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log$mv_freep
                                                        • String ID: %-15s $ %s$ (default $ (from $ to $"%s"$%-12lld $%-12s $%c%c%c%c%c%c%c%c%c%c%c$%d/%d$%lld
                                                        • API String ID: 3216983768-538076109
                                                        • Opcode ID: fe8bf675046af0f29d531435944fbc74d31e1b5dd77af1cbcd62e325a06ac8c6
                                                        • Instruction ID: 6669a645e77abe44fb88f8918c652bef149803a1577f2af9334f6d103ff6ece3
                                                        • Opcode Fuzzy Hash: fe8bf675046af0f29d531435944fbc74d31e1b5dd77af1cbcd62e325a06ac8c6
                                                        • Instruction Fuzzy Hash: 6102E3B4A187418FC714CF28D48065EBBE1FF89790F95C92EF8A98B391D774E8458B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 500 10009730-10009752 501 10009870-10009881 call 100086f0 500->501 502 10009758-1000975b 500->502 512 10009883-1000988a 501->512 513 100098a6-100098b3 501->513 504 10009761-10009766 502->504 505 10009808-1000980d 502->505 507 10009862-10009869 504->507 509 1000976c-10009774 504->509 505->507 508 1000980f-10009812 505->508 514 10009930-1000993d 508->514 515 10009818-1000981e 508->515 510 100099e8-100099ea 509->510 511 1000977a-1000977c 509->511 521 100099ec 510->521 522 10009a4d-10009a4f 510->522 516 10009782 511->516 517 100098ff-10009901 511->517 518 10009890-10009892 512->518 532 100098c0-100098d7 mv_bprintf 513->532 519 10009c70-10009c7f 514->519 520 10009943-1000994e 514->520 523 10009824-1000982f 515->523 524 100099b8-100099c6 call 100086f0 515->524 525 100097cd-100097cf 516->525 529 10009bd0-10009be5 mv_bprintf 517->529 530 10009907-10009909 517->530 518->532 533 10009894-100098a4 call 100086f0 518->533 531 10009c80-10009ca9 strchr * 2 519->531 534 10009950-10009979 strchr * 2 520->534 535 100099f0-100099f8 521->535 526 10009c10-10009c25 mv_bprintf 522->526 527 10009a55 522->527 536 10009830-10009842 strchr 523->536 524->507 558 100099cc-100099da call 100086f0 524->558 541 10009bf0-10009c05 mv_bprintf 525->541 542 100097d5 525->542 565 10009c30-10009c45 mv_bprintf 526->565 538 10009a10-10009a12 527->538 539 10009a57-10009a60 527->539 529->541 543 100098e0-100098e2 530->543 544 1000990b-10009925 mv_bprintf 530->544 545 10009cf0-10009cf6 531->545 546 10009cab-10009cb2 call 100086f0 531->546 532->518 537 100098d9 532->537 533->513 533->518 548 10009b40-10009b52 strchr 534->548 549 1000997f-10009986 call 100086f0 534->549 550 10009a88-10009a8d call 100086f0 535->550 551 100099fe-10009a01 535->551 552 10009850-10009860 call 100086f0 536->552 553 10009844-1000984b call 100086f0 536->553 537->513 538->565 566 10009a18-10009a1a 538->566 569 10009b90-10009b9a call 100086f0 539->569 570 10009a66-10009a80 mv_bprintf 539->570 541->526 572 100097d7-100097e0 542->572 573 10009788-1000978a 542->573 567 10009bb0-10009bc5 mv_bprintf 543->567 568 100098e8-100098ed call 100086f0 543->568 574 100098f2-100098f9 544->574 556 10009cb7-10009cc7 call 100086f0 545->556 557 10009cf8-10009cfd 545->557 546->556 548->549 577 10009b58-10009b5e 548->577 579 1000998b-1000999b call 100086f0 549->579 590 10009a92-10009a99 550->590 551->538 551->550 560 10009ac0-10009ada mv_bprintf 551->560 561 10009aa4-10009abe mv_bprintf 551->561 562 10009b17-10009b31 mv_bprintf 551->562 563 10009af8-10009b12 mv_bprintf 551->563 564 10009adc-10009af6 mv_bprintf 551->564 552->507 552->536 553->552 556->507 606 10009ccd-10009ccf 556->606 557->546 584 10009cff-10009d04 557->584 558->524 607 100099dc 558->607 560->590 561->590 562->590 563->590 564->590 587 10009c50-10009c65 mv_bprintf 565->587 566->569 586 10009a20-10009a3a mv_bprintf 566->586 567->529 568->574 611 10009ba0-10009ba5 569->611 589 10009a40-10009a47 570->589 591 10009b80-10009b8a call 100086f0 572->591 592 100097e6-10009800 mv_bprintf 572->592 573->587 588 10009790-10009792 573->588 574->507 574->517 578 10009b64-10009b69 577->578 577->579 578->549 593 10009b6f-10009b74 578->593 579->507 608 100099a1-100099a3 579->608 584->546 595 10009d06 584->595 586->589 587->519 588->591 598 10009798-100097b9 mv_bprintf 588->598 589->507 589->522 590->535 599 10009a9f 590->599 591->569 600 100097c0-100097c7 592->600 593->549 603 10009b7a 593->603 595->556 598->600 599->507 600->507 600->525 603->579 609 10009ce0-10009ce5 606->609 610 10009cd1-10009cda 606->610 607->507 608->611 612 100099a9-100099b2 608->612 609->531 610->531 611->534 612->534
                                                        APIs
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097AD
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB
                                                        • strchr.MSVCRT ref: 1000983B
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009920
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C05
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf$strchr
                                                        • String ID: &amp;$&apos;$&gt;$&lt;$&quot;$'\''
                                                        • API String ID: 2626076477-3929336650
                                                        • Opcode ID: 12b6750b4a52a26ed5acad3795ae941bdf77578173880ce7d0d3f74c73066fa8
                                                        • Instruction ID: db27ddebd36c8a04df1f9b29fc46dfe65a5f1e33d3c32a01edac565b911f7663
                                                        • Opcode Fuzzy Hash: 12b6750b4a52a26ed5acad3795ae941bdf77578173880ce7d0d3f74c73066fa8
                                                        • Instruction Fuzzy Hash: 7BD18174908B95CAE710DF29804076EBBE1FF826C0F56881EF9D58B20AD735E985D783
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        APIs
                                                          • Part of subcall function 10016E19: mv_mallocz.MAIN ref: 10016ECF
                                                        • mv_mallocz.MAIN ref: 10015A99
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mallocz
                                                        • String ID: *
                                                        • API String ID: 1901900789-163128923
                                                        • Opcode ID: f34b66a1ccc27e32b7c57b1c91422b2d98364e726381d3d9b355eaa3350dc528
                                                        • Instruction ID: 14329a75bb3270f280874b1f9c34d30974718639eef1760a85213997015026ea
                                                        • Opcode Fuzzy Hash: f34b66a1ccc27e32b7c57b1c91422b2d98364e726381d3d9b355eaa3350dc528
                                                        • Instruction Fuzzy Hash: 5791D4B9608701CFC344DF64D48141ABBE1FF88354F558A2EE8989F316D736E9868F92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 643 10028940-1002894b 644 10028953-1002895b 643->644 645 1002894d 643->645 647 10028963-1002896b 644->647 648 1002895d 644->648 645->644 646 10028a60-10028a7d mv_log 645->646 650 10028973-1002897b 647->650 651 1002896d 647->651 648->647 649 10028a38-10028a4d mv_log 648->649 655 10028a52-10028a55 649->655 653 10028983-1002898b 650->653 654 1002897d 650->654 651->650 652 10028ac0-10028add mv_log 651->652 657 10028993-1002899b 653->657 658 1002898d 653->658 654->653 656 10028a80-10028a9a mv_log 654->656 656->655 660 100289a3-100289ab 657->660 661 1002899d 657->661 658->657 659 10028aa0-10028aba mv_log 658->659 659->655 662 100289b3-100289bb 660->662 663 100289ad 660->663 661->660 664 10028b00-10028b1a mv_log 661->664 666 100289c3-100289cb 662->666 667 100289bd 662->667 663->662 665 10028b20-10028b3a mv_log 663->665 664->655 665->655 669 100289d3-100289db 666->669 670 100289cd 666->670 667->666 668 10028ae0-10028afa mv_log 667->668 668->655 672 100289e3-100289eb 669->672 673 100289dd 669->673 670->669 671 10028b40-10028b5a mv_log 670->671 671->655 675 100289f3-100289fb 672->675 676 100289ed 672->676 673->672 674 10028b5f-10028b79 mv_log 673->674 674->655 678 10028a03-10028a0b 675->678 679 100289fd 675->679 676->675 677 10028b7e-10028b98 mv_log 676->677 677->655 681 10028a11 678->681 682 10028b9d-10028bb8 mv_log 678->682 679->678 680 10028bc2-10028bdc mv_log 679->680 680->655 681->682 683 10028a17-10028a31 mv_log 681->683 682->680 683->655
                                                        APIs
                                                        • mv_log.MAIN(?,?,?,?,?,?,?,?,?,?,100299E3), ref: 10028A2C
                                                        • mv_log.MAIN(?,?,?,?,?,?,?,?,?,?,100299E3), ref: 10028A75
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log
                                                        • String ID: -DBL_MAX$-DBL_MIN$-FLT_MAX$-FLT_MIN$DBL_MAX$DBL_MIN$FLT_MAX$FLT_MIN$I64_MAX$I64_MIN$INT_MAX$INT_MIN$UINT32_MAX
                                                        • API String ID: 2418673259-2628725902
                                                        • Opcode ID: 6453b15dceaf4b7331f14c8ad6eaaf5a7c0dbe11f287a6335f0ed953db9f3e8b
                                                        • Instruction ID: c151ce863bab8d22e13df11496c1752d1bc59b589b709a0be275ec7c3333394e
                                                        • Opcode Fuzzy Hash: 6453b15dceaf4b7331f14c8ad6eaaf5a7c0dbe11f287a6335f0ed953db9f3e8b
                                                        • Instruction Fuzzy Hash: DC5133BD8067009ED355DF25B05121EFBE0FF84740FE5C92EA5C957211EB399685AB03
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 684 100195e0-100195f6 685 100197a0-100197a2 684->685 686 100195fc-1001963c MultiByteToWideChar 684->686 687 10019642-10019659 mv_calloc 686->687 688 100197e8-100197f0 686->688 689 100197f5-100197fb _errno 687->689 690 1001965f-10019698 MultiByteToWideChar 687->690 693 10019801 689->693 691 100197b0-100197b7 690->691 692 1001969e-100196c5 690->692 694 100197c2-100197c7 691->694 695 100197b9-100197bc 691->695 700 100198e1-100198eb _errno 692->700 701 100196cb-100196e0 mv_calloc 692->701 696 10019806-1001980d 693->696 694->692 697 100197cd-100197d6 694->697 695->692 695->694 697->692 699 100197dc 697->699 702 10019737-10019764 _wsopen mv_freep 699->702 705 100198f1-100198fe mv_freep 700->705 703 10019946-10019956 _errno 701->703 704 100196e6-10019706 701->704 706 10019790-10019797 702->706 707 10019766-1001976c 702->707 703->705 710 100198d9-100198dc call 100265b0 704->710 711 1001970c-10019729 mv_freep wcslen 704->711 705->696 707->693 709 10019772-1001978a _sopen 707->709 709->706 710->700 713 10019810-10019827 wcslen 711->713 714 1001972f 711->714 715 10019733-10019735 713->715 716 1001982d-10019831 713->716 714->715 715->702 715->709 717 100198a0-100198a7 716->717 718 10019833-1001983b 716->718 719 100198a9-100198ac 717->719 720 100198ae-100198b5 717->720 721 10019848-10019860 mv_calloc 718->721 722 1001983d-10019842 718->722 719->718 719->720 725 100198b7-100198ba 720->725 726 100198c9-100198ce 720->726 723 10019866-10019882 wcscpy wcscat 721->723 724 10019958-10019964 _errno 721->724 722->721 727 10019903-1001991b mv_calloc 722->727 728 10019887-10019893 mv_freep 723->728 724->705 725->718 729 100198c0-100198c3 725->729 726->718 730 100198d4 726->730 727->724 731 1001991d-10019941 wcscpy wcscat 727->731 728->702 729->718 729->726 730->702 731->728
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _errnomv_callocmv_freep$ByteCharMultiWidewcscatwcscpywcslen$_sopen_wsopen
                                                        • String ID: \\?\$\\?\UNC\
                                                        • API String ID: 2585690843-3019864461
                                                        • Opcode ID: 3b770d789a6b7b9b259c4104553542867824734224feeea9d00b87784f6ee047
                                                        • Instruction ID: f678d7e62f75a51a3396b5e92a4772b9af71e601e6ce56c2c03e9c047c1b1921
                                                        • Opcode Fuzzy Hash: 3b770d789a6b7b9b259c4104553542867824734224feeea9d00b87784f6ee047
                                                        • Instruction Fuzzy Hash: 8F91C2B49097119FD350EF69C98421EBBE0FF89754F55892EF898CB390E774D8809B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 732 100118c0-100118d1 733 100118d7-100118f5 732->733 734 10011a7d-10011a86 732->734 735 100118f9-100118fc 733->735 735->734 736 10011902-10011922 mv_get_token 735->736 737 10011924-10011927 736->737 738 10011929-1001194d mv_freep * 2 736->738 737->738 739 10011950-10011966 strspn 737->739 739->738 740 10011968-1001198b mv_get_token 739->740 740->738 741 1001198d-10011990 740->741 741->738 742 10011992-10011994 741->742 742->738 743 10011996-10011999 742->743 743->738 744 1001199b-100119c1 mv_strdup 743->744 745 100119c7-100119d5 mv_strdup 744->745 746 10011b08-10011b24 mv_dict_get 744->746 747 10011a90-10011aaa mv_mallocz 745->747 748 100119db-100119dd 745->748 749 10011acb-10011b03 call 100265b0 * 2 mv_freep * 2 747->749 750 10011aac-10011aae 747->750 751 10011ac0-10011ac5 748->751 752 100119e3-100119e9 748->752 750->752 753 10011ab4-10011ab6 750->753 754 10011b30-10011b47 mv_freep * 2 751->754 755 10011ac7 751->755 752->751 756 100119ef-100119f1 752->756 753->749 758 10011ab8-10011abf 753->758 754->755 755->749 759 10011b70-10011b8e mv_realloc_array 756->759 760 100119f7-100119fd 756->760 758->751 759->751 762 10011b94-10011b9a 759->762 763 10011c10-10011c24 call 100265b0 * 2 760->763 764 10011a03-10011a0f 760->764 785 10011c30-10011c35 763->785 767 10011ba0-10011bcb strlen * 2 mv_realloc 764->767 768 10011a15-10011a42 call 100265b0 * 2 764->768 767->751 770 10011bd1-10011be6 767->770 786 10011b50-10011b52 768->786 787 10011a48-10011a77 mv_freep * 2 768->787 773 10011c60-10011c63 770->773 774 10011be8-10011c08 mv_freep 770->774 779 10011c65-10011c68 773->779 780 10011ca8-10011cbe 773->780 782 10011c6a-10011c6d 779->782 783 10011c8e-10011ca6 779->783 780->779 782->774 784 10011c73-10011c89 782->784 783->782 784->774 785->735 788 10011c40-10011c57 mv_freep * 2 786->788 789 10011b58-10011b64 mv_freep 786->789 787->734 787->785 788->789
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$strspn$mv_get_tokenmv_strdup$mv_mallocstrlen
                                                        • String ID:
                                                        • API String ID: 2603649322-0
                                                        • Opcode ID: a48f40283b9e65b32d1f5a6441022cda31c27f9d96bb31350562698b963a6cb7
                                                        • Instruction ID: 9fb1d64ee0f767fe4cf9b76db285c661084ffa79d26213b968ed75a23716e163
                                                        • Opcode Fuzzy Hash: a48f40283b9e65b32d1f5a6441022cda31c27f9d96bb31350562698b963a6cb7
                                                        • Instruction Fuzzy Hash: D3B128759097419FC744DF25D58069EBBE5FF88690F96892EF8C89B311E730E980CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 790 1001c790-1001c7ad 791 1001c7b7-1001c7c7 mv_strcasecmp 790->791 792 1001c7e0-1001c7f0 mv_mallocz 791->792 793 1001c7c9-1001c7cd 791->793 796 1001c7f2-1001c7f8 792->796 797 1001c865-1001c86a 792->797 794 1001c7b0 793->794 795 1001c7cf-1001c7dd 793->795 794->791 799 1001c813 796->799 800 1001c7fa 796->800 798 1001c816-1001c81f 797->798 799->798 801 1001c8c0-1001c8c6 800->801 802 1001c900-1001c913 mv_ripemd_init 800->802 803 1001ca80-1001ca92 800->803 804 1001cac0-1001cae4 mv_crc 800->804 805 1001cb80-1001cb86 800->805 806 1001c848-1001c850 mv_md5_alloc 800->806 807 1001c808 mv_sha512_alloc 800->807 808 1001cb08-1001cb1a 800->808 809 1001c8d0-1001c8e3 mv_ripemd_init 800->809 810 1001c950-1001c963 mv_sha_init 800->810 811 1001c990-1001c9a3 mv_sha512_init 800->811 812 1001c9d0-1001c9e3 mv_sha512_init 800->812 813 1001c890 800->813 814 1001cb90-1001cb99 800->814 815 1001cb50-1001cb57 800->815 816 1001c852-1001c857 mv_murmur3_alloc 800->816 817 1001c918-1001c92b mv_ripemd_init 800->817 818 1001c820-1001c825 mv_ripemd_alloc 800->818 819 1001c8a0-1001c8a7 800->819 820 1001caa0-1001cab2 800->820 821 1001ca60-1001ca72 800->821 822 1001cba0-1001cba6 800->822 823 1001cb60-1001cb66 800->823 824 1001c8e8-1001c8fb mv_ripemd_init 800->824 825 1001cae8-1001cafa 800->825 826 1001c830-1001c835 mv_sha_alloc 800->826 827 1001c8b0-1001c8b6 800->827 828 1001c930-1001c943 mv_sha_init 800->828 829 1001c970-1001c983 mv_sha_init 800->829 830 1001c9b0-1001c9c3 mv_sha512_init 800->830 831 1001c9f0-1001ca03 mv_sha512_init 800->831 832 1001cbb0-1001cc1e mv_sha512_final 800->832 833 1001cb70-1001cb76 800->833 834 1001c837-1001c846 mv_crc_get_table 800->834 835 1001ca38-1001ca55 mv_adler32_update 800->835 801->809 836 1001c897-1001c89a 802->836 803->820 805->814 838 1001c80d-1001c811 806->838 807->838 808->815 809->836 810->836 811->836 812->836 813->836 816->838 817->836 818->838 819->836 820->804 821->803 822->832 823->833 824->836 825->808 826->838 827->801 828->836 829->836 830->836 831->836 844 1001cc70-1001cc76 832->844 845 1001cc20-1001cc24 832->845 833->805 834->799 838->799 840 1001c859-1001c860 call 100265b0 838->840 840->797 848 1001cdb8-1001cdc8 844->848 849 1001cc7c-1001cc82 844->849 846 1001cd30-1001cd3c 845->846 847 1001cc2a-1001cc3d 845->847 852 1001cd70-1001cd76 846->852 853 1001cd3e-1001cd41 846->853 859 1001cdd0-1001cddc 848->859 850 1001cda0-1001cdb0 849->850 851 1001cc88-1001cc8e 849->851 851->845 854 1001cc90-1001cc9e 851->854 857 1001cdf0-1001cdf5 852->857 858 1001cd78-1001cd7e 852->858 855 1001cd43-1001cd49 853->855 856 1001cd4c-1001cd4f 853->856 854->845 855->856 860 1001cd51-1001cd56 856->860 861 1001cd59-1001cd5c 856->861 857->858 862 1001cde0-1001cdeb 858->862 863 1001cd80-1001cd86 858->863 864 1001cd88-1001cd94 859->864 860->861 861->847 865 1001cd62-1001cd65 861->865 862->863 863->859 863->864 864->853 865->847
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_malloczmv_strcasecmp
                                                        • String ID: MD5
                                                        • API String ID: 1451953452-1168476579
                                                        • Opcode ID: fd8ebb722839f17aaf6157ba037008f289ae86b4bf847cb60b004431fafa5101
                                                        • Instruction ID: eb5494de89beb9ab75199d641261a1b3f1512631375a939401cd0d8990c0213e
                                                        • Opcode Fuzzy Hash: fd8ebb722839f17aaf6157ba037008f289ae86b4bf847cb60b004431fafa5101
                                                        • Instruction Fuzzy Hash: BB91F4B4909705DFC710DF68C080A1EBBE0FF89354F55896EE9888B362E735D980EB56
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1009 10011560-100115c5 call 10011040 mv_strdup 1012 10011758 1009->1012 1013 100115cb-100115d7 1009->1013 1014 1001175d-1001175f 1012->1014 1015 100116d0-100116f2 mv_dict_get 1013->1015 1016 100115dd-100115e5 1013->1016 1017 10011765 1014->1017 1018 10011699-100116ac call 100265b0 * 2 1014->1018 1019 10011670-10011680 mv_strdup 1016->1019 1020 100115eb-100115f1 1016->1020 1023 1001168f-10011693 1017->1023 1036 100116b1-100116c6 1018->1036 1021 10011700-1001171a mv_mallocz 1019->1021 1022 10011682-10011684 1019->1022 1020->1021 1025 100115f7-100115f9 1020->1025 1026 10011840-10011845 1021->1026 1027 10011720-10011722 1021->1027 1028 10011728-1001172c 1022->1028 1029 1001168a 1022->1029 1023->1018 1030 10011770-10011787 mv_freep * 2 1023->1030 1025->1029 1032 100115ff-10011601 1025->1032 1026->1014 1027->1026 1027->1028 1029->1023 1030->1018 1034 100117b0-100117cf mv_realloc_array 1032->1034 1035 10011607-1001160f 1032->1035 1034->1029 1037 100117d5-100117da 1034->1037 1038 10011615-10011623 1035->1038 1039 10011738-1001174e call 100265b0 * 2 1035->1039 1041 100117e0-1001180b strlen * 2 mv_realloc 1038->1041 1042 10011629-10011656 call 100265b0 * 2 1038->1042 1039->1036 1041->1029 1043 10011811-1001181d 1041->1043 1057 10011790-10011792 1042->1057 1058 1001165c-1001166d 1042->1058 1046 10011870-10011876 1043->1046 1047 1001181f-1001183b mv_freep 1043->1047 1051 10011898-100118a2 1046->1051 1052 10011878-1001187e 1046->1052 1051->1052 1055 10011880-10011886 1052->1055 1056 100118a4-100118b4 1052->1056 1055->1047 1059 10011888-10011896 1055->1059 1056->1055 1060 10011850-10011867 mv_freep * 2 1057->1060 1061 10011798-100117a6 mv_freep 1057->1061 1058->1036 1059->1047 1060->1061 1061->1036
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strlen$mv_freepmv_strdup$_aligned_reallocmv_dict_getmv_malloczmv_reallocmv_realloc_array
                                                        • String ID: $%lld
                                                        • API String ID: 420417855-3617178099
                                                        • Opcode ID: d510e7aac1835d2d14d11394022ecc06c06f3c51c024d220679ff3e81abd8013
                                                        • Instruction ID: 1aac3acce1ec20135028bdf280dbd7ca7379982b25da7d1f386a19304280214e
                                                        • Opcode Fuzzy Hash: d510e7aac1835d2d14d11394022ecc06c06f3c51c024d220679ff3e81abd8013
                                                        • Instruction Fuzzy Hash: 0C912AB5909751CBC754DF28C58065EBBE0FF88384F56892DED848B345EB74E884DB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mvpriv_open.MAIN ref: 1001933F
                                                          • Part of subcall function 100195E0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10019633
                                                          • Part of subcall function 100195E0: mv_calloc.MAIN ref: 1001964E
                                                          • Part of subcall function 100195E0: MultiByteToWideChar.KERNEL32 ref: 10019685
                                                          • Part of subcall function 100195E0: mv_calloc.MAIN ref: 100196D7
                                                          • Part of subcall function 100195E0: mv_freep.MAIN ref: 10019713
                                                          • Part of subcall function 100195E0: wcslen.MSVCRT ref: 1001971F
                                                          • Part of subcall function 100195E0: _wsopen.MSVCRT ref: 1001974B
                                                        • _fstat64.MSVCRT ref: 10019366
                                                        • _close.MSVCRT ref: 10019394
                                                        • _get_osfhandle.MSVCRT ref: 100193C5
                                                        • CreateFileMappingA.KERNEL32 ref: 100193ED
                                                        • MapViewOfFile.KERNEL32 ref: 10019422
                                                        • CloseHandle.KERNEL32 ref: 10019434
                                                        • mv_log.MAIN ref: 1001945D
                                                        • _close.MSVCRT ref: 10019465
                                                        • _errno.MSVCRT ref: 10019480
                                                        • mv_strerror.MAIN ref: 100194A1
                                                        • mv_log.MAIN ref: 100194C7
                                                        • _errno.MSVCRT ref: 100194D8
                                                        • mv_strerror.MAIN ref: 100194FE
                                                        • mv_log.MAIN ref: 1001951B
                                                        • _close.MSVCRT ref: 10019523
                                                        • mv_log.MAIN ref: 1001954F
                                                        • _close.MSVCRT ref: 10019557
                                                        Strings
                                                        • File size for file '%s' is too big, xrefs: 10019535
                                                        • Error occurred in CreateFileMapping(), xrefs: 10019561
                                                        • Cannot read file '%s': %s, xrefs: 100194A6
                                                        • Error occurred in fstat(): %s, xrefs: 1001950B
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _closemv_log$ByteCharFileMultiWide_errnomv_callocmv_strerror$CloseCreateHandleMappingView_fstat64_get_osfhandle_wsopenmv_freepmvpriv_openwcslen
                                                        • String ID: Cannot read file '%s': %s$Error occurred in CreateFileMapping()$Error occurred in fstat(): %s$File size for file '%s' is too big
                                                        • API String ID: 2213036534-2445208470
                                                        • Opcode ID: 115248d222d0207b4b6978023f43e634846f62dc27148f7a7cd2e032391e2a57
                                                        • Instruction ID: 617e9db2a449c1ebb97318d6d46501e643e1f1538bb2456b081f200f3c68d203
                                                        • Opcode Fuzzy Hash: 115248d222d0207b4b6978023f43e634846f62dc27148f7a7cd2e032391e2a57
                                                        • Instruction Fuzzy Hash: 6861C0B59097459FC310EF29C48529EFBE4FF88700F41892EE9D98B351E774E9809B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: de691f1ba13835e21657e86075408ec6b0dc09785dc25b7b1d0ef4953b892b6e
                                                        • Instruction ID: 2f248bfe3db45479d33083a71d7c86b86264631c37f86e05a0edac7835ee7c2e
                                                        • Opcode Fuzzy Hash: de691f1ba13835e21657e86075408ec6b0dc09785dc25b7b1d0ef4953b892b6e
                                                        • Instruction Fuzzy Hash: 2A6192B8A04B558FC704EF69D4C191AB7E0FF48254F51891CE9948B31AEB30F896CBD2
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf
                                                        • String ID: %sasm_call$%sfwd_only$%simdct_full$%sinplace$%sinv_only$%sout_of_place$%spreshuf$%sunaligned$aligned$flags: [
                                                        • API String ID: 3083893021-1441846183
                                                        • Opcode ID: 16923d63af30e83d2c7efbf8c1da79df8fe88a9a1f2f24f8342d05ec943732c7
                                                        • Instruction ID: 1dc6e91ea481e811bfe5c5906a416067f5532a53e96b106321926297a6af6804
                                                        • Opcode Fuzzy Hash: 16923d63af30e83d2c7efbf8c1da79df8fe88a9a1f2f24f8342d05ec943732c7
                                                        • Instruction Fuzzy Hash: DD6110B5A186858BE300EF19C492B1FBAD1EB84794F66883EF0C8C7240D778DD41D78A
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$mv_log
                                                        • String ID: %-15s $ (default $"%s"$%d/%d$%lld
                                                        • API String ID: 2749705325-3616743394
                                                        • Opcode ID: 54d7423ecd114c77d54f3555a7fa34dbefed27d13947955652e8fafffa582ee6
                                                        • Instruction ID: a78736eaf865b939ee6902c1b70fed4f9ad85332988bb7fcaf3499c0514d5393
                                                        • Opcode Fuzzy Hash: 54d7423ecd114c77d54f3555a7fa34dbefed27d13947955652e8fafffa582ee6
                                                        • Instruction Fuzzy Hash: D191AF78A087459FC750DF28E48065EFBE1FF89780F91892EF8998B351E774E9418B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Invalid 0xRRGGBB[AA] color string: '%s', xrefs: 1002EBF7
                                                        • bikeshed, xrefs: 1002E9BB
                                                        • 0123456789ABCDEFabcdef, xrefs: 1002EACB
                                                        • random, xrefs: 1002E9A6
                                                        • Invalid alpha value specifier '%s' in '%s', xrefs: 1002EBC4
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_strcasecmpstrlen$mv_get_random_seedmv_strlcpystrchrstrtoul
                                                        • String ID: 0123456789ABCDEFabcdef$Invalid 0xRRGGBB[AA] color string: '%s'$Invalid alpha value specifier '%s' in '%s'$bikeshed$random
                                                        • API String ID: 887406882-1143575717
                                                        • Opcode ID: 36b8675d15f54015864d4cad0e834c3d0155204aa8deb69ae3f5c7034227c4af
                                                        • Instruction ID: 5528a354f5a3b115f7f47ff1570fdc362057e49d17d9d5bd6ab876f37a57e2b2
                                                        • Opcode Fuzzy Hash: 36b8675d15f54015864d4cad0e834c3d0155204aa8deb69ae3f5c7034227c4af
                                                        • Instruction Fuzzy Hash: 5F819A749487819ED342DF38D49064EBBE0EF85380F95CE6EE8C99B241E778D980DB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_strdup$mv_dict_getmv_mallocz
                                                        • String ID:
                                                        • API String ID: 3834523185-0
                                                        • Opcode ID: 34b8535691b7a7fadd794d32cbd0790fd03931f9f00ffb340a5a63087569dce7
                                                        • Instruction ID: 095bdf82c674aaefaf2cda3429f550f943fa4cc151a1ce18d08b383c11ff4614
                                                        • Opcode Fuzzy Hash: 34b8535691b7a7fadd794d32cbd0790fd03931f9f00ffb340a5a63087569dce7
                                                        • Instruction Fuzzy Hash: F39127B5A087518FC754DF68C48065EBBE1FF88794F12892DED989B344E770E981CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_dict_copy.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A89A
                                                        • mv_dict_copy.MAIN ref: 1001A996
                                                        • mv_buffer_ref.MAIN ref: 1001A9EC
                                                        • mv_realloc.MAIN ref: 1001AA26
                                                        • mv_mallocz.MAIN ref: 1001AA40
                                                        • mv_buffer_replace.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AB9F
                                                        • mv_buffer_replace.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001ABBD
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_buffer_replacemv_dict_copy$mv_buffer_refmv_malloczmv_realloc
                                                        • String ID:
                                                        • API String ID: 1780483662-0
                                                        • Opcode ID: 07b599f6d8ee219048b6128147e910c9945fa735575f1c6576c8cbb7c6ffcc6f
                                                        • Instruction ID: 1c222d73e1748437048cd959b4fb099db9e50fe00274f25359b61923485b158e
                                                        • Opcode Fuzzy Hash: 07b599f6d8ee219048b6128147e910c9945fa735575f1c6576c8cbb7c6ffcc6f
                                                        • Instruction Fuzzy Hash: 71F1B5B49043468FC764CF29C580799BBE1FF49350F058A6EE9899B712E730E985CF91
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_init$mv_bprintf$mv_bprint_finalizemv_vbprintf
                                                        • String ID: %s%s%s%s$[%s @ %p] $[%s]
                                                        • API String ID: 2514531573-1798253436
                                                        • Opcode ID: 73ec329c920999803a4babe89b4941ef9f254048450b1a5a3304028e830a3db2
                                                        • Instruction ID: 6f949b97a94191d98c9e239c908f2f64f0d76179adbd4d945766b856959e5812
                                                        • Opcode Fuzzy Hash: 73ec329c920999803a4babe89b4941ef9f254048450b1a5a3304028e830a3db2
                                                        • Instruction Fuzzy Hash: 5F8106B49097809FD354DF28D08069BBBE5FF89380F95C92EF8C88B315DA749984CB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Key '%s' not found., xrefs: 1002D364
                                                        • Missing key or no key/value separator found after key '%s', xrefs: 1002D3B4
                                                        • Setting entry with key '%s' to value '%s', xrefs: 1002D2CC
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_logstrspn$mv_get_token$mv_freepmv_mallocmv_opt_setstrlen
                                                        • String ID: Key '%s' not found.$Missing key or no key/value separator found after key '%s'$Setting entry with key '%s' to value '%s'
                                                        • API String ID: 3679258194-2858522012
                                                        • Opcode ID: 595c6547f65cc4bb8e71bd801e19b34be3a319f29eb8b0681d307362fd9c2fa6
                                                        • Instruction ID: 7fb14f7b88a9286a04fbc63168e79df0a13211f554c8c21c667f0136fc5f52d7
                                                        • Opcode Fuzzy Hash: 595c6547f65cc4bb8e71bd801e19b34be3a319f29eb8b0681d307362fd9c2fa6
                                                        • Instruction Fuzzy Hash: 5B41D2B4A097409FC340EF29E48061EBBE4FF88394F91892EF5C887351EA75D940CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_log.MAIN ref: 1002D46B
                                                        • mv_opt_set.MAIN ref: 1002D488
                                                        • mv_opt_get_key_value.MAIN ref: 1002D4F6
                                                          • Part of subcall function 1002BF30: strspn.MSVCRT ref: 1002BF4D
                                                          • Part of subcall function 1002BF30: strspn.MSVCRT ref: 1002BF97
                                                          • Part of subcall function 1002BF30: strchr.MSVCRT ref: 1002BFB5
                                                          • Part of subcall function 1002BF30: mv_malloc.MAIN(?,?,?,?,?,?,?,?,?,?,100AEACF,100AEB86,00000000,?,1000DF13), ref: 1002BFCD
                                                          • Part of subcall function 1002BF30: mv_get_token.MAIN ref: 1002BFFF
                                                        • mv_strerror.MAIN ref: 1002D5A9
                                                        • mv_log.MAIN ref: 1002D5D2
                                                        • mv_log.MAIN ref: 1002D615
                                                        • mv_log.MAIN ref: 1002D653
                                                        Strings
                                                        • No option name near '%s', xrefs: 1002D600
                                                        • Setting '%s' to value '%s', xrefs: 1002D44C
                                                        • Unable to parse '%s': %s, xrefs: 1002D5AE
                                                        • Option '%s' not found, xrefs: 1002D637
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log$strspn$mv_get_tokenmv_mallocmv_opt_get_key_valuemv_opt_setmv_strerrorstrchr
                                                        • String ID: No option name near '%s'$Option '%s' not found$Setting '%s' to value '%s'$Unable to parse '%s': %s
                                                        • API String ID: 669169455-2003673103
                                                        • Opcode ID: 42f4af90029895782656a055397532cb0e26e144a9066ca91bb51c1471e1f9dd
                                                        • Instruction ID: 701acf41a1ead03db3666d664b3341f8442fad518a1ed00e3a98405c4d1a9712
                                                        • Opcode Fuzzy Hash: 42f4af90029895782656a055397532cb0e26e144a9066ca91bb51c1471e1f9dd
                                                        • Instruction Fuzzy Hash: 5C51F575A087509FD760EF29E48075EBBE4EFC4654F91882EE9C9C7341E774E8408B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_tree_find
                                                        • String ID:
                                                        • API String ID: 59044961-0
                                                        • Opcode ID: a2a5cd09734139798f1fd845032fbc4d271d5e899faa0ed1a3b262cc80cb7db8
                                                        • Instruction ID: cce57886af535d8735bdf396c26f78100a8d8e3b141664cbd45599b0a5c3ab2e
                                                        • Opcode Fuzzy Hash: a2a5cd09734139798f1fd845032fbc4d271d5e899faa0ed1a3b262cc80cb7db8
                                                        • Instruction Fuzzy Hash: 4FF1AFB490974A9FC344DF2AC18091AFBE5FFC8654F61892EE888D7311E774E9418F86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_tree_find
                                                        • String ID:
                                                        • API String ID: 59044961-0
                                                        • Opcode ID: 2e39002f0947aa2d0dcfdfe7d57795e1a31c696425fd7e0b4506f071d05121fc
                                                        • Instruction ID: 7ec3c2c7dacb140ed4bfedfc7a75d038d4e13e51791f240047a25a975b8cf788
                                                        • Opcode Fuzzy Hash: 2e39002f0947aa2d0dcfdfe7d57795e1a31c696425fd7e0b4506f071d05121fc
                                                        • Instruction Fuzzy Hash: 73F1A0B490974A9FC344DF2AC18081AFBE5FFC8654F61892EE898D7311E774E9418F86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Failed to map frame into derived frame context: %d., xrefs: 1001E37D
                                                        • Invalid mapping found when attempting unmap., xrefs: 1001E295
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_frame_unref
                                                        • String ID: Failed to map frame into derived frame context: %d.$Invalid mapping found when attempting unmap.
                                                        • API String ID: 3522828444-968520014
                                                        • Opcode ID: c51a9e1b472074b834904429bd500262b32e19eb408ec7d04c88999b5f63e95e
                                                        • Instruction ID: a9b2bb0cb6fdc28be8a2433754fc5c1c364900424f67e1161cdcac98c29180a2
                                                        • Opcode Fuzzy Hash: c51a9e1b472074b834904429bd500262b32e19eb408ec7d04c88999b5f63e95e
                                                        • Instruction Fuzzy Hash: 9A91BEB8A097419FC744CF29C58090EBBE0FF88754F16896EE9998B351D730ED81CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ExclusiveLock$Releasemv_mallocz$Acquire_beginthreadexabortmv_callocmv_cpu_countmv_freepmv_logmvpriv_slicethread_free
                                                        • String ID: j
                                                        • API String ID: 2987404029-2137352139
                                                        • Opcode ID: 99bc2fdff7da96867b2e9425b216463629f581a320c99328d2d44c55e57351e6
                                                        • Instruction ID: aa8bda996068d509f672b83f007ff4c046d751420288b4ab536222a33dc34af4
                                                        • Opcode Fuzzy Hash: 99bc2fdff7da96867b2e9425b216463629f581a320c99328d2d44c55e57351e6
                                                        • Instruction Fuzzy Hash: 0481E2B5A087409FD740EF29D48061ABBE0FF89344F118A2EF8998B341E775E945CF82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: CurrentDebugOutputStringThread_ultoaabort
                                                        • String ID: Erro$ad $eani$eys $for $in_k$ng u$p sp$r cl$thre
                                                        • API String ID: 4191895893-3726152543
                                                        • Opcode ID: 32d6918716459faddcb7dc1042b6d8857ba7126cf37684ded785e2cb3a3e0069
                                                        • Instruction ID: 088c25127c847526b46776e24d12a3bdf4591a2816cfb9b61a0b1617db757378
                                                        • Opcode Fuzzy Hash: 32d6918716459faddcb7dc1042b6d8857ba7126cf37684ded785e2cb3a3e0069
                                                        • Instruction Fuzzy Hash: 942117B050C3819FE354EF64C19931FBBE2EB81304F909D2DE4894A3A5CBB9C9498B47
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_sub_q$mv_add_q$mv_reduce
                                                        • String ID:
                                                        • API String ID: 416313997-0
                                                        • Opcode ID: 16bc828a6e54490581e3bca817dbe7aaeb3a5d58f0d8fddf083b3c311aad9c19
                                                        • Instruction ID: 137885487f331a62fd44dc5ad255b81a0a07b8edcdf78e8c3b60c95945d2ee5e
                                                        • Opcode Fuzzy Hash: 16bc828a6e54490581e3bca817dbe7aaeb3a5d58f0d8fddf083b3c311aad9c19
                                                        • Instruction Fuzzy Hash: 9881B2B4A08B06AFC744DF6AC18151AFBE1FF88251F10C92EE98DC7711E670E8519F82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_pix_fmt_desc_get.MAIN ref: 1001F220
                                                        • mv_image_get_linesize.MAIN ref: 1001F259
                                                          • Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976
                                                        • mv_image_fill_linesizes.MAIN(?), ref: 1001F2F7
                                                        • mv_image_fill_plane_sizes.MAIN(?), ref: 1001F366
                                                        • mv_malloc.MAIN(?), ref: 1001F39E
                                                        • mv_image_fill_pointers.MAIN(?), ref: 1001F3CF
                                                          • Part of subcall function 1001EFD0: mv_image_fill_plane_sizes.MAIN ref: 1001F040
                                                        • mvpriv_set_systematic_pal2.MAIN(?), ref: 1001F419
                                                        Strings
                                                        • Picture size %ux%u is invalid, xrefs: 1001F48C
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_image_fill_plane_sizesmv_pix_fmt_desc_get$mv_image_fill_linesizesmv_image_fill_pointersmv_image_get_linesizemv_mallocmvpriv_set_systematic_pal2
                                                        • String ID: Picture size %ux%u is invalid
                                                        • API String ID: 3240037220-1963597007
                                                        • Opcode ID: 677e3105d86441c919a6bb07a2d9eb729f5658238c16f65244001bb42f50e7cb
                                                        • Instruction ID: 41a0369190cf79952ebc4083191ebf048a4207412b4fff0bffc105f261d70811
                                                        • Opcode Fuzzy Hash: 677e3105d86441c919a6bb07a2d9eb729f5658238c16f65244001bb42f50e7cb
                                                        • Instruction Fuzzy Hash: 39911576A087418FC350DF28C48572BBBE2FF98354F15892DE9A8CB355EB35D9808B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: free$isspace
                                                        • String ID:
                                                        • API String ID: 976929720-0
                                                        • Opcode ID: b163d4d369103ade2559268b18c1e9f57b898a83c08365d6067c7703f8cff183
                                                        • Instruction ID: ca441e24884805ae0a01a9b3e4b79260671fbd71cce081429fa1365773641494
                                                        • Opcode Fuzzy Hash: b163d4d369103ade2559268b18c1e9f57b898a83c08365d6067c7703f8cff183
                                                        • Instruction Fuzzy Hash: 8A8145746087428FD710DF25C08075ABBE4FF88748F12492DFAA89B261D770E949AB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Invalid separator(s) found., xrefs: 1002E560
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_escape$mv_bprint_append_datamv_bprint_finalizemv_bprint_initmv_freepmv_logmv_opt_getmv_opt_is_set_to_default
                                                        • String ID: Invalid separator(s) found.
                                                        • API String ID: 350117393-2087347751
                                                        • Opcode ID: 69ccca22108feb783cd74857b2cac3c0314cb1417c4cb460f6239eef7be459b8
                                                        • Instruction ID: 035096c34b81a8408bd776f44eb798195d6d7415f3781d3bc3fbbb06a5d0ee26
                                                        • Opcode Fuzzy Hash: 69ccca22108feb783cd74857b2cac3c0314cb1417c4cb460f6239eef7be459b8
                                                        • Instruction Fuzzy Hash: 437133B56497818FD750DF29D48069BBBE5FF89384F85892EE998C3301E735ED048B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_small_strptime$_mktime64mv_gettimemv_strcasecmp
                                                        • String ID: %H%M%S$%H:%M:%S$%Y - %m - %d$%Y%m%d$now
                                                        • API String ID: 3102546153-2275413634
                                                        • Opcode ID: 714232e79b76d34a95a4b2be10d242d26dbfea1d23b5746406886e60186c9d60
                                                        • Instruction ID: 7f3ee14ce240381be5dd98d6c3d180aec0b6e0ebcf4911cbbe250e8a450d1d0f
                                                        • Opcode Fuzzy Hash: 714232e79b76d34a95a4b2be10d242d26dbfea1d23b5746406886e60186c9d60
                                                        • Instruction Fuzzy Hash: F1518F75A083564FC344DF29948032AFBE1EFC8794F92893EE5D8C7391EA34D9458B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmp
                                                        • String ID: %s%s$bgr32$bgra$rgb32$rgba$yuv420p
                                                        • API String ID: 1004003707-3566121812
                                                        • Opcode ID: d32a04ad6243debcaeacd2200b49bc79f4e9a670f515df0e03357758963548ad
                                                        • Instruction ID: f43fe70899dd8ef4f4baf1748d2a43fec607c47801efeecbfc865d4fb8ae2220
                                                        • Opcode Fuzzy Hash: d32a04ad6243debcaeacd2200b49bc79f4e9a670f515df0e03357758963548ad
                                                        • Instruction Fuzzy Hash: EA216179A083559BD701DF69899175EB6F4EF88682F41492FE8C8DB301E778C800D742
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_tree_find
                                                        • String ID:
                                                        • API String ID: 59044961-0
                                                        • Opcode ID: 95cf165c7df1e3b14e8353417eaf65eff3f766b1f1fabdb0d3657f97e4e1532e
                                                        • Instruction ID: 92974a57f51364e3157bc9e69e38102b8c966e1fd57831e9c9b5ac2784e8d0df
                                                        • Opcode Fuzzy Hash: 95cf165c7df1e3b14e8353417eaf65eff3f766b1f1fabdb0d3657f97e4e1532e
                                                        • Instruction Fuzzy Hash: 1FC1C2B490974A9FC340DF6AC18081AFBE5FFC8654F61892EE898D7311E774E9418F86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_tree_find
                                                        • String ID:
                                                        • API String ID: 59044961-0
                                                        • Opcode ID: 5ba1de0a2128bb80714fc7f87f514a6120d16dbb4c6ec235376ab0e5548afddf
                                                        • Instruction ID: 55863b4f0a31e834c219965d94d4823f7879c6ff1bed93916ad31882f3d71024
                                                        • Opcode Fuzzy Hash: 5ba1de0a2128bb80714fc7f87f514a6120d16dbb4c6ec235376ab0e5548afddf
                                                        • Instruction Fuzzy Hash: 8AC1D2B4909749AFC340DF6AC18091AFBE5FF88654F61892EE8D8D7311E734E9418F86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_ripemd_initmv_sha512_init$mv_sha_init$mv_adler32_updatemv_crc
                                                        • String ID:
                                                        • API String ID: 2533704273-0
                                                        • Opcode ID: a5574497256713bb20ba09e0eacec7ebb4491d86d0e4b8baf7000fed20719829
                                                        • Instruction ID: b4fd7817c68cc5ebcb381f62e52a11943eedc005ab1a14790db74db78419b9e7
                                                        • Opcode Fuzzy Hash: a5574497256713bb20ba09e0eacec7ebb4491d86d0e4b8baf7000fed20719829
                                                        • Instruction Fuzzy Hash: 8871AFB4909701DFC754DF68C08091ABBE0FF8D354F5489AEE9898B322E735D980EB56
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_dict_free.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A49E
                                                        • mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A4A6
                                                        • mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A496
                                                          • Part of subcall function 1000A000: mv_freep.MAIN ref: 1000A01E
                                                        • mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A4D0
                                                        • mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A4E6
                                                        • mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A50D
                                                        • mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A51D
                                                        • mv_dict_free.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A52B
                                                        • mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A539
                                                        • mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A547
                                                        • mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A555
                                                        • mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A565
                                                        • mv_channel_layout_uninit.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A578
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_buffer_unref$mv_freep$mv_dict_free$mv_channel_layout_uninit
                                                        • String ID:
                                                        • API String ID: 1735483532-0
                                                        • Opcode ID: 945f5bc7cbde55a6aa345190f856de26ec9369814dab5ad9417d2f0141cb4add
                                                        • Instruction ID: 3743f490041121a309f73bd17641a77e7b536aba58928b40e76834ce72ff9424
                                                        • Opcode Fuzzy Hash: 945f5bc7cbde55a6aa345190f856de26ec9369814dab5ad9417d2f0141cb4add
                                                        • Instruction Fuzzy Hash: 3A516CB19047028BDB10DF24C88178A77E5FF45364F0A45BADC989F38AE775E8C58BA1
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: memcmpstrlen
                                                        • String ID: mono
                                                        • API String ID: 3108337309-2381334079
                                                        • Opcode ID: 05a9566f9cebdc7444aeb341508e8bd87ecfd7e1d953646c9f26566dae47a867
                                                        • Instruction ID: b6009183c03875402946771f74e016b0be1646e1b5b10329ba9fdfd6138aa893
                                                        • Opcode Fuzzy Hash: 05a9566f9cebdc7444aeb341508e8bd87ecfd7e1d953646c9f26566dae47a867
                                                        • Instruction Fuzzy Hash: 4D712874A083598FE314DF25C484A1ABBE2FFC8384F15892EE88997315DB70E8459B86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • The hardware pixel format '%s' is not supported by the device type '%s', xrefs: 1001E663
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_get_pix_fmt_namemv_log
                                                        • String ID: The hardware pixel format '%s' is not supported by the device type '%s'
                                                        • API String ID: 3418758923-379977042
                                                        • Opcode ID: 5dfad572c67db8fa61b7bb2c6cdad9a604c24d0b64868fd794a6f7046a9e5d28
                                                        • Instruction ID: 93c42ac0cc7c39aee4c6308fb1e9594b2517373d7f7eca67d321c97bd06f55ee
                                                        • Opcode Fuzzy Hash: 5dfad572c67db8fa61b7bb2c6cdad9a604c24d0b64868fd794a6f7046a9e5d28
                                                        • Instruction Fuzzy Hash: 4861C274608B818FC750DF29C480A0EB7E5FF88754F568A6DE998DB351E770EC818B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mallocz$mv_realloc$mv_freep
                                                        • String ID:
                                                        • API String ID: 3944475926-0
                                                        • Opcode ID: 21c0e84fb2d2b07cdbd2145871ab2905cba1277f35f8114cc737119d02b58269
                                                        • Instruction ID: 4ee62d273146a1fe968e339e986c88b207b98d61c88eaf1789f61ff4cee38887
                                                        • Opcode Fuzzy Hash: 21c0e84fb2d2b07cdbd2145871ab2905cba1277f35f8114cc737119d02b58269
                                                        • Instruction Fuzzy Hash: BF7115B48087508FD710DF24C48471ABBE0FF8A384F568A6DE9898B369D775E980CB91
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • %d:%d:%d%c%d, xrefs: 1004C19B
                                                        • Using non-standard frame rate %d/%d, xrefs: 1004C287
                                                        • Valid timecode frame rate must be specified. Minimum value is 1, xrefs: 1004C3FE
                                                        • Drop frame is only allowed with multiples of 30000/1001 FPS, xrefs: 1004C30B
                                                        • Unable to parse timecode, syntax: hh:mm:ss[:;.]ff, xrefs: 1004C3CA
                                                        • gfff, xrefs: 1004C342
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log
                                                        • String ID: %d:%d:%d%c%d$Drop frame is only allowed with multiples of 30000/1001 FPS$Unable to parse timecode, syntax: hh:mm:ss[:;.]ff$Using non-standard frame rate %d/%d$Valid timecode frame rate must be specified. Minimum value is 1$gfff
                                                        • API String ID: 2418673259-2042051344
                                                        • Opcode ID: 176bcdf597b490fee4af283c04cbe13f8de8e079172abadff0e8b3cae13c4abb
                                                        • Instruction ID: 51795c79a45c6e8ce531692f10421d4895f82dc3b0050cc4962ed38357205801
                                                        • Opcode Fuzzy Hash: 176bcdf597b490fee4af283c04cbe13f8de8e079172abadff0e8b3cae13c4abb
                                                        • Instruction Fuzzy Hash: 4561A4719087498BC760CF68C580A4EBBE1FB84350F25893FE999DB351D674ED409B86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_frame_alloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E32A
                                                          • Part of subcall function 1001AC40: mv_malloc.MAIN ref: 1001AC56
                                                        • mv_hwframe_get_buffer.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E34A
                                                          • Part of subcall function 1001E2F0: mv_hwframe_map.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E36C
                                                          • Part of subcall function 1001E2F0: mv_log.MAIN ref: 1001E396
                                                          • Part of subcall function 1001E2F0: mv_frame_free.MAIN ref: 1001E3A2
                                                        • mv_buffer_ref.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E317
                                                          • Part of subcall function 10009FC0: mv_mallocz.MAIN ref: 10009FD2
                                                        • mv_buffer_ref.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E3D3
                                                        Strings
                                                        • Failed to map frame into derived frame context: %d., xrefs: 1001E37D
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_buffer_ref$mv_frame_allocmv_frame_freemv_hwframe_get_buffermv_hwframe_mapmv_logmv_mallocmv_mallocz
                                                        • String ID: Failed to map frame into derived frame context: %d.
                                                        • API String ID: 2770197599-2491951210
                                                        • Opcode ID: b982bc6816b3afb20851306c66ddb92193a8adb26d1f7859c5dff6e59dc61fb9
                                                        • Instruction ID: 9b451d42297ff9da348d1ac60a3a70938ed94ec3f991f54ec8aa55de9da18352
                                                        • Opcode Fuzzy Hash: b982bc6816b3afb20851306c66ddb92193a8adb26d1f7859c5dff6e59dc61fb9
                                                        • Instruction Fuzzy Hash: 0041F5B46087418FD740DF29D48055FBBE0FF88350F05892DE9A98B345EB34E9818F82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmp$mv_parse_ratio
                                                        • String ID: ntsc
                                                        • API String ID: 1661692936-2045543799
                                                        • Opcode ID: fc802bc66f50ca201fdf2d927c743c47fe42e6573d439dee567ffb06767441b6
                                                        • Instruction ID: dadf62e05f87e60a70cc0e9807c988b55b66a7878f9bc8684de5bb80b8492f26
                                                        • Opcode Fuzzy Hash: fc802bc66f50ca201fdf2d927c743c47fe42e6573d439dee567ffb06767441b6
                                                        • Instruction Fuzzy Hash: 2731E8B89893819AD750EF29A54161EB6E0FF44381F868C2EA9CCC7340DF74DD40AB57
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009A7B
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009AB9
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009AD5
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009AF1
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009B0D
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009B2C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf
                                                        • String ID: &amp;$&apos;$&gt;$&lt;$&quot;
                                                        • API String ID: 3083893021-87953025
                                                        • Opcode ID: a8492cc7d52c020423f32362092ccefd240c7d2216d999baf81aeaf4ef70062f
                                                        • Instruction ID: 14f95469a8fd426adbc8d3b99f13887d58f0213caa7dd6ac72794508adc3bfbb
                                                        • Opcode Fuzzy Hash: a8492cc7d52c020423f32362092ccefd240c7d2216d999baf81aeaf4ef70062f
                                                        • Instruction Fuzzy Hash: BF110D70A08B55DEE710EF69808065EBBD1FB81680F56C81EF5D9CB245E639E9809783
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_tree_find
                                                        • String ID:
                                                        • API String ID: 59044961-0
                                                        • Opcode ID: a695cc76ce69234c581bf4b4b735b6e1a38d1706809023f07848c68a58c7e2d7
                                                        • Instruction ID: d5bf940e379ca4a6bd7046eb797087e303209b84da27322be6da1c3234df6ef9
                                                        • Opcode Fuzzy Hash: a695cc76ce69234c581bf4b4b735b6e1a38d1706809023f07848c68a58c7e2d7
                                                        • Instruction Fuzzy Hash: D3A1C3B490974A9FC340DF6AC18081AFBE5FFC8654F61892EE898D7311E774E9418F86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ExclusiveLock$Releasemv_mallocz$Acquire
                                                        • String ID:
                                                        • API String ID: 2881747546-0
                                                        • Opcode ID: 0d1f996a099190dbcac24ef498fb0996fadf9c399d392a80c4173242cb49765f
                                                        • Instruction ID: e8e0c9d1389fe9fc4d2fa8f13575414dd6078b243068f84da3cacd96059e79d8
                                                        • Opcode Fuzzy Hash: 0d1f996a099190dbcac24ef498fb0996fadf9c399d392a80c4173242cb49765f
                                                        • Instruction Fuzzy Hash: B36138B49087018FE714DF25C48170BBBE1EF85380F12866DE8998B35ADB74E981CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mallocz$mv_freep$mv_buffer_createmv_buffer_refmv_buffer_unref
                                                        • String ID:
                                                        • API String ID: 2772056172-0
                                                        • Opcode ID: f78fb1774a9b6c4d14d1ed364c0b54d703b3fc5897b42f1e152435b2e8f7f7ef
                                                        • Instruction ID: 961086c667dc9f8e49421d039f7100c0425955bc0778363e0507aedae6c66dfa
                                                        • Opcode Fuzzy Hash: f78fb1774a9b6c4d14d1ed364c0b54d703b3fc5897b42f1e152435b2e8f7f7ef
                                                        • Instruction Fuzzy Hash: 1741E9B46087419FD740EF29D48061AFBE4FF88294F85896EF8998B355E735E881CB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: isupper$_errnoislowerisspace
                                                        • String ID: $
                                                        • API String ID: 4095548146-3993045852
                                                        • Opcode ID: 026cf13eb89308e961753ce655e2892c44d5266a6a8bc87b24ee3076e9ab9950
                                                        • Instruction ID: 66d36e278e9387c17c28d7139ad898e7a92bf48a2b7880ad50bacd675aa30ae7
                                                        • Opcode Fuzzy Hash: 026cf13eb89308e961753ce655e2892c44d5266a6a8bc87b24ee3076e9ab9950
                                                        • Instruction Fuzzy Hash: C3718D70A083468BC704DF68C48062FBBE2FF893A4F25892FE9D997391D774D8458B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ExclusiveLockReleasemv_bprint_finalizemv_bprintfmv_vbprintfstrcmpstrcpy
                                                        • String ID: Last message repeated %d times$%s%s%s%s$[%s]
                                                        • API String ID: 4275616186-1378087399
                                                        • Opcode ID: d0df824065387cbc24c48f67f203688572bdbcaedd198ee8c4ff34e36a2db307
                                                        • Instruction ID: 3a5394bdbcfdd3d39a4a44ba34fc3df736875c3267acf4b9896f0e29f48a5ef2
                                                        • Opcode Fuzzy Hash: d0df824065387cbc24c48f67f203688572bdbcaedd198ee8c4ff34e36a2db307
                                                        • Instruction Fuzzy Hash: B161BE749087959FD720DF24D4803AABBE2FF85384F95884EE8C957342C736E985CB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _errnomv_logstrlen$mv_freepmv_malloc
                                                        • String ID: ./%sXXXXXX$/tmp/%sXXXXXX$ff_tempfile: Cannot open temporary file %s
                                                        • API String ID: 3823847272-2791948529
                                                        • Opcode ID: 9fcd766a609fa42d1e131dfce7f93293598c381c48a3ec19530fb229cde90f30
                                                        • Instruction ID: ca396602fb1ee98faa866fa63a7723223a79ba1d365e5aad02c347e39299c69d
                                                        • Opcode Fuzzy Hash: 9fcd766a609fa42d1e131dfce7f93293598c381c48a3ec19530fb229cde90f30
                                                        • Instruction Fuzzy Hash: B73179B89087419FC340EF29C18151AFBE0FF88650F91892EF9C99B311E775E9859F82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_reallocstrftimestrlen
                                                        • String ID: !!!!$[truncated strftime output]
                                                        • API String ID: 709960874-1743851734
                                                        • Opcode ID: f29f42bb8ffea11f48ea5e99c1610936806f5c95083409d1b8b746ef61fd5416
                                                        • Instruction ID: 5e96dacd8902ef441cde7e6f7e331d45904ef3b1d824b749351cd4a48aad1636
                                                        • Opcode Fuzzy Hash: f29f42bb8ffea11f48ea5e99c1610936806f5c95083409d1b8b746ef61fd5416
                                                        • Instruction Fuzzy Hash: FFA1BFB1A042429FE710CF28C98579E77E2EF843D0F268529ED898B399E735DD45CB41
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: malloc$isspace
                                                        • String ID: d
                                                        • API String ID: 177827414-2564639436
                                                        • Opcode ID: 7a5a73d22a611f51a86e873d8a3b0d49793b2c600cde0416c3143a58db11ab05
                                                        • Instruction ID: 149852ab0a24966de1e470053d148fe3943fffd9ea7aad0997647bcbaf56fcf5
                                                        • Opcode Fuzzy Hash: 7a5a73d22a611f51a86e873d8a3b0d49793b2c600cde0416c3143a58db11ab05
                                                        • Instruction Fuzzy Hash: B55121756087018FD320EF29C18065AB7E4EFC9754F118A2EF99897361EB70ED05AB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_init_for_buffermv_bprintf
                                                        • String ID: AMBI%d$NONE$USR%d
                                                        • API String ID: 2490314137-3656852315
                                                        • Opcode ID: 18c3f00c932525b9a03c6c26bd996f108cdefc78bc7c7bb15c7cae72aa0d9e7e
                                                        • Instruction ID: 1ef98ca077266c32d1aee9727dfec110bedddac347624ae906d8e5fb6b24c5a3
                                                        • Opcode Fuzzy Hash: 18c3f00c932525b9a03c6c26bd996f108cdefc78bc7c7bb15c7cae72aa0d9e7e
                                                        • Instruction Fuzzy Hash: 20114FB4918B55CBE714EF28C480A5EB7E0FF88780F51C92EF68897254D334AE419B97
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_init_for_buffermv_bprintf
                                                        • String ID: ambisonic ACN %d$none$user %d
                                                        • API String ID: 2490314137-4180635230
                                                        • Opcode ID: 6d247fa50da3d5541497e9d82b9e4f8f3eef7e7a432eeee65763f77ec15faa69
                                                        • Instruction ID: c94b059796d13185444bee4ca381abcd6d61be9244a4282c7920a982e5d4d1e4
                                                        • Opcode Fuzzy Hash: 6d247fa50da3d5541497e9d82b9e4f8f3eef7e7a432eeee65763f77ec15faa69
                                                        • Instruction Fuzzy Hash: 51112EB4908B55CBE320DF24D480A6EB7E0FF847C4F51882EF59887289D734A941DB97
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_channel_layout_check.MAIN ref: 1001B920
                                                        • mv_sample_fmt_is_planar.MAIN ref: 1001B942
                                                        • mv_channel_layout_check.MAIN ref: 1001B9B7
                                                        • mv_hwframe_transfer_data.MAIN ref: 1001BAE3
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_channel_layout_check$mv_hwframe_transfer_datamv_sample_fmt_is_planar
                                                        • String ID:
                                                        • API String ID: 1553998843-0
                                                        • Opcode ID: 6cac879977a8b13244bde48582e16f82ac97cff3938bce88e986ecd715483f6d
                                                        • Instruction ID: 72df875d59b9fd1ba8d0ac85d53e609cc354b7ecb43e3e539226396dea563104
                                                        • Opcode Fuzzy Hash: 6cac879977a8b13244bde48582e16f82ac97cff3938bce88e986ecd715483f6d
                                                        • Instruction Fuzzy Hash: 72A11E74604B458BD758DF26C0C162BBBE2FFC4694F158A2DD9998F719E730E882CB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_tree_find
                                                        • String ID:
                                                        • API String ID: 59044961-0
                                                        • Opcode ID: c36327b2d25d5fe4884ec1989afda76d5058c06c978ad9fa8712f8f68075efe0
                                                        • Instruction ID: 53801cd7259bdacf3f476d6e8c3942157b86ee63cd70a90bc861ee9562dfc515
                                                        • Opcode Fuzzy Hash: c36327b2d25d5fe4884ec1989afda76d5058c06c978ad9fa8712f8f68075efe0
                                                        • Instruction Fuzzy Hash: EB81DFB490974A9FC340DF6AC18091AFBE5FF88654F61892EE898D7311E734E941CF86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ExclusiveLockReleasemv_bprint_finalizemv_bprintfmv_vbprintfstrcmpstrcpy
                                                        • String ID: Last message repeated %d times$%s%s%s%s
                                                        • API String ID: 4275616186-2673086376
                                                        • Opcode ID: 42d1c28a59b315c23aa48637e9ae167f894d38651270de1a8a98ee9fcc4ad737
                                                        • Instruction ID: b81f238ef4300ec1d8f16b3a8da4b914aea516d51c501e69078f494d4313df77
                                                        • Opcode Fuzzy Hash: 42d1c28a59b315c23aa48637e9ae167f894d38651270de1a8a98ee9fcc4ad737
                                                        • Instruction Fuzzy Hash: E561E4709087958FD720DF24D4803AABBE2FF85384F95885EE8C957342C776E985CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_expr_parse_and_evalmv_logstrcmp
                                                        • String ID: all$default$max$min$none
                                                        • API String ID: 638344568-3292705889
                                                        • Opcode ID: a45776dcf589f155364fd2da9f593db2c86a165bccd51a658e422361a96ac0f8
                                                        • Instruction ID: 411126b03e5c4c9fee0fee3cc8844fcbddd9a5d1040519b46a4fb5c1d41167ed
                                                        • Opcode Fuzzy Hash: a45776dcf589f155364fd2da9f593db2c86a165bccd51a658e422361a96ac0f8
                                                        • Instruction Fuzzy Hash: EC514A7590974A8BC351EF68E04469BF7E5FF89344F518A2EE9C9D7200EB70E9048B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Value %d for parameter '%s' out of %s format range [%d - %d], xrefs: 100281B3
                                                        • none, xrefs: 1002808E
                                                        • Unable to parse option value "%s" as %s, xrefs: 10028165
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_logstrcmpstrtol
                                                        • String ID: Unable to parse option value "%s" as %s$Value %d for parameter '%s' out of %s format range [%d - %d]$none
                                                        • API String ID: 3237617949-2908652078
                                                        • Opcode ID: 691e268f59eefe45aab27bd49c65c0bfe69c5a44b4361b2dd8b56a23eaf8e8d9
                                                        • Instruction ID: 4bc733314f34f2699ba82556ed72ea64bb9030a0ec2445b5dd4e85adb85467a1
                                                        • Opcode Fuzzy Hash: 691e268f59eefe45aab27bd49c65c0bfe69c5a44b4361b2dd8b56a23eaf8e8d9
                                                        • Instruction Fuzzy Hash: AB3137B4A097458FC344DF78948010AFBE1EFC9390F908A2EF9A9D7391E770D9458B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Error setting option %s to value %s., xrefs: 1002D6F7
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_dict_free$mv_dict_getmv_dict_setmv_logmv_opt_set
                                                        • String ID: Error setting option %s to value %s.
                                                        • API String ID: 3258142065-3279051434
                                                        • Opcode ID: ef5084decda187cd213080217201cfa49cd5edc4dfbb471ff57d75f3a90a4203
                                                        • Instruction ID: 35dba755cf83891b6b787024823c04eb56a84bd00f467e741874e99c9612048c
                                                        • Opcode Fuzzy Hash: ef5084decda187cd213080217201cfa49cd5edc4dfbb471ff57d75f3a90a4203
                                                        • Instruction Fuzzy Hash: F731A3B9A087449FC740DF69D58065ABBE4FF88294F51882EF99CC7310E674E940DF82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • AcquireSRWLockExclusive.KERNEL32 ref: 1004A08E
                                                        • SleepConditionVariableSRW.KERNEL32 ref: 1004A0C6
                                                        • ReleaseSRWLockExclusive.KERNEL32 ref: 1004A0DC
                                                        • AcquireSRWLockExclusive.KERNEL32 ref: 1004A123
                                                        • WakeConditionVariable.KERNEL32 ref: 1004A135
                                                        • ReleaseSRWLockExclusive.KERNEL32 ref: 1004A141
                                                        • mv_log.MAIN ref: 1004A1E7
                                                        • abort.MSVCRT ref: 1004A1EC
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ExclusiveLock$AcquireConditionReleaseVariable$SleepWakeabortmv_log
                                                        • String ID:
                                                        • API String ID: 347658250-0
                                                        • Opcode ID: 5ec2205790857898139d0150919feb44815b91eac6bd09cfc369016d3f6426bb
                                                        • Instruction ID: 105667d8cc5a2ab336bf2b63828960297e3ed020638f170ef27288a45aaf5278
                                                        • Opcode Fuzzy Hash: 5ec2205790857898139d0150919feb44815b91eac6bd09cfc369016d3f6426bb
                                                        • Instruction Fuzzy Hash: 305136B56047058FD710EF29C58060BFBE1FF89354F118A2DE99A97610E774F949CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: free$ungetc
                                                        • String ID:
                                                        • API String ID: 2663370934-0
                                                        • Opcode ID: 7e5d2668a86438e7c09c7f4b4d73e0480b01a75a41e977086b1adbd88c9befee
                                                        • Instruction ID: d692218a8b19da4155b2aff489b2430a951df32eb5285c2326706aa3e10a62d2
                                                        • Opcode Fuzzy Hash: 7e5d2668a86438e7c09c7f4b4d73e0480b01a75a41e977086b1adbd88c9befee
                                                        • Instruction Fuzzy Hash: 01419D74A087818FE710DF24C08039AB7E5EF85344F51496EF9E9572A2C775ED88EB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_callocmv_fifo_alloc2mv_fifo_freep2mv_freepmv_malloczmv_sample_fmt_is_planarmv_samples_get_buffer_size
                                                        • String ID:
                                                        • API String ID: 3721653357-0
                                                        • Opcode ID: 42dff5a3eb04adc49f19050df871efb01a7c87c8a448b2921b037ed844c736a9
                                                        • Instruction ID: bb9eb3e5d0204011adfe0aa4748bc2d8f300a22c96b3cf74cba0d42d24462043
                                                        • Opcode Fuzzy Hash: 42dff5a3eb04adc49f19050df871efb01a7c87c8a448b2921b037ed844c736a9
                                                        • Instruction Fuzzy Hash: 273148B8A087068FD700DF69C58061AFBE4FF88384F11892EE99CC7315E774E8558B92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_sha_alloc$mv_sha512_alloc$mv_malloczmv_md5_alloc
                                                        • String ID:
                                                        • API String ID: 1780169607-0
                                                        • Opcode ID: 89fe73e6439e83052310f9247eaea9b5c1dd9965fdfc5345831e5e410a5014f8
                                                        • Instruction ID: 308d306f19edf6ed78ffa685c28ceabba911b28968eaf46d4c5fb4499698521b
                                                        • Opcode Fuzzy Hash: 89fe73e6439e83052310f9247eaea9b5c1dd9965fdfc5345831e5e410a5014f8
                                                        • Instruction Fuzzy Hash: 543102B0016390CFD740EF50E549B06BBA0FB00315FA6C9A9C50A1F262D7BED944CBD6
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • av_image_get_linesize failed, xrefs: 1001FEF6
                                                        • Assertion %s failed at %s:%d, xrefs: 1001FF91
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: abortmv_image_get_linesizemv_logmv_pix_fmt_desc_get
                                                        • String ID: Assertion %s failed at %s:%d$av_image_get_linesize failed
                                                        • API String ID: 1423692287-2525362290
                                                        • Opcode ID: 19a34fa3045bd52ddc904fabf5880a30275453ed701ec10dc373799bbca6dd21
                                                        • Instruction ID: eedc48b82a1fb41b1fbcfd9c24b211374ee1d321ec6a1758f6a6c150146530bc
                                                        • Opcode Fuzzy Hash: 19a34fa3045bd52ddc904fabf5880a30275453ed701ec10dc373799bbca6dd21
                                                        • Instruction Fuzzy Hash: CDD17C75A08351CFC350CF28C18062AFBE1FF99344F55896DE9898B362D775E982DB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 0$@
                                                        • API String ID: 0-1545510068
                                                        • Opcode ID: 13a05ddf3fa1ef3e6f83545d4c8c7334279129876b143e9975e0b6c0a575227c
                                                        • Instruction ID: 042a0d87ccfab50b6cd798803ce937aa9cfec6d564815ef75f931cd5060123e9
                                                        • Opcode Fuzzy Hash: 13a05ddf3fa1ef3e6f83545d4c8c7334279129876b143e9975e0b6c0a575227c
                                                        • Instruction Fuzzy Hash: 14C12772E046168BDB05CF68C88478DBBF2FF88354F258269E85CAB395D374E841DB90
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: abortmv_gcdmv_logmv_malloc
                                                        • String ID: Assertion %s failed at %s:%d$libavutil/tx.c
                                                        • API String ID: 4069727316-3214517670
                                                        • Opcode ID: 3a86cab36d8e530dac25bcc30bd8bbdd95ef25ef144ed0f4418dff830d47f98c
                                                        • Instruction ID: 97686d52ff029028b5cb48a31492680369d7a5b0c0d5c016aae493d3c13362a3
                                                        • Opcode Fuzzy Hash: 3a86cab36d8e530dac25bcc30bd8bbdd95ef25ef144ed0f4418dff830d47f98c
                                                        • Instruction Fuzzy Hash: E8B1E375A083818FC764CF29C58065AFBE2FF88314F158A2EE999D7311E730AD45CB86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: malloc$realloc
                                                        • String ID:
                                                        • API String ID: 4146991691-0
                                                        • Opcode ID: a4f104c4048a5f8dccd610beb3d4c19a87cfe24ad6d50ab1b5bfdd7435f784a0
                                                        • Instruction ID: f586937920a4f822164f33dd0f291a3d66e9c0cb58edef8f4ec06fb8e085db03
                                                        • Opcode Fuzzy Hash: a4f104c4048a5f8dccd610beb3d4c19a87cfe24ad6d50ab1b5bfdd7435f784a0
                                                        • Instruction Fuzzy Hash: 25A1FD746083018FC720CF29C580A5AB7E1EFC9754F118A2EF9999B361E771ED05EB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_adler32_updatemv_crcmv_md5_finalmv_murmur3_finalmv_ripemd_finalmv_sha512_finalmv_sha_final
                                                        • String ID:
                                                        • API String ID: 1982440126-0
                                                        • Opcode ID: df96e90217d37244b0dca780f4c69ede17494fb52ea6fc2b56b595ac0794c65b
                                                        • Instruction ID: 046ab84a8c44898d371c363dc14f1fdf4a4b70b6c38c2771c8d012733aa29193
                                                        • Opcode Fuzzy Hash: df96e90217d37244b0dca780f4c69ede17494fb52ea6fc2b56b595ac0794c65b
                                                        • Instruction Fuzzy Hash: E29108B5909746CFC710CF28D18060ABBE0FF89350F65896EE98D9B321D334E985DB96
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e22194f63cd8b3d32d12af993c9b419f9564881632f182a2152fe54f23c7911b
                                                        • Instruction ID: 16f5bf25af95bab1faddb375712d4b7f53b5ab5cb691f7174e3ff760a2b83ddc
                                                        • Opcode Fuzzy Hash: e22194f63cd8b3d32d12af993c9b419f9564881632f182a2152fe54f23c7911b
                                                        • Instruction Fuzzy Hash: 9B717E75608342CBC755EF28E490A1AB7E1EF94780FA1892EE8D98B355D731DC85CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmp$mv_opt_find2
                                                        • String ID:
                                                        • API String ID: 3181049271-0
                                                        • Opcode ID: dd01def158e708a67ffa8e9ac78e78581eb1c099993243723df33eb0ce15e060
                                                        • Instruction ID: e6022f51a5e1b9dd3d0d9e8f4efd117a22464f7803f398aa773214262c2afff6
                                                        • Opcode Fuzzy Hash: dd01def158e708a67ffa8e9ac78e78581eb1c099993243723df33eb0ce15e060
                                                        • Instruction Fuzzy Hash: D651E87460834ACBCB40DFE5E580A1BB7E4EF85784F85882DEC98C7210EB74D948DB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_tree_find$mv_tree_insert
                                                        • String ID:
                                                        • API String ID: 3047205218-0
                                                        • Opcode ID: 748b1c967ae3881e327b4b3e75e89f36747101333f41ba75464ed4008a113ba7
                                                        • Instruction ID: 11e2b96d07c673488f848e46a8f9316f5266a218077dcf01b0671550c3d31cb7
                                                        • Opcode Fuzzy Hash: 748b1c967ae3881e327b4b3e75e89f36747101333f41ba75464ed4008a113ba7
                                                        • Instruction Fuzzy Hash: 5A51DFB590974A9FC340DF6AC18091AFBE1FF88650F61892EE898C7301E734E9418F86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_pix_fmt_desc_get.MAIN ref: 1002067F
                                                        • mv_image_get_linesize.MAIN ref: 100206B4
                                                          • Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976
                                                        • mv_image_fill_linesizes.MAIN(?), ref: 10020748
                                                        • mv_image_fill_plane_sizes.MAIN(?), ref: 100207AB
                                                        Strings
                                                        • Picture size %ux%u is invalid, xrefs: 100207FF
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_pix_fmt_desc_get$mv_image_fill_linesizesmv_image_fill_plane_sizesmv_image_get_linesize
                                                        • String ID: Picture size %ux%u is invalid
                                                        • API String ID: 3680373976-1963597007
                                                        • Opcode ID: 363d7f5b0f2576a8b82a55742b866563a56274ce2c15312feba007e7f86faec8
                                                        • Instruction ID: 2314817fb5d2ccefc3c8ff58fcc714fc26626ca1613a84a068ef5f43893ec408
                                                        • Opcode Fuzzy Hash: 363d7f5b0f2576a8b82a55742b866563a56274ce2c15312feba007e7f86faec8
                                                        • Instruction Fuzzy Hash: C4512576A083418FC354CF69D88564FBBE6EFC8350F558A2EF598C7351EA74E8448B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_escape$mv_bprint_append_datamv_bprint_finalizemv_bprint_initmv_strdup
                                                        • String ID:
                                                        • API String ID: 806756221-0
                                                        • Opcode ID: bd899ef9b0dbaba746c8b6d0da506afdd114f8397f9f9c4fb8b0c4949863bb04
                                                        • Instruction ID: 7187b0243939ecc75a9d4dff51427cd59bf1c299843c139242dac8f39c04a417
                                                        • Opcode Fuzzy Hash: bd899ef9b0dbaba746c8b6d0da506afdd114f8397f9f9c4fb8b0c4949863bb04
                                                        • Instruction Fuzzy Hash: 134114B55093449FC360CF28C08029BFBE5FF86354F55892EE9988B341E736EA95CB46
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_channel_from_string$mv_strlcpystrchrstrcmp
                                                        • String ID:
                                                        • API String ID: 1821482347-0
                                                        • Opcode ID: da3edf490d4416a14b75eaa0f87995938fed091b4a310eb1baaf614b82469ff7
                                                        • Instruction ID: b36a671443ebfd3664ebfe81d2672e3825410638c3dff80f38bd050e3f4a86e6
                                                        • Opcode Fuzzy Hash: da3edf490d4416a14b75eaa0f87995938fed091b4a310eb1baaf614b82469ff7
                                                        • Instruction Fuzzy Hash: DF418075A087868BEB10DF28C48054EBBE4FF88794F114D2DE8D8A7255D370ED45CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_buffer_alloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A8CA
                                                          • Part of subcall function 10009DC0: mv_malloc.MAIN ref: 10009DDC
                                                          • Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009DF2
                                                          • Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009E25
                                                        • mv_realloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A902
                                                          • Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB
                                                        • mv_mallocz.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A91C
                                                        • mv_dict_copy.MAIN ref: 1001A996
                                                        • mv_buffer_ref.MAIN ref: 1001A9EC
                                                        • mv_realloc.MAIN ref: 1001AA26
                                                        • mv_mallocz.MAIN ref: 1001AA40
                                                        • mv_buffer_unref.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AA87
                                                        • mv_buffer_unref.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AAAD
                                                        • mv_dict_free.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AAB5
                                                        • mv_freep.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AABD
                                                        • mv_freep.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AADB
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mallocz$mv_buffer_unrefmv_freepmv_realloc$_aligned_reallocmv_buffer_allocmv_buffer_refmv_dict_copymv_dict_freemv_malloc
                                                        • String ID:
                                                        • API String ID: 3654835198-0
                                                        • Opcode ID: 70dec7b0525f92eea09a52100746da8d68807f2b7a8b1601fe4d47d21b59e6f4
                                                        • Instruction ID: 2b85b05f5678c247458617f8db437906648f713ae92fec64b70ab4220dcfa18e
                                                        • Opcode Fuzzy Hash: 70dec7b0525f92eea09a52100746da8d68807f2b7a8b1601fe4d47d21b59e6f4
                                                        • Instruction Fuzzy Hash: 8F51E674904381CFCB14CF19C58069ABBE1FF89390F46896EE98A9B351E770E981CF91
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strspn$mv_mallocstrlen
                                                        • String ID:
                                                        • API String ID: 1916163187-596783616
                                                        • Opcode ID: c1cd0ea710ee61caf6f581c2a68d6a1753dc280333e09f0715da0c84ddb40841
                                                        • Instruction ID: 4177569fa848450c707169e52794d897aa5a5a3714551b1bd9b9763f873ecb90
                                                        • Opcode Fuzzy Hash: c1cd0ea710ee61caf6f581c2a68d6a1753dc280333e09f0715da0c84ddb40841
                                                        • Instruction Fuzzy Hash: E341847460C3958FDB11DF25888025ABBE7EF8B6C0F55885DE8C56B306C235EA48CB93
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_expr_parse_and_eval.MAIN ref: 1002C5F5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_expr_parse_and_eval
                                                        • String ID: all$default$max$min$none
                                                        • API String ID: 2217327432-3292705889
                                                        • Opcode ID: 322fc08208eac5c62e149815230ed5bfbdbf25e373bcd5dd5b57cac02c8132ab
                                                        • Instruction ID: 83d07ffb6d8c6cfe48df1192a88470446e278d9b2bcb376e76410f15be41486f
                                                        • Opcode Fuzzy Hash: 322fc08208eac5c62e149815230ed5bfbdbf25e373bcd5dd5b57cac02c8132ab
                                                        • Instruction Fuzzy Hash: A6410475A097458BC395EF28E04038BBBE5FFC9314F618A2EE9C9D7200EB71D9448B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log$strcmp
                                                        • String ID: %-15s
                                                        • API String ID: 1163046698-755444208
                                                        • Opcode ID: fe091ff9f6901946a166bc3df3bd508716d3bd7d362f07d782aa9c38da8257b7
                                                        • Instruction ID: c2e3231857e14b6d66286021a66802d314ea6e9fac30e20b35dba61e0b599c78
                                                        • Opcode Fuzzy Hash: fe091ff9f6901946a166bc3df3bd508716d3bd7d362f07d782aa9c38da8257b7
                                                        • Instruction Fuzzy Hash: 39319E78A093459FC750DF28E19065EBBE1EF88B80F91C82EF89987351E774E9409B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _errno$_sopenrandstrlen
                                                        • String ID: XXXX
                                                        • API String ID: 1081397658-1518373315
                                                        • Opcode ID: 41818ad3e72adebc80571ed86afad46c9302ef0646f7f912c4873975d3c77747
                                                        • Instruction ID: 44b3c0712c4d6cf3a6541ef21b7e2c07706476ce399c25bdb07493ab5c095def
                                                        • Opcode Fuzzy Hash: 41818ad3e72adebc80571ed86afad46c9302ef0646f7f912c4873975d3c77747
                                                        • Instruction Fuzzy Hash: CA21F571D0834ACFC318EF35889416A7BE0FF8A354F12892FE6548B291DF319949CB81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • overriding to %d logical cores, xrefs: 1000F981
                                                        • detected %d logical cores, xrefs: 1000F9B4
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: Process$AffinityCurrentMaskmv_log
                                                        • String ID: detected %d logical cores$overriding to %d logical cores
                                                        • API String ID: 4261380130-3421371979
                                                        • Opcode ID: c659c9415a9862b172ccff880677a34c8f56de918c1cf1742d91ff05b19fa797
                                                        • Instruction ID: 58e6b2fe0b08649328af5215a9cec38f6754a0f8dc443d6bf54cb1b14bc42e03
                                                        • Opcode Fuzzy Hash: c659c9415a9862b172ccff880677a34c8f56de918c1cf1742d91ff05b19fa797
                                                        • Instruction Fuzzy Hash: E82130B5A197019BD304DF29C48131ABBE2EBC8350F48C93DF989C7759E638D9458B43
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_buffer_pool_uninit.MAIN ref: 1001D7BB
                                                          • Part of subcall function 1000A650: AcquireSRWLockExclusive.KERNEL32 ref: 1000A66C
                                                          • Part of subcall function 1000A650: mv_freep.MAIN ref: 1000A69C
                                                          • Part of subcall function 1000A650: ReleaseSRWLockExclusive.KERNEL32 ref: 1000A6AB
                                                        • mv_buffer_unref.MAIN ref: 1001D7F2
                                                        • mv_buffer_unref.MAIN ref: 1001D801
                                                        • mv_freep.MAIN ref: 1001D810
                                                        • mv_freep.MAIN ref: 1001D822
                                                        • mv_freep.MAIN ref: 1001D831
                                                        • mv_freep.MAIN ref: 1001D83D
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$ExclusiveLockmv_buffer_unref$AcquireReleasemv_buffer_pool_uninit
                                                        • String ID:
                                                        • API String ID: 3286761627-0
                                                        • Opcode ID: c6c09d7d300876a1707853c3afdde09c35c9359a08c94a7bfa9ac57c73ae979d
                                                        • Instruction ID: d019eb9eba46684987302df58934bd10d6a5c0a39701eb176e19b0f551cd46b2
                                                        • Opcode Fuzzy Hash: c6c09d7d300876a1707853c3afdde09c35c9359a08c94a7bfa9ac57c73ae979d
                                                        • Instruction Fuzzy Hash: FE1198B86087018FDB04EF69D485A1EFBE1FF84204F46895DE4948B306E735E889CB52
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf
                                                        • String ID: AMBI%d$NONE$USR%d
                                                        • API String ID: 3083893021-3656852315
                                                        • Opcode ID: 6cd4f19d3d74ee3d12c501f26348e63cdefaf32e071506f7e6661ce223037e5e
                                                        • Instruction ID: 7fcf34f7b534e12bd35e409064aa58f3f25e521088902b3bc772a385e2e8df73
                                                        • Opcode Fuzzy Hash: 6cd4f19d3d74ee3d12c501f26348e63cdefaf32e071506f7e6661ce223037e5e
                                                        • Instruction Fuzzy Hash: FA0121B4909B85CBD344EF68848052DB6E1FB94384F948A6DE4CC87755E639DE409B83
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf
                                                        • String ID: ambisonic ACN %d$none$user %d
                                                        • API String ID: 3083893021-4180635230
                                                        • Opcode ID: 223aa0a192477accd332f19378ca7d36c64ee90d24a02cbd76f3be9b95891286
                                                        • Instruction ID: dcc63c4345791cf420d4df1e5b10cc0e469fa513568dbd2a0042959f5c7c7fdf
                                                        • Opcode Fuzzy Hash: 223aa0a192477accd332f19378ca7d36c64ee90d24a02cbd76f3be9b95891286
                                                        • Instruction Fuzzy Hash: D7011EB4908B81CBD314EF28908152DBAE1FBD4284F94896DE4CC87355E639DA408B53
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_pix_fmt_desc_get.MAIN ref: 1001B043
                                                        • mv_image_check_size.MAIN ref: 1001B069
                                                          • Part of subcall function 1001F6A0: mv_image_get_linesize.MAIN ref: 1001F6E3
                                                        • mv_image_fill_linesizes.MAIN ref: 1001B0C8
                                                          • Part of subcall function 1001EAB0: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,1001B0CD), ref: 1001EAC6
                                                        • mv_image_fill_plane_sizes.MAIN ref: 1001B15D
                                                        • mv_buffer_alloc.MAIN ref: 1001B1CD
                                                        • mv_image_fill_pointers.MAIN ref: 1001B1FC
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_pix_fmt_desc_get$mv_buffer_allocmv_image_check_sizemv_image_fill_linesizesmv_image_fill_plane_sizesmv_image_fill_pointersmv_image_get_linesize
                                                        • String ID:
                                                        • API String ID: 566543421-0
                                                        • Opcode ID: f91591d019d291e180dcf44e96ce89918f7d927db6cfc3ba89d5ff0d6a58ef0d
                                                        • Instruction ID: a5d1a7900a1a2f35fa09734171263621add282bd6d5ab2c0dd3880a3946380f0
                                                        • Opcode Fuzzy Hash: f91591d019d291e180dcf44e96ce89918f7d927db6cfc3ba89d5ff0d6a58ef0d
                                                        • Instruction Fuzzy Hash: 8A61F7B5A08B018FCB44DF69C59065ABBE1FF88240F16897DE949CB319E735E884CF41
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_calloc.MAIN ref: 1003A52A
                                                        • mv_samples_get_buffer_size.MAIN ref: 1003A55E
                                                        • mv_malloc.MAIN ref: 1003A572
                                                        • mv_samples_fill_arrays.MAIN ref: 1003A5A8
                                                          • Part of subcall function 1003A1B0: mv_samples_get_buffer_size.MAIN ref: 1003A201
                                                        • mv_freep.MAIN ref: 1003A697
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_samples_get_buffer_size$mv_callocmv_freepmv_mallocmv_samples_fill_arrays
                                                        • String ID:
                                                        • API String ID: 3785048109-0
                                                        • Opcode ID: 5ae1779f3f7e2cdb2b331e1be93d4aeac89c33ba1fb156b6b974ba19d1fc6e91
                                                        • Instruction ID: bcd7097c64c988b962d1b439634854989dd960b0eefa7e233943bcd087631235
                                                        • Opcode Fuzzy Hash: 5ae1779f3f7e2cdb2b331e1be93d4aeac89c33ba1fb156b6b974ba19d1fc6e91
                                                        • Instruction Fuzzy Hash: E3518E75E087418FC701CF69D4C160AFBE4EF86395F56492EE8848B360E375E985CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_buffer_is_writable$mv_channel_layout_copymv_frame_copymv_hwframe_get_buffer
                                                        • String ID:
                                                        • API String ID: 1431812533-0
                                                        • Opcode ID: 364bd59554279b40aee4642812e1f726182608b2a75209079b3376af4345f371
                                                        • Instruction ID: eaf454bc14f92c14001bd62492fec0c564a2a00f258074e35efd3c86292710f4
                                                        • Opcode Fuzzy Hash: 364bd59554279b40aee4642812e1f726182608b2a75209079b3376af4345f371
                                                        • Instruction Fuzzy Hash: 46514B75A047168BD354CF79C880B9AF7E4FF88350F018A2AE999CB301E734E8948B91
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: QueryVirtualabortfwritevfprintf
                                                        • String ID:
                                                        • API String ID: 2513968241-0
                                                        • Opcode ID: 77f9c74a023bead4244158e4538434e8ac340feeaea4348980fb076ccdbc421e
                                                        • Instruction ID: 54ad2b6e83e5b16b79a45a6593ed35e006b5b48100f64ca54a0057f1c503df76
                                                        • Opcode Fuzzy Hash: 77f9c74a023bead4244158e4538434e8ac340feeaea4348980fb076ccdbc421e
                                                        • Instruction Fuzzy Hash: E0514BB59053519FC700EF68C98965AFBE4FF84354F42C92EE8988B226D734E944CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • Sleep.KERNEL32(?,?,?,10001281,?,?,?,?,?,?,100013AE), ref: 10001057
                                                        • _amsg_exit.MSVCRT ref: 10001086
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: Sleep_amsg_exit
                                                        • String ID:
                                                        • API String ID: 1015461914-0
                                                        • Opcode ID: d59ae3628b0237ba56fdd7c9d317007903976593300e79648f20ecf33c672c95
                                                        • Instruction ID: dd64dd1eda1eb68cef0d792f916db726e673d7e5cc478cdb0012762ac5c84acb
                                                        • Opcode Fuzzy Hash: d59ae3628b0237ba56fdd7c9d317007903976593300e79648f20ecf33c672c95
                                                        • Instruction Fuzzy Hash: 1A31A374609651CBE310EF54C9C438A7BE1FB483C0F52482DE9848B76DD7B9D884DB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • AcquireSRWLockExclusive.KERNEL32 ref: 1004A262
                                                        • WakeConditionVariable.KERNEL32 ref: 1004A274
                                                        • ReleaseSRWLockExclusive.KERNEL32 ref: 1004A280
                                                        • WaitForSingleObjectEx.KERNEL32 ref: 1004A2C8
                                                        • CloseHandle.KERNEL32 ref: 1004A2D8
                                                        • mv_freep.MAIN ref: 1004A2F3
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ExclusiveLock$AcquireCloseConditionHandleObjectReleaseSingleVariableWaitWakemv_freep
                                                        • String ID:
                                                        • API String ID: 1841216690-0
                                                        • Opcode ID: 18bc572b1c8a2e61cb34bfd6f4b1ef9c865d202ec6cb55ee2b061ed66f55e34f
                                                        • Instruction ID: 3180a2c82765ffdb0d0e9836089f8425691ac15bb4143a1306c626e3471b16ad
                                                        • Opcode Fuzzy Hash: 18bc572b1c8a2e61cb34bfd6f4b1ef9c865d202ec6cb55ee2b061ed66f55e34f
                                                        • Instruction Fuzzy Hash: 34317EB26047058FD304EF68D98420BBBE1FF85290F61853DE85987205E331E999CBC6
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_channel_layout_from_maskmv_freepstrcmp
                                                        • String ID:
                                                        • API String ID: 3576703362-0
                                                        • Opcode ID: 2b02768f874b8c8628ca8c24d3a244cf9eff547c0ef362d73473bb9b13f20ec1
                                                        • Instruction ID: 3232a43fc97f47c23ab915f7ee9f6b07ea90700946469634bd9b1ff3e7b05c00
                                                        • Opcode Fuzzy Hash: 2b02768f874b8c8628ca8c24d3a244cf9eff547c0ef362d73473bb9b13f20ec1
                                                        • Instruction Fuzzy Hash: 9C313871A087819FE340DF25D48061EBBE1EF88394F52982EF98997318DB71EC44CB52
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • AcquireSRWLockExclusive.KERNEL32 ref: 1004A262
                                                        • WakeConditionVariable.KERNEL32 ref: 1004A274
                                                        • ReleaseSRWLockExclusive.KERNEL32 ref: 1004A280
                                                        • WaitForSingleObjectEx.KERNEL32 ref: 1004A2C8
                                                        • CloseHandle.KERNEL32 ref: 1004A2D8
                                                        • mv_freep.MAIN ref: 1004A2F3
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ExclusiveLock$AcquireCloseConditionHandleObjectReleaseSingleVariableWaitWakemv_freep
                                                        • String ID:
                                                        • API String ID: 1841216690-0
                                                        • Opcode ID: a14856d7447140d92799d6568a2db05317804891632b94121e1a719d57eb44ae
                                                        • Instruction ID: bc251ce03876973850fb77e440ae180f66f2e7fe9fc8712012c25621f5453433
                                                        • Opcode Fuzzy Hash: a14856d7447140d92799d6568a2db05317804891632b94121e1a719d57eb44ae
                                                        • Instruction Fuzzy Hash: BF214CB15087158FC700EF68D98420EBBE0FF94340F61853DE89997215D331E599CBC6
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$mv_buffer_createmv_buffer_refmv_buffer_unrefmv_mallocz
                                                        • String ID:
                                                        • API String ID: 3470597486-0
                                                        • Opcode ID: 82d4d6f48f5693230cace15fd24bc2228de7c8f31a461438f864d3093ed9a926
                                                        • Instruction ID: 5b75efe8a7b385c844e612e13115847a546b552e435f503cc794a769bad89dbf
                                                        • Opcode Fuzzy Hash: 82d4d6f48f5693230cace15fd24bc2228de7c8f31a461438f864d3093ed9a926
                                                        • Instruction Fuzzy Hash: 4101A8756097909FDB40EF74D88161EBBE4EF44294F811C2EF985CB316E735E4848B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep
                                                        • String ID:
                                                        • API String ID: 2373662943-0
                                                        • Opcode ID: 040eb387164af77af1c63a09622b6d2a53c8259c3461063de0c689219d215f94
                                                        • Instruction ID: 1079961fa057578bb5c831cca7ccaeae819dd5d2bf26a49409838597a67f0fd3
                                                        • Opcode Fuzzy Hash: 040eb387164af77af1c63a09622b6d2a53c8259c3461063de0c689219d215f94
                                                        • Instruction Fuzzy Hash: ABF0F879509B548BCB00EFB4E88559DBBE4FF48214F810C2EF8C487305F635E5448B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_strstart
                                                        • String ID: $xyz$yuvj
                                                        • API String ID: 2201124280-2071466796
                                                        • Opcode ID: bd39db4a194a366d109f30458d461c2df5a62078d964f913814af86215653bba
                                                        • Instruction ID: fae87543b31ee3dab4fff42b62755004a6e6770c78894ec516081f8316d78002
                                                        • Opcode Fuzzy Hash: bd39db4a194a366d109f30458d461c2df5a62078d964f913814af86215653bba
                                                        • Instruction Fuzzy Hash: 28C1F3355083948FD342CF28D8D47AABBE2EFC6388F85496CF4D187266D275DA58CB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_strstart
                                                        • String ID: $xyz$yuvj
                                                        • API String ID: 2201124280-2071466796
                                                        • Opcode ID: 81723ec4f1f1f9ea585c3b123fc44b8cc6761d75b4754926e1d488a3831eaf29
                                                        • Instruction ID: bfc651eaba2522c4d235aec60645e24123cb0f9c5bb9b4cc4e7f011c1b04411b
                                                        • Opcode Fuzzy Hash: 81723ec4f1f1f9ea585c3b123fc44b8cc6761d75b4754926e1d488a3831eaf29
                                                        • Instruction Fuzzy Hash: 02C103355083948FD342CF28D8D47AABBE2EFC5388F85496CF4D187266D275EA58CB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Value %f for parameter '%s' out of range [%g - %g], xrefs: 100284E1
                                                        • Value %f for parameter '%s' is not a valid set of 32bit integer flags, xrefs: 10028528
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log
                                                        • String ID: Value %f for parameter '%s' is not a valid set of 32bit integer flags$Value %f for parameter '%s' out of range [%g - %g]
                                                        • API String ID: 2418673259-116802341
                                                        • Opcode ID: b91d7ced30b6434288ab1907ca3d90c93a663e42af0a09cf66cc9c9b5210601c
                                                        • Instruction ID: 931f173b8bdea695e87718931e4fd3664ef7a6003200403b2d75d7b454637e3a
                                                        • Opcode Fuzzy Hash: b91d7ced30b6434288ab1907ca3d90c93a663e42af0a09cf66cc9c9b5210601c
                                                        • Instruction Fuzzy Hash: 6B81AB3982AF918BC342DF38948111BF7E5FFDA780F919B5EF8966A251CB3096418742
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: abortmv_logstrchr
                                                        • String ID: D$[%d]
                                                        • API String ID: 3894635902-663482207
                                                        • Opcode ID: edaa72c25f19791f7b0e2c498262eef7d1e3daae0752c7ed1855659ef121fb98
                                                        • Instruction ID: d504e214a0ac69bf47af384dd0df17c231b8338c86ebac8fad4f33609c477930
                                                        • Opcode Fuzzy Hash: edaa72c25f19791f7b0e2c498262eef7d1e3daae0752c7ed1855659ef121fb98
                                                        • Instruction Fuzzy Hash: CA51C271E057528FE764DF29858022BB7E0FB8B354F15482AFA96D3A02D335ACC5DB81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_image_get_linesize.MAIN ref: 1001F5A7
                                                          • Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976
                                                        • mv_log.MAIN ref: 1001F651
                                                        • mv_log.MAIN(?), ref: 1001F68E
                                                        Strings
                                                        • Picture size %ux%u exceeds specified max pixel count %lld, see the documentation if you wish to increase it, xrefs: 1001F67E
                                                        • Picture size %ux%u is invalid, xrefs: 1001F634
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log$mv_image_get_linesizemv_pix_fmt_desc_get
                                                        • String ID: Picture size %ux%u exceeds specified max pixel count %lld, see the documentation if you wish to increase it$Picture size %ux%u is invalid
                                                        • API String ID: 1737039923-91635712
                                                        • Opcode ID: b713d412f0b4c193ddf67d660aae77bfb9a187d1b155d626092247ac1b9e9bef
                                                        • Instruction ID: b6506859fe761d8d1ebdf93eb357839b8b21828a19d49b356052a9795fea712b
                                                        • Opcode Fuzzy Hash: b713d412f0b4c193ddf67d660aae77bfb9a187d1b155d626092247ac1b9e9bef
                                                        • Instruction Fuzzy Hash: FA41DFB5A083449FC350CF29C08020EFBE1FBD8750F558A2EF9A8D7360E674E9458B86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: fputc$memset
                                                        • String ID: 0$o
                                                        • API String ID: 2944404495-4157579757
                                                        • Opcode ID: 53fe556841918975cc31bb2d763770b8d6595e2fb305a3f12117177a263cadf8
                                                        • Instruction ID: aa4496313d88015306b34c3d7fa9de5912afecbe9c57c6fd191b73af4879bf6f
                                                        • Opcode Fuzzy Hash: 53fe556841918975cc31bb2d763770b8d6595e2fb305a3f12117177a263cadf8
                                                        • Instruction Fuzzy Hash: 35310876A08206CBCB15CF68C48479EBBF1FF48350F15862AD99DAB351E738E900EB54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmpstrncmpstrtol
                                                        • String ID: AMBI
                                                        • API String ID: 155133989-3084986980
                                                        • Opcode ID: c65f3f7975b7823a73d044f094c93d5fd796e748c7aa11a49156733d133437d6
                                                        • Instruction ID: 96a3e84c180ec1e05a7f5708790a2991e0ec9e313a24bbe51d35f59fb7ac403f
                                                        • Opcode Fuzzy Hash: c65f3f7975b7823a73d044f094c93d5fd796e748c7aa11a49156733d133437d6
                                                        • Instruction Fuzzy Hash: B6217FB590C7864FE750DF249CC060BBAD0EF492D1F11893EE98993255E275DC85C782
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • strspn.MSVCRT ref: 1002BF97
                                                        • strchr.MSVCRT ref: 1002BFB5
                                                        • mv_malloc.MAIN(?,?,?,?,?,?,?,?,?,?,100AEACF,100AEB86,00000000,?,1000DF13), ref: 1002BFCD
                                                        • mv_get_token.MAIN ref: 1002BFFF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_get_tokenmv_mallocstrchrstrspn
                                                        • String ID:
                                                        • API String ID: 476366593-596783616
                                                        • Opcode ID: 29e496927f1da63fb82fa8c860c72426edcc2de4f9f69176329bf0e8f31cb9b9
                                                        • Instruction ID: dc3b06df85388a75f907743202ecfe3307d48378777e578708470cdae6669aaf
                                                        • Opcode Fuzzy Hash: 29e496927f1da63fb82fa8c860c72426edcc2de4f9f69176329bf0e8f31cb9b9
                                                        • Instruction Fuzzy Hash: 89215E745087458FCB00DFB8D5C095ABBE5FF89284F80896ED998C7301E675E84ADB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_dict_setmv_strlcatfstrftime
                                                        • String ID: %Y-%m-%dT%H:%M:%S$.%06dZ
                                                        • API String ID: 3046200060-930656424
                                                        • Opcode ID: 728a3bd6f1d20a34548cbc8e6d3f3df844403d6c227aa6eea2e28321bcd2af87
                                                        • Instruction ID: 1402893b187d2e51f9b144a86c1e9403a14236be66f1ea1af33c468999098a96
                                                        • Opcode Fuzzy Hash: 728a3bd6f1d20a34548cbc8e6d3f3df844403d6c227aa6eea2e28321bcd2af87
                                                        • Instruction Fuzzy Hash: 982190B59093419FD350DF29E58065BBBE0FB88354F51C92EF89CC7305E639D8948B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf
                                                        • String ID: @%s$NONE
                                                        • API String ID: 3083893021-9228147
                                                        • Opcode ID: 79dbcbfc88ece960a6534e3f0ca092c78e639d7c6172cd214de36e0c89aebf28
                                                        • Instruction ID: 70331aafde610822ed2af80890897691dd53c5944589bad81a8dad7e52305c51
                                                        • Opcode Fuzzy Hash: 79dbcbfc88ece960a6534e3f0ca092c78e639d7c6172cd214de36e0c89aebf28
                                                        • Instruction Fuzzy Hash: 65114C71909B5A8BE720EF18C58016EF7E1FB443D4F55881EE889A7219D731EC94CBE2
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                          • Part of subcall function 1008F820: strlen.MSVCRT ref: 1008F832
                                                          • Part of subcall function 1008F820: _errno.MSVCRT ref: 1008F850
                                                        • _errno.MSVCRT ref: 10019A21
                                                        • mv_log.MAIN ref: 10019A4E
                                                        • mv_freep.MAIN ref: 10019A56
                                                        Strings
                                                        • ff_tempfile: Cannot open temporary file %s, xrefs: 10019A45
                                                        • ./%sXXXXXX, xrefs: 100199FC
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _errno$mv_freepmv_logstrlen
                                                        • String ID: ./%sXXXXXX$ff_tempfile: Cannot open temporary file %s
                                                        • API String ID: 3408331932-3725816632
                                                        • Opcode ID: a3950751fee6fd876fd9b19f7d0582473770252bb0b6f1313e2b3e67b8d33bc2
                                                        • Instruction ID: 705c49607cd9e09248a5fe22d2e6320ca494c65325cbcc3e842bccd471215b3e
                                                        • Opcode Fuzzy Hash: a3950751fee6fd876fd9b19f7d0582473770252bb0b6f1313e2b3e67b8d33bc2
                                                        • Instruction Fuzzy Hash: 0E0168B89087519FC340DF29C18151ABBE1FF88600F91882EE9C99B311E739E9859F82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Error occurred in fstat(): %s, xrefs: 1001950B
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _close_errnomv_logmv_strerrormv_strlcpy
                                                        • String ID: Error occurred in fstat(): %s
                                                        • API String ID: 1199337903-68092211
                                                        • Opcode ID: fe60c93a3a69f3fb052d7518d5be4b5d53371f27e76a69ea24f993d483ec9b6c
                                                        • Instruction ID: 16cc7446d487878674d3b6b426b97f2481dfa04c85c7ba054179e642ea7d2528
                                                        • Opcode Fuzzy Hash: fe60c93a3a69f3fb052d7518d5be4b5d53371f27e76a69ea24f993d483ec9b6c
                                                        • Instruction Fuzzy Hash: D5F092B48097159FC310EF14C48425AFBE4FF84700F41C82EE5D99B361DBB4A9859B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_log.MAIN(?,?,?,?,?,?,?,?,?,?,100272BA), ref: 10026214
                                                        • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,100272BA), ref: 10026219
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: abortmv_log
                                                        • String ID: Assertion %s failed at %s:%d$libavutil/mem.c$val || !min_size
                                                        • API String ID: 2075109169-2043513658
                                                        • Opcode ID: e7e30a6a0de43b51050d007a56aa4d2eb09a9faf66d078cd7bb3a4404be27e90
                                                        • Instruction ID: 7b7f116074881568e08956f9dc360710bb9d07d4c08e9fc45df01861e4a7bb4b
                                                        • Opcode Fuzzy Hash: e7e30a6a0de43b51050d007a56aa4d2eb09a9faf66d078cd7bb3a4404be27e90
                                                        • Instruction Fuzzy Hash: 07E04C745493459FC344DF69911160EBBE1EB88700F51C82DE59CC7349D778D4449B57
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strlen$strchrstrncmp
                                                        • String ID: -
                                                        • API String ID: 2264528763-2547889144
                                                        • Opcode ID: 48f7d506b45c4cfb1b097bd66a56f7f6b4d5827668b9fbc93cb44df58068eac6
                                                        • Instruction ID: 2e89a320e1afa525ac89b1a85f99ca85d7156f5341a68399cbbe94f8cfb36377
                                                        • Opcode Fuzzy Hash: 48f7d506b45c4cfb1b097bd66a56f7f6b4d5827668b9fbc93cb44df58068eac6
                                                        • Instruction Fuzzy Hash: 8C318F75A083918FEB10DA78949025EBBE1FF89284F05492EE9C8D7249E278D906D792
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_callocmv_frame_allocmv_frame_freemv_freepmv_get_pix_fmt_namemv_image_check_sizemv_log
                                                        • String ID:
                                                        • API String ID: 473889652-0
                                                        • Opcode ID: 9fa864ee1928c6bd1dd4db397f2e61f531e39c49d346cdfc62535eb3725c1c8c
                                                        • Instruction ID: f0d2ef2185eafc4a44fc2f14c59591e06059a7926607cfdcd1216548b2331345
                                                        • Opcode Fuzzy Hash: 9fa864ee1928c6bd1dd4db397f2e61f531e39c49d346cdfc62535eb3725c1c8c
                                                        • Instruction Fuzzy Hash: C841E274604B828FD750DF69C480A0AF7E5FF88754F56892DE999DB321E770EC818B81
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_buffer_ref$mv_buffer_unrefmv_hwframe_ctx_alloc
                                                        • String ID:
                                                        • API String ID: 2050485749-0
                                                        • Opcode ID: d3ad7b980c272c66dfc6251d2f9a7c7bfdd2a05f411efaddebb324c9794b0f7c
                                                        • Instruction ID: b949cf843239185fdb129f7a391c6e35efcc54fa384153f32d0a78a94b68c8eb
                                                        • Opcode Fuzzy Hash: d3ad7b980c272c66dfc6251d2f9a7c7bfdd2a05f411efaddebb324c9794b0f7c
                                                        • Instruction Fuzzy Hash: E0417078A087518FD744DF29C18091AFBE1FF89350F568A6DE8989B395D730EC81CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,00000000,00000004,?,00000000,1009EC6A,000003E8,?,?,100A014E), ref: 100A1580
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: CurrentThread
                                                        • String ID:
                                                        • API String ID: 2882836952-0
                                                        • Opcode ID: aad5760cf48bfe59ace8456a0545fe3771cbea0c5a493778d31e095d93af85e1
                                                        • Instruction ID: a603e3a71963cb926592ecdf01b935e1f93b8b32596d5f9433372c4bec14c4a6
                                                        • Opcode Fuzzy Hash: aad5760cf48bfe59ace8456a0545fe3771cbea0c5a493778d31e095d93af85e1
                                                        • Instruction Fuzzy Hash: AD31AE75B04612CBDB00EFA8C98439A77E5EBC03E0F598579E8598F249EA75CC40CBD2
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$mv_mallocz
                                                        • String ID:
                                                        • API String ID: 2455733640-0
                                                        • Opcode ID: 9f74527f40638788ac7371101fbd516078908c2a159fba3966d1ad274412a250
                                                        • Instruction ID: 7473898efd5c84ff4cba6f3e963b26fd6c8cdcec3b0c7db7706523d113c4544c
                                                        • Opcode Fuzzy Hash: 9f74527f40638788ac7371101fbd516078908c2a159fba3966d1ad274412a250
                                                        • Instruction Fuzzy Hash: 2B31D074904B11CFD760DF25C88191AB7E0FF89391B168A5DEC999B719E730E880CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strlen$_aligned_reallocmv_freepmv_realloc
                                                        • String ID:
                                                        • API String ID: 895301365-0
                                                        • Opcode ID: 0c29223b98c086e2b46ad98e7ce3030191046c0ef949241b854c2fd3e23e1c87
                                                        • Instruction ID: 2d1e53f319068be23ad8f88d31967b5a2669bada8836d01dcbd6984a06f05035
                                                        • Opcode Fuzzy Hash: 0c29223b98c086e2b46ad98e7ce3030191046c0ef949241b854c2fd3e23e1c87
                                                        • Instruction Fuzzy Hash: 6131BDB99087018FC744CF29C18045AFBE1FF88718F158A6EE889AB311E731E945CF82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ExclusiveLock$AcquireReleasemv_freep
                                                        • String ID:
                                                        • API String ID: 2444013405-0
                                                        • Opcode ID: 69b2e29afcab2b062c2147764c90657bebc76e2e75c4088fc9dd16b63d4a40d8
                                                        • Instruction ID: 7158096d1edc9a63a07daa50029a30cfeb496985ca544081e00db1e7d26d72ff
                                                        • Opcode Fuzzy Hash: 69b2e29afcab2b062c2147764c90657bebc76e2e75c4088fc9dd16b63d4a40d8
                                                        • Instruction Fuzzy Hash: 3421DBB5604701CFD704EF25D5C591ABBF4FF89280F06C969E8898B31AE731E985CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_append_datamv_bprint_escape$mv_bprint_finalizemv_bprint_init
                                                        • String ID:
                                                        • API String ID: 3283265872-0
                                                        • Opcode ID: 40e4fae6fe95c9ae0cafae5e4cfbe44df76d706b7c6edfb7b55f5239210fc438
                                                        • Instruction ID: 90910876c942d1fbafe524e13dc9732c176e9ecd8d18a9c8de127334b5e1fd1f
                                                        • Opcode Fuzzy Hash: 40e4fae6fe95c9ae0cafae5e4cfbe44df76d706b7c6edfb7b55f5239210fc438
                                                        • Instruction Fuzzy Hash: 6121DDB59197059FC350DF28C18025AFBE1FF88354F51892EE99D87351E736E982CB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strlen$_aligned_reallocmv_freepmv_realloc
                                                        • String ID:
                                                        • API String ID: 895301365-0
                                                        • Opcode ID: 04da3bf766d47488039e948dce66939b5b65f249d2add762eec63dcc3e51c44d
                                                        • Instruction ID: 51621a72b6bbd22e45abe63bff26c18dabce81ca6188ceac0dc85253792fa2d5
                                                        • Opcode Fuzzy Hash: 04da3bf766d47488039e948dce66939b5b65f249d2add762eec63dcc3e51c44d
                                                        • Instruction Fuzzy Hash: F121B3B8908712CFCB14DF24C48055AB7E5FF89344F458A5EE9999B305E731EA46CF82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _lock_unlockcalloc
                                                        • String ID:
                                                        • API String ID: 3876498383-0
                                                        • Opcode ID: 357fb2442f9bcdd85ef6b46d033be08ae312da071a22b7525909557a6230c189
                                                        • Instruction ID: 6cddb97a3fd8d0d05461b53b71359434b8c1691dc6b4f2f6cc4d1d10a1eaf7a4
                                                        • Opcode Fuzzy Hash: 357fb2442f9bcdd85ef6b46d033be08ae312da071a22b7525909557a6230c189
                                                        • Instruction Fuzzy Hash: BF115E75544201CFDB40EF78C59071ABBE4FF84250F16896AD98CCF249EB74D840EBA2
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_bprint_escape.MAIN ref: 100122B3
                                                          • Part of subcall function 10009730: mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB
                                                        • mv_bprint_append_data.MAIN ref: 100122CC
                                                        • mv_bprint_escape.MAIN ref: 100122EE
                                                        • mv_bprint_finalize.MAIN ref: 1001231B
                                                        • mv_bprint_append_data.MAIN ref: 1001234B
                                                          • Part of subcall function 10008F30: mv_realloc.MAIN ref: 10008F73
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_append_datamv_bprint_escape$mv_bprint_finalizemv_bprintfmv_realloc
                                                        • String ID:
                                                        • API String ID: 1942445456-0
                                                        • Opcode ID: 5e9e0b7bf5f3d5346bbbc040ec1caf168d6988dfb1b18155a4329e28a55b4eeb
                                                        • Instruction ID: 403ebcfaa7f6bf6d2df9c5cc3f9910434a712b72dc8362acc2447b37bc06364c
                                                        • Opcode Fuzzy Hash: 5e9e0b7bf5f3d5346bbbc040ec1caf168d6988dfb1b18155a4329e28a55b4eeb
                                                        • Instruction Fuzzy Hash: 752199B59183019FD360DF29C08069AFBE1FB89348F50892EE58CC7301E736E981CB46
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_mallocz.MAIN ref: 1008AA02
                                                        • mv_buffer_create.MAIN ref: 1008AA43
                                                          • Part of subcall function 10009E60: mv_mallocz.MAIN ref: 10009E86
                                                          • Part of subcall function 10009E60: mv_mallocz.MAIN ref: 10009EBF
                                                        • mv_frame_new_side_data_from_buf.MAIN ref: 1008AA64
                                                          • Part of subcall function 1001B750: mv_realloc.MAIN(?,?,?,00000000,10011000), ref: 1001B782
                                                          • Part of subcall function 1001B750: mv_mallocz.MAIN(?,?,?,00000000,10011000), ref: 1001B798
                                                        • mv_freep.MAIN ref: 1008AA87
                                                        • mv_buffer_unref.MAIN ref: 1008AA9F
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mallocz$mv_buffer_createmv_buffer_unrefmv_frame_new_side_data_from_bufmv_freepmv_realloc
                                                        • String ID:
                                                        • API String ID: 4079258015-0
                                                        • Opcode ID: db8889515c7f553bd07aa0679fa2a6a29804f1dbc555ffa5fdf3cb394941dbce
                                                        • Instruction ID: b48374cefd5705bd05e398ce965887d68948386aeb5666d67e45d6dee8b3c328
                                                        • Opcode Fuzzy Hash: db8889515c7f553bd07aa0679fa2a6a29804f1dbc555ffa5fdf3cb394941dbce
                                                        • Instruction Fuzzy Hash: 3C1116B09087018FD744DF29C58460BBBE4FF89380F45882EE999CB621E734E985CF52
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$mv_mallocz
                                                        • String ID:
                                                        • API String ID: 2455733640-0
                                                        • Opcode ID: d5c1c30fc960bf7640f1f1bb9a1ad17a8736e34e7bb0e74a488f3468996d7490
                                                        • Instruction ID: e27aaf6f2fbb493ff670743c398b5037914b47ddc08bede214f16f72f1dc21d1
                                                        • Opcode Fuzzy Hash: d5c1c30fc960bf7640f1f1bb9a1ad17a8736e34e7bb0e74a488f3468996d7490
                                                        • Instruction Fuzzy Hash: E50119756097548FC740EFB8D88175AB7E4FF48290F81582DF894C7200EB31E8448B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$mv_buffer_createmv_buffer_refmv_buffer_unrefmv_mallocz
                                                        • String ID:
                                                        • API String ID: 3470597486-0
                                                        • Opcode ID: 3a33ffab89d5aed0bf03c31c6abfb545fd4a93970b8c716d4a66c5e27936259d
                                                        • Instruction ID: ec82959c7a140a0cfaaa292ac1a12e2931abf6bf560108a204ed996edac76e07
                                                        • Opcode Fuzzy Hash: 3a33ffab89d5aed0bf03c31c6abfb545fd4a93970b8c716d4a66c5e27936259d
                                                        • Instruction Fuzzy Hash: D5011D796087808FD740EF34D88161ABBE0FF88248F858D2EE4898B306E631E444CB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _errno$strtol
                                                        • String ID:
                                                        • API String ID: 3596500743-0
                                                        • Opcode ID: 94420cbffd51064d18b4594c717699c8f84a31741584a0f27c6857c5b8a8326f
                                                        • Instruction ID: e5a68f2e7340340f2a0c1abd8e62d28df7ecd48bc61271be75172e8c5bb86d30
                                                        • Opcode Fuzzy Hash: 94420cbffd51064d18b4594c717699c8f84a31741584a0f27c6857c5b8a8326f
                                                        • Instruction Fuzzy Hash: CD01E474A0931A9FD744EF65C88871ABBE2FF85740F55C86DE88987724EB74E8408B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • AcquireSRWLockExclusive.KERNEL32 ref: 1004B02F
                                                        • mv_fifo_can_read.MAIN ref: 1004B03C
                                                        • mv_fifo_read_to_cb.MAIN ref: 1004B066
                                                        • WakeAllConditionVariable.KERNEL32 ref: 1004B071
                                                        • ReleaseSRWLockExclusive.KERNEL32 ref: 1004B07D
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: ExclusiveLock$AcquireConditionReleaseVariableWakemv_fifo_can_readmv_fifo_read_to_cb
                                                        • String ID:
                                                        • API String ID: 93134951-0
                                                        • Opcode ID: b04aa90755bf11445e363e889d079bebaf352ae153b96380cc2547109b9fea1a
                                                        • Instruction ID: f622ea8ca44b4a077811579624edcdfc0bd4128ea1142ae48ea321c74ce907da
                                                        • Opcode Fuzzy Hash: b04aa90755bf11445e363e889d079bebaf352ae153b96380cc2547109b9fea1a
                                                        • Instruction Fuzzy Hash: D5F0B6F5908A109FCB40FF39E5C550ABBE0EF45644F41892DF8898B209E634E595CB93
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8
                                                        • mv_log.MAIN ref: 1002A471
                                                        Strings
                                                        • Value %f for parameter '%s' out of range [%g - %g], xrefs: 1002A44E
                                                        • Value %f for parameter '%s' is not a valid set of 32bit integer flags, xrefs: 1002A41D
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmp$mv_log
                                                        • String ID: Value %f for parameter '%s' is not a valid set of 32bit integer flags$Value %f for parameter '%s' out of range [%g - %g]
                                                        • API String ID: 2835281190-116802341
                                                        • Opcode ID: 0c2f96b72357f92c4ca18961a8f2628428f56dc49a738391d3e7b851953e97bc
                                                        • Instruction ID: 1f9a3ae519994aab547ffbe7134408521fdf083e78839cfb6fd5b55b8ae9f8c9
                                                        • Opcode Fuzzy Hash: 0c2f96b72357f92c4ca18961a8f2628428f56dc49a738391d3e7b851953e97bc
                                                        • Instruction Fuzzy Hash: C3619B35919B45CBC382DF38E48111AFBA6FFDB2E0F91975AF8966A250DB30C4C19742
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_image_get_linesize.MAIN ref: 10020524
                                                          • Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976
                                                        • mv_image_fill_linesizes.MAIN(?), ref: 100205B2
                                                        Strings
                                                        • Picture size %ux%u is invalid, xrefs: 10020635
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_image_fill_linesizesmv_image_get_linesizemv_pix_fmt_desc_get
                                                        • String ID: Picture size %ux%u is invalid
                                                        • API String ID: 547003755-1963597007
                                                        • Opcode ID: 55cc673a7fd8fa65950412ae644b1255500889416eca15a6256c6aad94377d03
                                                        • Instruction ID: 76d0c1c0ea3a07b63bf36c4eb498433e90d4a1915968e7ac4ed20e6f6339bb64
                                                        • Opcode Fuzzy Hash: 55cc673a7fd8fa65950412ae644b1255500889416eca15a6256c6aad94377d03
                                                        • Instruction Fuzzy Hash: 73412576A097508FC350CF29D88074ABBE2FFC8610F558A2EF9A8CB351E634D8418F42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf
                                                        • String ID: @%s
                                                        • API String ID: 3083893021-2921637043
                                                        • Opcode ID: 3226884ed7a48c89542cb2da4cd6bdc3bde8d4d284e963f694dc1568948eeeaa
                                                        • Instruction ID: 3992f4aefadd0f47064a5f8236616475ea9e2f99c0eaa1b511875076a351044c
                                                        • Opcode Fuzzy Hash: 3226884ed7a48c89542cb2da4cd6bdc3bde8d4d284e963f694dc1568948eeeaa
                                                        • Instruction Fuzzy Hash: F32128719087168BE350EF59C48022EF7E1FB98394F12892EE89897315E731ED55CBA2
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log$strcmp
                                                        • String ID: %-15s
                                                        • API String ID: 1163046698-755444208
                                                        • Opcode ID: b29ba3bba20739d572f02bb09815cded5aef70f9b82e404a867a14a708790a90
                                                        • Instruction ID: ce635d268765be07717733ae1f701fccf88d57a4aae717667b6e3b1a655ee8de
                                                        • Opcode Fuzzy Hash: b29ba3bba20739d572f02bb09815cded5aef70f9b82e404a867a14a708790a90
                                                        • Instruction Fuzzy Hash: 8B21B278A093459FCB50DF28E09069EB7E1EF88B80F92C82DE89997351D374E940DB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strtoul$bsearchmv_logstrspn
                                                        • String ID: 0123456789ABCDEFabcdef
                                                        • API String ID: 1580567553-1534423534
                                                        • Opcode ID: abb7986011698c1c1e265c16a005ff9de3de25baebe5d04ef4ccaa8955e208e0
                                                        • Instruction ID: 1049657c988276e6ddf893df4eb424eafbb891710bb151af54785349b2433993
                                                        • Opcode Fuzzy Hash: abb7986011698c1c1e265c16a005ff9de3de25baebe5d04ef4ccaa8955e208e0
                                                        • Instruction Fuzzy Hash: 1E21AF719487C59ED752CF34909171ABBE4EF81380F85CA6FE4899B241E738CD80C712
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmp
                                                        • String ID: ntsc
                                                        • API String ID: 1004003707-2045543799
                                                        • Opcode ID: 45332122925daee58b0ca36453adb93a54a139fa692ca5e16f6db20bb7fad8e3
                                                        • Instruction ID: a92f6e95659317827b4528b13064fbf16e1d4fcf51acc17d8aa5f4157741274d
                                                        • Opcode Fuzzy Hash: 45332122925daee58b0ca36453adb93a54a139fa692ca5e16f6db20bb7fad8e3
                                                        • Instruction Fuzzy Hash: A5111CB4A483829FE300DF69E4C065ABBE5EF85340F95896AF49897361D370EC81DB42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _errno$mv_small_strptime
                                                        • String ID: %M:%S
                                                        • API String ID: 1751681387-2500880230
                                                        • Opcode ID: 0f4dc0b8a2eab276dcd261725bdbf527f7e350a116602d16b17de4fd457b750a
                                                        • Instruction ID: 08dd91ef31b92b14981fe1afeff638f908fd3777591abbf69ec9e5e015226bf1
                                                        • Opcode Fuzzy Hash: 0f4dc0b8a2eab276dcd261725bdbf527f7e350a116602d16b17de4fd457b750a
                                                        • Instruction Fuzzy Hash: 10010C75A05305DFD764DF29D45076EBBE0FB84280F51883EE899C3250EA3098458F92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Error setting option %s to value %s., xrefs: 1002D6F7
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_dict_freemv_dict_getmv_dict_setmv_logmv_opt_set
                                                        • String ID: Error setting option %s to value %s.
                                                        • API String ID: 1354616078-3279051434
                                                        • Opcode ID: be12c7fe19db5ab61db51b4a1bede206e01a94ada12606f0a4e7e7a9321a0867
                                                        • Instruction ID: 6b9ea6aabfc4124447e1f2434b6fc2a42ecd06c72756f075168a49251e9f20a7
                                                        • Opcode Fuzzy Hash: be12c7fe19db5ab61db51b4a1bede206e01a94ada12606f0a4e7e7a9321a0867
                                                        • Instruction Fuzzy Hash: B6017AB9A08304AFC744DF28D48059ABBE0FB88354F10892EF99CD7310E634EA409F86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097AD
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C05
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C65
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf
                                                        • String ID: &amp;$&gt;
                                                        • API String ID: 3083893021-624094588
                                                        • Opcode ID: 3a0184e92dcb7e1e473096fa467e9c05a6d80c2d3150c9be7b04146b26d57726
                                                        • Instruction ID: 4c5438aa6a129c9ce896481cefdf623b6b0dbe5659d14e32da422b5388819884
                                                        • Opcode Fuzzy Hash: 3a0184e92dcb7e1e473096fa467e9c05a6d80c2d3150c9be7b04146b26d57726
                                                        • Instruction Fuzzy Hash: 0EF03071C08B59CADB50EF68855079AB7E5EB853D0F86480EE4DA9B209C734FC86C782
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009A35
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009A7B
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C25
                                                        • mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C45
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprintf
                                                        • String ID: &apos;$&gt;
                                                        • API String ID: 3083893021-1996891769
                                                        • Opcode ID: 42ebd6a35695f5f76d849163282aa4592941da0a2ecac70b33ec663c14a5c16d
                                                        • Instruction ID: 833e2b3188953a1b3be8fb8ff8af71bd57aa8e074cd88eba3086a03673e998a7
                                                        • Opcode Fuzzy Hash: 42ebd6a35695f5f76d849163282aa4592941da0a2ecac70b33ec663c14a5c16d
                                                        • Instruction Fuzzy Hash: 8CF05430C18B59CAD710EF64805076AB7D1EB463C0F868C0EE5D55B209C734B8C2C797
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_stristrmv_uuid_parse_rangestrlen
                                                        • String ID: urn:uuid:
                                                        • API String ID: 1905088648-560508677
                                                        • Opcode ID: c0996147e5801d84dfc9fd88d759a400d8d0d672de9e6cdb5cd08c5e74220e47
                                                        • Instruction ID: 77bc98d95f22fff805a02dd3f8ff758dfa51e570d0101063bf40377ba5083ad9
                                                        • Opcode Fuzzy Hash: c0996147e5801d84dfc9fd88d759a400d8d0d672de9e6cdb5cd08c5e74220e47
                                                        • Instruction Fuzzy Hash: 34F01CB49087518BDA10EF28998100EB6E4FB4A654F17499FF4C9A7302D279D9809B93
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • overriding to %d logical cores, xrefs: 1000F981
                                                        • detected %d logical cores, xrefs: 1000F9B4
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log
                                                        • String ID: detected %d logical cores$overriding to %d logical cores
                                                        • API String ID: 2418673259-3421371979
                                                        • Opcode ID: 0759295ed6044173e9392d2661279fec986e6af074d162e95bf04f3e6d97d716
                                                        • Instruction ID: 4351d7ad1e4b7553753ed5daeab53ed97445378c9d31bf055318a612fe487827
                                                        • Opcode Fuzzy Hash: 0759295ed6044173e9392d2661279fec986e6af074d162e95bf04f3e6d97d716
                                                        • Instruction Fuzzy Hash: A4F06CB0A08341AFD340DF59C09171ABBE0EB88740F90C82EE6D987361D679A9459F87
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_log
                                                        • String ID: Key '%s' not found.
                                                        • API String ID: 2418673259-2052305073
                                                        • Opcode ID: b6e5dbdcddb3e8e537d9606f4ee5ef41b23fddcb67c58fcbb9e80a7253b86ab3
                                                        • Instruction ID: 2935cc58392a1398e58e060f8426a77ac91e2dc20dd80442988a03116b7c0377
                                                        • Opcode Fuzzy Hash: b6e5dbdcddb3e8e537d9606f4ee5ef41b23fddcb67c58fcbb9e80a7253b86ab3
                                                        • Instruction Fuzzy Hash: CBE075755087509FC304DF28E48111EFBE0EF88354F41C82EE5CD97315DA75E4418B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_mul_q.MAIN ref: 10025352
                                                          • Part of subcall function 10032DA0: mv_reduce.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,10025357), ref: 10032DE1
                                                        • mv_rescale_rnd.MAIN ref: 100253F3
                                                        • mv_rescale_rnd.MAIN ref: 10025420
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_rescale_rnd$mv_mul_qmv_reduce
                                                        • String ID:
                                                        • API String ID: 3269292098-0
                                                        • Opcode ID: b50e5d1874e335783e8f5a6a831900d86d3a57486d0b88453f95c6126a562e0d
                                                        • Instruction ID: 7a4d74e7e2a0161bf1f379c5bd56ad13f195e656a433c0a89533b9deccd96d44
                                                        • Opcode Fuzzy Hash: b50e5d1874e335783e8f5a6a831900d86d3a57486d0b88453f95c6126a562e0d
                                                        • Instruction Fuzzy Hash: 8A61B074A097409FC344CF29D48060AFBE1BFC8764F548A2EF8A993360D771E9418F86
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_samples_get_buffer_size.MAIN ref: 1003A34E
                                                        • mv_malloc.MAIN ref: 1003A360
                                                        • mv_samples_fill_arrays.MAIN ref: 1003A396
                                                          • Part of subcall function 1003A1B0: mv_samples_get_buffer_size.MAIN ref: 1003A201
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_samples_get_buffer_size$mv_mallocmv_samples_fill_arrays
                                                        • String ID:
                                                        • API String ID: 3894167361-0
                                                        • Opcode ID: 8d336f63005a17f0ce2746193248b8f2ccff729fc354cbe18226dd819581e305
                                                        • Instruction ID: 29f813314073505780b3b6a0bf21f4ec65a179872cc3375d0f3d993001abd10e
                                                        • Opcode Fuzzy Hash: 8d336f63005a17f0ce2746193248b8f2ccff729fc354cbe18226dd819581e305
                                                        • Instruction Fuzzy Hash: 0A419D75E083018FD705CF29C58460EFBE6EFCA355F55892EE8888B350E7B5E9858B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_image_fill_linesizes.MAIN ref: 1001B0C8
                                                          • Part of subcall function 1001EAB0: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,1001B0CD), ref: 1001EAC6
                                                        • mv_image_fill_plane_sizes.MAIN ref: 1001B15D
                                                        • mv_buffer_alloc.MAIN ref: 1001B1CD
                                                        • mv_image_fill_pointers.MAIN ref: 1001B1FC
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_buffer_allocmv_image_fill_linesizesmv_image_fill_plane_sizesmv_image_fill_pointersmv_pix_fmt_desc_get
                                                        • String ID:
                                                        • API String ID: 2879504290-0
                                                        • Opcode ID: 7341e7224c3c084a21f5b683c78ee4c84bc759b0f2a3afcbc0be0c244e6f78e6
                                                        • Instruction ID: 8f506c5f79b5a5d03f9a5ada546bbcf13e993700c3781cdda1da6b75d303e5b0
                                                        • Opcode Fuzzy Hash: 7341e7224c3c084a21f5b683c78ee4c84bc759b0f2a3afcbc0be0c244e6f78e6
                                                        • Instruction Fuzzy Hash: 4151F9B5608B018FCB48DF69D5D066ABBE1FF88240F15897DE949CB359E731E884CB41
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_strlcatfstrcmp
                                                        • String ID:
                                                        • API String ID: 3138383634-0
                                                        • Opcode ID: e6d04f5b88f278462d021f45b59cfba453c363faba32e7f9e0e655f4c856f37f
                                                        • Instruction ID: 4e00ca5e32ba23cd1f0d150041dade036c75141da2ff9e4549c40cdffe91d108
                                                        • Opcode Fuzzy Hash: e6d04f5b88f278462d021f45b59cfba453c363faba32e7f9e0e655f4c856f37f
                                                        • Instruction Fuzzy Hash: 3C316B75A083968FDB10DF6AE48475BBBE4EF84384F55486EEC9897201D334ED18CB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • IsDBCSLeadByteEx.KERNEL32 ref: 1009D822
                                                        • MultiByteToWideChar.KERNEL32 ref: 1009D865
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: Byte$CharLeadMultiWide
                                                        • String ID:
                                                        • API String ID: 2561704868-0
                                                        • Opcode ID: e06c874c7b0f77f595b58fe30017b44e27d557a91db68f2b64ff68b0ac9c3ef2
                                                        • Instruction ID: b6030a99734b0483f6aa4200c2ea406aadadd20ec724542bcc610d09dc4c1d1f
                                                        • Opcode Fuzzy Hash: e06c874c7b0f77f595b58fe30017b44e27d557a91db68f2b64ff68b0ac9c3ef2
                                                        • Instruction Fuzzy Hash: 8431E2B45093918FD700EF68D58424BBBF0FF85354F00895EE8988B252D7BAD849DB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004D9EA
                                                        • mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004D9F5
                                                        • mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004DA00
                                                        • mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004DA0B
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep
                                                        • String ID:
                                                        • API String ID: 2373662943-0
                                                        • Opcode ID: 7dfa075bf1bdc506961d276955aafd077213c814744881a5db9aafc42121e5d5
                                                        • Instruction ID: 0cb0491cf1fe648b7da9de51e1deb3b3891b8e5c0bd1407a825c4066b1865736
                                                        • Opcode Fuzzy Hash: 7dfa075bf1bdc506961d276955aafd077213c814744881a5db9aafc42121e5d5
                                                        • Instruction Fuzzy Hash: B1219CB5A087618ADB10EF24E8C175A37E5EF40340F6A45BBDC89CB24AE634D950C796
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: clockmv_sha_finalmv_sha_initmv_sha_update
                                                        • String ID:
                                                        • API String ID: 679641161-0
                                                        • Opcode ID: 6f861df05181ea4ff24294a19bc8cb2a57f6845d629d0ae6cd75aa9bb61d67ba
                                                        • Instruction ID: 2963d4e084b8430f89c99bd8ea125613e8711b22e7604053a18660b36ac50186
                                                        • Opcode Fuzzy Hash: 6f861df05181ea4ff24294a19bc8cb2a57f6845d629d0ae6cd75aa9bb61d67ba
                                                        • Instruction Fuzzy Hash: 63218D76A043108FE308EF38CAC424AB7E2EBC8316F95C93DDD889B355DA75D9058B91
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: free
                                                        • String ID:
                                                        • API String ID: 1294909896-0
                                                        • Opcode ID: c948fa845793077111497f2527960b47adc091a50e119db403586e5582924b95
                                                        • Instruction ID: a65262f2a8dc64e3d2e8f10df8af347bd004f4dc4fa9b202cb7ff24efa69f101
                                                        • Opcode Fuzzy Hash: c948fa845793077111497f2527960b47adc091a50e119db403586e5582924b95
                                                        • Instruction Fuzzy Hash: 923149746087428FD710DF65C08469EB7E4FF88348F11496DFAAC97251D730E949DB52
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: free$isspace
                                                        • String ID:
                                                        • API String ID: 976929720-0
                                                        • Opcode ID: fe24054ec7115680a7aba0907deca4313fe60f6a3821cc51ca110f7dcd4ad952
                                                        • Instruction ID: 9a66b9782b17951ee1e90e07e3e5ef4e575e26772417cf8a5ace86cc60e39293
                                                        • Opcode Fuzzy Hash: fe24054ec7115680a7aba0907deca4313fe60f6a3821cc51ca110f7dcd4ad952
                                                        • Instruction Fuzzy Hash: 42211675608B528FD710DF24C08079AB7E0FF84758F16491DEAE8A7221D374F98A9B92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: free$isspace
                                                        • String ID:
                                                        • API String ID: 976929720-0
                                                        • Opcode ID: dac273ccd9a5951a7db9dff5896ff6531715d0d8e536adad97fba163b5a1a0c2
                                                        • Instruction ID: f581656372f63a1c8f88fd144b7300c4eda009a61946b385c261621a1e34703c
                                                        • Opcode Fuzzy Hash: dac273ccd9a5951a7db9dff5896ff6531715d0d8e536adad97fba163b5a1a0c2
                                                        • Instruction Fuzzy Hash: 96211675608B528FD710DF24C08079AB7E0FF84754F16491DFAECA7221D374B94AAB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_hwframe_get_buffer.MAIN ref: 1001E561
                                                          • Part of subcall function 1001E2F0: mv_buffer_ref.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E317
                                                          • Part of subcall function 1001E2F0: mv_frame_alloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E32A
                                                          • Part of subcall function 1001E2F0: mv_hwframe_map.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E36C
                                                          • Part of subcall function 1001E2F0: mv_log.MAIN ref: 1001E396
                                                          • Part of subcall function 1001E2F0: mv_frame_free.MAIN ref: 1001E3A2
                                                        • mv_frame_alloc.MAIN ref: 1001E584
                                                          • Part of subcall function 1001AC40: mv_malloc.MAIN ref: 1001AC56
                                                        • mv_frame_free.MAIN ref: 1001E5CB
                                                        • mv_freep.MAIN ref: 1001E5DC
                                                        • mv_freep.MAIN ref: 1001E61B
                                                        • mv_freep.MAIN ref: 1001E63A
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep$mv_frame_allocmv_frame_free$mv_buffer_refmv_hwframe_get_buffermv_hwframe_mapmv_logmv_malloc
                                                        • String ID:
                                                        • API String ID: 2206481229-0
                                                        • Opcode ID: 25283562a18f3cc925092daff3d8813b508f0ce4e67f46393089d96786ff75ef
                                                        • Instruction ID: ca945ac18ed839ac5bf74ac2fa747fd2f81b9f58e27d0342db77472b587ece54
                                                        • Opcode Fuzzy Hash: 25283562a18f3cc925092daff3d8813b508f0ce4e67f46393089d96786ff75ef
                                                        • Instruction Fuzzy Hash: F42126756087518FD340DF29C880A4EF3E5FF89354F468869E988DB321E770EC858B41
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_fifo_can_read.MAIN ref: 100027C7
                                                        • mv_fifo_can_write.MAIN ref: 100027D6
                                                        • mv_samples_get_buffer_size.MAIN ref: 100027FF
                                                        • mv_fifo_grow2.MAIN ref: 10002833
                                                          • Part of subcall function 10017F70: mv_realloc_array.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002838), ref: 10017FAE
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_fifo_can_readmv_fifo_can_writemv_fifo_grow2mv_realloc_arraymv_samples_get_buffer_size
                                                        • String ID:
                                                        • API String ID: 78108474-0
                                                        • Opcode ID: 0ae8dcb50c524f4d83e5332cc30a05b3d9202b551eefed4852725224eaea7f23
                                                        • Instruction ID: aca124555f9e986d8ecf7dcc78e3baf80687684f5b36e82da0df567b59823915
                                                        • Opcode Fuzzy Hash: 0ae8dcb50c524f4d83e5332cc30a05b3d9202b551eefed4852725224eaea7f23
                                                        • Instruction Fuzzy Hash: 8611E378A093559FD700DF69C58094ABBE4FF88394F01892DFD88CB314E774E9458B92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: Count64ObjectSingleTickWait
                                                        • String ID:
                                                        • API String ID: 3187275320-0
                                                        • Opcode ID: 1cfadcc898e6b36cfd1a4f7bf5837ebdbe6212e429eb6220fca006c3ac279431
                                                        • Instruction ID: 1bf18b280d2744a8743e55954746d7a5a9d8936b65fabab63a36412c31ae482f
                                                        • Opcode Fuzzy Hash: 1cfadcc898e6b36cfd1a4f7bf5837ebdbe6212e429eb6220fca006c3ac279431
                                                        • Instruction Fuzzy Hash: 1201BC32B092548BC700BEBD9CC845EBBE5FBC41A4F808A3DE988C7705E63098088792
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_buffer_alloc.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B7F0
                                                          • Part of subcall function 10009DC0: mv_malloc.MAIN ref: 10009DDC
                                                          • Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009DF2
                                                          • Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009E25
                                                        • mv_realloc.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B820
                                                          • Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB
                                                        • mv_mallocz.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B836
                                                        • mv_buffer_unref.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B87F
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_mallocz$_aligned_reallocmv_buffer_allocmv_buffer_unrefmv_mallocmv_realloc
                                                        • String ID:
                                                        • API String ID: 547404713-0
                                                        • Opcode ID: f53c243b31966ade95df7518ce4c0598c2817321e792378a526fbf3cdf0bd58c
                                                        • Instruction ID: e87e4f9eabebad2ec55774af977a150987189923fc92643a84a7bc33fe8d3c27
                                                        • Opcode Fuzzy Hash: f53c243b31966ade95df7518ce4c0598c2817321e792378a526fbf3cdf0bd58c
                                                        • Instruction Fuzzy Hash: 0011F8B4908B418FD750DF25D48068AFBE4FF48290F55896EE99A9B315EB30E881CB51
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004D9EA
                                                        • mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004D9F5
                                                        • mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004DA00
                                                        • mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004DA0B
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep
                                                        • String ID:
                                                        • API String ID: 2373662943-0
                                                        • Opcode ID: 883756fb135680f02b9e7241d4b82a69b6f557dd1b3e18bc2a7579ac156dc7e8
                                                        • Instruction ID: a4ea76907e77a494ff592404b92edb11bbb38d68de6f5075056f11605139768e
                                                        • Opcode Fuzzy Hash: 883756fb135680f02b9e7241d4b82a69b6f557dd1b3e18bc2a7579ac156dc7e8
                                                        • Instruction Fuzzy Hash: FF1157B5D04B608ADB40EF64E8C135977E4EF05310F5A48BADC85CB38AE739D884C756
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_channel_from_string.MAIN ref: 1000E993
                                                        • strchr.MSVCRT ref: 1000E9C4
                                                        • mv_strlcpy.MAIN ref: 1000E9EF
                                                          • Part of subcall function 100066E0: strlen.MSVCRT ref: 10006726
                                                        • mv_channel_from_string.MAIN ref: 1000EA01
                                                          • Part of subcall function 1000C560: strncmp.MSVCRT ref: 1000C582
                                                          • Part of subcall function 1000C560: strcmp.MSVCRT ref: 1000C5B0
                                                        • strcmp.MSVCRT ref: 1000EA3D
                                                        • mv_channel_from_string.MAIN ref: 1000EA58
                                                        • strcmp.MSVCRT ref: 1000EAA6
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_channel_from_stringstrcmp$mv_strlcpystrchrstrlenstrncmp
                                                        • String ID:
                                                        • API String ID: 886603963-0
                                                        • Opcode ID: 8616275c2150e7efb85d131667853066869ad1c5313a7f24b712379ae3ad5ca6
                                                        • Instruction ID: 573cd39c050991141a6e921ab4fbfb848e83e1f3f19c3e4a32285acdb0885ff6
                                                        • Opcode Fuzzy Hash: 8616275c2150e7efb85d131667853066869ad1c5313a7f24b712379ae3ad5ca6
                                                        • Instruction Fuzzy Hash: AF1136B46087428FDB00DF28C58065ABBE5FF88780F118D2DE5C8EB265E270ED44DB92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: free$isspace
                                                        • String ID:
                                                        • API String ID: 976929720-0
                                                        • Opcode ID: 37b137bf86c7b9fd5c083fa930197be3b6f87acadb63fa94fcfc321b8d9dfeb5
                                                        • Instruction ID: 7cf0f320011b5f61f1ef3f0d1d252dbc84d66aace04f87b5de561192c6a65056
                                                        • Opcode Fuzzy Hash: 37b137bf86c7b9fd5c083fa930197be3b6f87acadb63fa94fcfc321b8d9dfeb5
                                                        • Instruction Fuzzy Hash: BD011779A087018FD710EF75D48035AB3E4FF88764F124A2CFAACA7201D730EA049B91
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_bprint_init.MAIN ref: 10007076
                                                        • mv_bprint_escape.MAIN ref: 100070AA
                                                          • Part of subcall function 10009730: mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB
                                                        • mv_bprint_finalize.MAIN ref: 100070C7
                                                          • Part of subcall function 10009690: mv_realloc.MAIN(?,?,?,?,?,?,10006D57), ref: 100096C9
                                                        • mv_bprint_finalize.MAIN ref: 100070F1
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_finalize$mv_bprint_escapemv_bprint_initmv_bprintfmv_realloc
                                                        • String ID:
                                                        • API String ID: 2707718180-0
                                                        • Opcode ID: 8fcf3987ad7d05698dc9ea44ca5edbe39d28e2b760c260b832d1773102fd6b80
                                                        • Instruction ID: 7786e306f37471b19b8e033861bf3e046f7241f8be26b7eb16500715b45264db
                                                        • Opcode Fuzzy Hash: 8fcf3987ad7d05698dc9ea44ca5edbe39d28e2b760c260b832d1773102fd6b80
                                                        • Instruction Fuzzy Hash: 9F116DB4A093408BD360DF28C18065EBBE0BF88254F908E2DBA9C87345E635A944CB06
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_freep
                                                        • String ID:
                                                        • API String ID: 2373662943-0
                                                        • Opcode ID: 7d849d430b18bd63c2ffebc00fb6b84f710c2797a3bf5240d0040ef1fb02228c
                                                        • Instruction ID: e6160234d2b5473e354702e54758fc74ece171a8690405ef2f617578e500f202
                                                        • Opcode Fuzzy Hash: 7d849d430b18bd63c2ffebc00fb6b84f710c2797a3bf5240d0040ef1fb02228c
                                                        • Instruction Fuzzy Hash: B3E0AE79508B608BC700EF28D88141EB7F0FF89208F854C1DFAC4A7306E635F9448B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: ad5d3dc0fd0cb3ef6d04f562988a8f745905f1efb17a15ffeb54e2807adc24af
                                                        • Instruction ID: 8863fbba633440d1c9bb7560d783c2b2fa1c445144d5959f5dcc9319c98cded4
                                                        • Opcode Fuzzy Hash: ad5d3dc0fd0cb3ef6d04f562988a8f745905f1efb17a15ffeb54e2807adc24af
                                                        • Instruction Fuzzy Hash: A7E075B9508B508FC744EF64D9C101AB7E0FF8C218F86486CEEC46730AE638F9558B92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: _errnolocaleconv
                                                        • String ID: @
                                                        • API String ID: 890718178-2766056989
                                                        • Opcode ID: 87f31d4bc7428a5e780d7db96b519d0f88b83d4e61296ca7e5b1cf395b6e1900
                                                        • Instruction ID: 1adff65aeb5dec3d05c04cddd2872ed229e66694363a5810d246a0a24491e72e
                                                        • Opcode Fuzzy Hash: 87f31d4bc7428a5e780d7db96b519d0f88b83d4e61296ca7e5b1cf395b6e1900
                                                        • Instruction Fuzzy Hash: 87A16874508392CBD760CF24C09079BBBE1EB85754F218A1EE9DC97391D7359A05EB82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        Strings
                                                        • Assertion %s failed at %s:%d, xrefs: 1001F99A
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_get_cpu_flags
                                                        • String ID: Assertion %s failed at %s:%d
                                                        • API String ID: 185405932-2766368343
                                                        • Opcode ID: 7551bec9f1eeb9b50cbb3d7bd5363e3c1abd8a109e782f2c9d38e8ffc4970d7f
                                                        • Instruction ID: 4f99d49389e0e95857478378ad07d1c4ddbe0ca0cbe19b611fff2a9fa084b9f8
                                                        • Opcode Fuzzy Hash: 7551bec9f1eeb9b50cbb3d7bd5363e3c1abd8a109e782f2c9d38e8ffc4970d7f
                                                        • Instruction Fuzzy Hash: 27410575A083419FC700DF58C18162EFBF1FF95740F91892DE9895B311D7B6EA858B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • Assertion %s failed at %s:%d, xrefs: 1001FAB0
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: abortmv_log
                                                        • String ID: Assertion %s failed at %s:%d
                                                        • API String ID: 2075109169-2766368343
                                                        • Opcode ID: 99925a3dfaecbcafd95e37379194f54048025d468bd88c2924350edf8c5203d4
                                                        • Instruction ID: 863fd428840cd462da4e804408d77d29575e174ab1a66922a4b6ae8ce10ff121
                                                        • Opcode Fuzzy Hash: 99925a3dfaecbcafd95e37379194f54048025d468bd88c2924350edf8c5203d4
                                                        • Instruction Fuzzy Hash: 3D317CB5A083418BC714CF10C58112EFBE2FFE1650F96895DE98E4B241D7BAE984DB43
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: fputc$memset
                                                        • String ID: o
                                                        • API String ID: 2944404495-252678980
                                                        • Opcode ID: 1373d73b05fdf106881186494202064314183d0cc506e90ee32ecc42dbec3c5f
                                                        • Instruction ID: ad139c84ee4032cb0745c75e293c42ec59ceabe6979b451a5be0c6555295671d
                                                        • Opcode Fuzzy Hash: 1373d73b05fdf106881186494202064314183d0cc506e90ee32ecc42dbec3c5f
                                                        • Instruction Fuzzy Hash: B1311876A04206CFCB15CF68C58479ABBF2FF88380F168659D98DAB351E734E940EB40
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_image_get_linesize.MAIN ref: 1001F6E3
                                                          • Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976
                                                        Strings
                                                        • Picture size %ux%u is invalid, xrefs: 1001F76D
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_image_get_linesizemv_pix_fmt_desc_get
                                                        • String ID: Picture size %ux%u is invalid
                                                        • API String ID: 645864070-1963597007
                                                        • Opcode ID: bffdba0522676a7119fbd8fb8b2c8a2483aa10af2a0b965411779b3daaf4d02a
                                                        • Instruction ID: 48c45da9e3d96b5e90a1d1455c756ac50fe1bc564d21c4e887ebdd33d9096bef
                                                        • Opcode Fuzzy Hash: bffdba0522676a7119fbd8fb8b2c8a2483aa10af2a0b965411779b3daaf4d02a
                                                        • Instruction Fuzzy Hash: 51213D75A083558FC304CF69C08021EFBE1FBC8710F658A2EF99897390EBB1E9458B46
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: fputc
                                                        • String ID: @
                                                        • API String ID: 1992160199-2766056989
                                                        • Opcode ID: ddbe921fc933a0b388eeef67dc39fb76b3fd1d74e2a72d8bf4d74865a2920ba7
                                                        • Instruction ID: cf90b192445e0a6cb44dcd0b4b3e915d1c15c70e7e6222fd19e49ba899a06b57
                                                        • Opcode Fuzzy Hash: ddbe921fc933a0b388eeef67dc39fb76b3fd1d74e2a72d8bf4d74865a2920ba7
                                                        • Instruction Fuzzy Hash: CA11F6B2905A058BCB05CF28C184789BBE2FB89744F268259ED8D9F34AD334EC00EB54
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_parse_video_sizestrcmp
                                                        • String ID: none
                                                        • API String ID: 3218284479-2140143823
                                                        • Opcode ID: 84f624393dde609fecd91fcb81b813e84baa12488068a8de4cf90aaac65596b6
                                                        • Instruction ID: 729e6b95738b9364faedc3518f6085fbd91f0b578ed6da749226210f4fcd2ad2
                                                        • Opcode Fuzzy Hash: 84f624393dde609fecd91fcb81b813e84baa12488068a8de4cf90aaac65596b6
                                                        • Instruction Fuzzy Hash: C501AF756493819BC780DF28E58141ABBE0EF88780FD58C3EB999C7611E734ED50DB52
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8
                                                        • mv_log.MAIN ref: 1002B909
                                                        Strings
                                                        • pixel, xrefs: 1002B8F9
                                                        • The value for option '%s' is not a %s format., xrefs: 1002B8E3
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmp$mv_log
                                                        • String ID: The value for option '%s' is not a %s format.$pixel
                                                        • API String ID: 2835281190-1801304947
                                                        • Opcode ID: e11b65e06b6ff3f522415558f7f655b812ad7cc3f6f8f44e6a5f87898257d26e
                                                        • Instruction ID: 81a977f13b7eab3a7f73a45e2267e6bafa0d1da5cfeb87ddfd4a13f4960ac526
                                                        • Opcode Fuzzy Hash: e11b65e06b6ff3f522415558f7f655b812ad7cc3f6f8f44e6a5f87898257d26e
                                                        • Instruction Fuzzy Hash: 0B01A2786087418FC340CF29D08091AB7F1FBC9250F91892EE99887351D735DD859B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8
                                                        • mv_log.MAIN ref: 1002B989
                                                        Strings
                                                        • The value for option '%s' is not a %s format., xrefs: 1002B963
                                                        • sample, xrefs: 1002B979
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmp$mv_log
                                                        • String ID: The value for option '%s' is not a %s format.$sample
                                                        • API String ID: 2835281190-3983800382
                                                        • Opcode ID: ec28a4045ceb146e725bc9fee1ba0b9711b2358affd951b1a63fd3584c48ff2b
                                                        • Instruction ID: 165b06202dc9305b22196fa44e07fb86eddec9d76e15cbfd607819d9a995c42f
                                                        • Opcode Fuzzy Hash: ec28a4045ceb146e725bc9fee1ba0b9711b2358affd951b1a63fd3584c48ff2b
                                                        • Instruction Fuzzy Hash: FD01C078608B418FC350CF29D080A1AB7F2FBCA350F91892DFA988B351D735DD859B42
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_bprint_init_for_buffermv_bprintf
                                                        • String ID: none
                                                        • API String ID: 2490314137-2140143823
                                                        • Opcode ID: 44bfa67158831aa083f8cc1da789653ca32cdf6bd98319aefa498c906f6f28ff
                                                        • Instruction ID: ef26fa46dfb025d24f9aeb391b3245028a50c27fa559dbd60d9f836e91f94d6c
                                                        • Opcode Fuzzy Hash: 44bfa67158831aa083f8cc1da789653ca32cdf6bd98319aefa498c906f6f28ff
                                                        • Instruction Fuzzy Hash: E60136B5904B568BD720DF24D880B9BB3E4FFC4394F52492DEA9853245D330BD858B97
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
                                                          • Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8
                                                        • mv_channel_layout_copy.MAIN ref: 1002BA6D
                                                        • mv_log.MAIN ref: 1002BAA1
                                                        Strings
                                                        • The value for option '%s' is not a channel layout., xrefs: 1002BA88
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: strcmp$mv_channel_layout_copymv_log
                                                        • String ID: The value for option '%s' is not a channel layout.
                                                        • API String ID: 3662905369-3477801521
                                                        • Opcode ID: 471cd88609156a8107d00b70eb431ac1533a30dc763dbf71cc828c1ee9b289ce
                                                        • Instruction ID: a4738fb313bc9bb28b9f10f0556689a5b5dd38b8270a41f3b8276b00c034be88
                                                        • Opcode Fuzzy Hash: 471cd88609156a8107d00b70eb431ac1533a30dc763dbf71cc828c1ee9b289ce
                                                        • Instruction Fuzzy Hash: 74019D78A097019FC784DF29E081A1EB7E1EFC8750F81892DF8D987355EA74E9849B43
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_strdup.MAIN ref: 1002AE5C
                                                          • Part of subcall function 100267C0: strlen.MSVCRT ref: 100267DE
                                                          • Part of subcall function 100267C0: _aligned_realloc.MSVCRT ref: 10026805
                                                        • mv_strdup.MAIN ref: 1002AE9D
                                                        • mv_get_pix_fmt_name.MAIN ref: 1002B0A5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_strdup$_aligned_reallocmv_get_pix_fmt_namestrlen
                                                        • String ID: none
                                                        • API String ID: 1590616525-2140143823
                                                        • Opcode ID: b294c5a8c65fd7395aa3be69607baeaa27a66f6b1d0d3b6513df14421a8e1872
                                                        • Instruction ID: 0d6bc99ecbd7f612be6a0bf6eac545e310f060afd60664256324de9b27112373
                                                        • Opcode Fuzzy Hash: b294c5a8c65fd7395aa3be69607baeaa27a66f6b1d0d3b6513df14421a8e1872
                                                        • Instruction Fuzzy Hash: 9EF0B6785087518FD760DB64945075EB7E0FF88300FA1882AED98A7301E634E9559B92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_strdup.MAIN ref: 1002AE5C
                                                          • Part of subcall function 100267C0: strlen.MSVCRT ref: 100267DE
                                                          • Part of subcall function 100267C0: _aligned_realloc.MSVCRT ref: 10026805
                                                        • mv_strdup.MAIN ref: 1002AE9D
                                                        • mv_get_sample_fmt_name.MAIN ref: 1002B085
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_strdup$_aligned_reallocmv_get_sample_fmt_namestrlen
                                                        • String ID: none
                                                        • API String ID: 2342221411-2140143823
                                                        • Opcode ID: 0b516a2da8f1af9e55d9d15c0199d5e67172dab74c125b6f9c68ae81825cd705
                                                        • Instruction ID: 5fee32d5547f3127f63c377983f0a0c76c391dad5c7b300539e2ac3540c0e873
                                                        • Opcode Fuzzy Hash: 0b516a2da8f1af9e55d9d15c0199d5e67172dab74c125b6f9c68ae81825cd705
                                                        • Instruction Fuzzy Hash: 0DF0B2785087518FD760DB24E84075EB7E0EB88200FA1882AE9C8A7301EA34E9558B92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: abortmv_log
                                                        • String ID: n
                                                        • API String ID: 2075109169-2013832146
                                                        • Opcode ID: 305f50042675133581abc84f0ac8aeb4db4ebd802b12af6a6ddaca597f7b3ecb
                                                        • Instruction ID: 9cd627dcd14046b22d08c3e5956b6159e380adc9b031ccf81193a127ca12455e
                                                        • Opcode Fuzzy Hash: 305f50042675133581abc84f0ac8aeb4db4ebd802b12af6a6ddaca597f7b3ecb
                                                        • Instruction Fuzzy Hash: A8E012B88093818AC340EF28C64220FBBE0EB85640F848D5DF499C7200EBB98A948B53
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        • mv_strlcatf.MAIN ref: 10012429
                                                          • Part of subcall function 100067F0: strlen.MSVCRT ref: 1000680A
                                                        • mv_dict_set.MAIN ref: 1001244D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_dict_setmv_strlcatfstrlen
                                                        • String ID: .%06dZ
                                                        • API String ID: 1014950348-3752268379
                                                        • Opcode ID: 0fcd152bd701cbbf5cc4896f3278894f4415348b4f9091eae84d680c15830739
                                                        • Instruction ID: 22fa46e81f10ce603b991d120468da5a27ef3793c7905e7972ce2945146385a5
                                                        • Opcode Fuzzy Hash: 0fcd152bd701cbbf5cc4896f3278894f4415348b4f9091eae84d680c15830739
                                                        • Instruction Fuzzy Hash: 4BE04EB5908740AFD714DF29E48175ABBE0FB88354F51C82EA49CD7306D63898518B46
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • The hardware pixel format '%s' is not supported by the device type '%s', xrefs: 1001E663
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_callocmv_frame_allocmv_frame_freemv_freepmv_get_pix_fmt_namemv_image_check_sizemv_log
                                                        • String ID: The hardware pixel format '%s' is not supported by the device type '%s'
                                                        • API String ID: 473889652-379977042
                                                        • Opcode ID: f3e8bdb9d7c170bdc459c1ee668fdc6473492807cb8fec2a19448897106cc44b
                                                        • Instruction ID: 2c6a83db8df34ec64cc29cb3759a8fadaa61080bb751505f1c4c7e836789d21e
                                                        • Opcode Fuzzy Hash: f3e8bdb9d7c170bdc459c1ee668fdc6473492807cb8fec2a19448897106cc44b
                                                        • Instruction Fuzzy Hash: A2F022786047418FC710DF29C08051EBBE0EB4D760F558A5DEAE99B391D774EC809B92
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Strings
                                                        • The hardware pixel format '%s' is not supported by the device type '%s', xrefs: 1001E663
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: mv_get_pix_fmt_namemv_log
                                                        • String ID: The hardware pixel format '%s' is not supported by the device type '%s'
                                                        • API String ID: 3418758923-379977042
                                                        • Opcode ID: 29ee3040ede78108e4cc3fd02deb21ab80279a55efe4e481cb1b1b588cc07577
                                                        • Instruction ID: 525b23ace38b9bb6834e06c5e8b4b181dd8ba8557f5f50a91c42102dc809ce23
                                                        • Opcode Fuzzy Hash: 29ee3040ede78108e4cc3fd02deb21ab80279a55efe4e481cb1b1b588cc07577
                                                        • Instruction Fuzzy Hash: 36E02DB89187409FC710DF29808121EBBE0FB49710F51CD2EA9E89B341D774E8809B82
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000007.00000002.1072127907.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true
                                                        • Associated: 00000007.00000002.1072123561.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072229823.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072236585.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072261247.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072270005.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072276196.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
                                                        • Associated: 00000007.00000002.1072309185.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                        • String ID:
                                                        • API String ID: 682475483-0
                                                        • Opcode ID: 08e83d7a8b309bb27f33bcb565ca26a80b3f8e398a714c744f86402301243d9a
                                                        • Instruction ID: 75efdd3623e0d03d8c836b031dcd533682d24787f7fc8771eedf31777a92f740
                                                        • Opcode Fuzzy Hash: 08e83d7a8b309bb27f33bcb565ca26a80b3f8e398a714c744f86402301243d9a
                                                        • Instruction Fuzzy Hash: BCF0AFB69053619FC700BF78C9C890A7BA8FB44740B460578DD8847719E734EC45CBA3
                                                        Uniqueness

                                                        Uniqueness Score: -1.00%