Edit tour

Windows Analysis Report
5q4psw.msi

Overview

General Information

Sample Name:	5q4psw.msi
Analysis ID:	878635
MD5:	e35727b10193fe55df216a1f9d166997
SHA1:	9ddafa77fc9fdea0085e41aa0f3a1ee0d15d9c8a
SHA256:	696156d9a4117cba652b18b012db376fddfbd7db8b26a638c760d61b98d3590d
Tags:	msi
Infos:

Detection

Qbot

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Qbot

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory in foreign processes

Injects a PE file into a foreign processes

C2 URLs / IPs found in malware configuration

Sample uses string decryption to hide its real strings

Potentially malicious time measurement code found

May use bcdedit to modify the Windows boot settings

Queries the volume information (name, serial number etc) of a device

Yara signature match

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Found inlined nop instructions (likely shell or obfuscated code)

Modifies existing windows services

PE file contains an invalid checksum

Drops PE files

Contains functionality to read the PEB

Connects to several IPs in different countries

Launches processes in debugging mode, may be used to hinder debugging

Checks for available system drives (often done to infect USB drives)

Creates or modifies windows services

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w7x64

msiexec.exe (PID: 2372 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\5q4psw.msi" MD5: AC2E7152124CEED36846BD1B6592A00F)

msiexec.exe (PID: 684 cmdline: C:\Windows\system32\msiexec.exe /V MD5: AC2E7152124CEED36846BD1B6592A00F)

rundll32.exe (PID: 3380 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: DD81D91FF3B0763C392422865C9AC12E)

rundll32.exe (PID: 3396 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: 51138BEEA3E2C21EC44D0932C71762A8)

wermgr.exe (PID: 3476 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: C9905EA4C326DAB778B9297BA5BD1889)

wscript.exe (PID: 3388 cmdline: wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs MD5: 045451FA238A75305CC26AC982472367)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
QakBot, qbotQbot	QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.	GOLD CABIN	http://contagiodump.blogspot.com/2010/11/template.html http://www.secureworks.com/research/threat-profiles/gold-lagoon http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7 https://asec.ahnlab.com/en/44662/	https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot

Malware Configuration

Threatname: Qbot

{"Bot id": "obama265", "Campaign": "1685436052", "Version": "404.1320", "C2 list": ["103.42.86.42:995", "174.4.89.3:443", "161.142.103.187:995", "78.160.146.127:443", "84.35.26.14:995", "12.172.173.82:20", "70.28.50.223:2078", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "103.123.223.133:443", "94.207.104.225:443", "89.114.140.100:443", "213.64.33.61:2222", "86.176.144.234:2222", "72.134.124.16:443", "47.34.30.133:443", "109.50.149.241:2222", "85.104.105.67:443", "81.111.108.123:443", "86.173.2.12:2222", "188.28.19.84:443", "41.228.224.161:995", "12.172.173.82:50001", "178.175.187.254:443", "65.95.141.84:2222", "205.237.67.69:995", "83.110.223.61:443", "193.253.100.236:2222", "27.0.48.233:443", "102.159.188.125:443", "71.38.155.217:443", "58.186.75.42:443", "76.178.148.107:2222", "70.28.50.223:2087", "114.143.176.236:443", "51.14.29.227:2222", "59.28.84.65:443", "173.88.135.179:443", "103.144.201.56:2078", "96.87.28.170:2222", "105.184.103.97:995", "176.142.207.63:443", "151.62.238.176:443", "12.172.173.82:32101", "122.186.210.254:443", "82.125.44.236:2222", "84.108.200.161:443", "76.16.49.134:443", "70.28.50.223:32100", "12.172.173.82:465", "76.170.252.153:995", "184.182.66.109:443", "78.92.133.215:443", "50.68.204.71:993", "186.75.95.6:443", "113.11.92.30:443", "70.28.50.223:3389", "98.145.23.67:443", "85.57.212.13:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "69.242.31.249:443", "81.101.185.146:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "86.195.14.72:2222", "81.229.117.95:2222", "220.240.164.182:443", "73.29.92.128:443", "12.172.173.82:21", "96.56.197.26:2222", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "124.122.47.148:443", "122.184.143.86:443", "92.186.69.229:2222", "70.28.50.223:2083", "89.129.109.27:2222", "147.147.30.126:2222", "125.99.76.102:443", "88.126.94.4:50000", "151.65.167.77:443", "86.132.236.117:443", "92.154.17.149:2222", "223.166.13.95:995", "89.36.206.69:995", "96.56.197.26:2083", "78.18.105.11:443", "82.127.153.75:2222", "90.78.147.141:2222", "82.131.141.209:443", "183.87.163.165:443", "92.9.45.20:2222", "80.6.50.34:443", "80.12.88.148:2222", "69.133.162.35:443", "172.115.17.50:443", "95.45.50.93:2222", "12.172.173.82:2087", "103.140.174.20:2222", "24.198.114.130:995", "50.68.204.71:443", "69.119.123.159:2222", "64.121.161.102:443", "2.82.8.80:443", "184.181.75.148:443", "70.112.206.5:443", "198.2.51.242:993", "2.36.64.159:2078", "79.77.142.22:2222", "84.215.202.8:443", "147.219.4.194:443", "116.74.164.81:443", "70.28.50.223:2078"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.1048899180.000000000257D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000007.00000002.1048686575.000000000038D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
decrypted.memstr	JoeSecurity_Qbot	Yara detected Qbot	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.rundll32.exe.39a328.1.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xdf71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0x9b97:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
7.2.rundll32.exe.39a328.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
7.2.rundll32.exe.180000.0.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
7.2.rundll32.exe.180000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
7.2.rundll32.exe.39a328.1.raw.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
7.2.rundll32.exe.39a328.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000007.00000002.1048686575.000000000038D000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Qbot {"Bot id": "obama265", "Campaign": "1685436052", "Version": "404.1320", "C2 list": ["103.42.86.42:995", "174.4.89.3:443", "161.142.103.187:995", "78.160.146.127:443", "84.35.26.14:995", "12.172.173.82:20", "70.28.50.223:2078", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "103.123.223.133:443", "94.207.104.225:443", "89.114.140.100:443", "213.64.33.61:2222", "86.176.144.234:2222", "72.134.124.16:443", "47.34.30.133:443", "109.50.149.241:2222", "85.104.105.67:443", "81.111.108.123:443", "86.173.2.12:2222", "188.28.19.84:443", "41.228.224.161:995", "12.172.173.82:50001", "178.175.187.254:443", "65.95.141.84:2222", "205.237.67.69:995", "83.110.223.61:443", "193.253.100.236:2222", "27.0.48.233:443", "102.159.188.125:443", "71.38.155.217:443", "58.186.75.42:443", "76.178.148.107:2222", "70.28.50.223:2087", "114.143.176.236:443", "51.14.29.227:2222", "59.28.84.65:443", "173.88.135.179:443", "103.144.201.56:2078", "96.87.28.170:2222", "105.184.103.97:995", "176.142.207.63:443", "151.62.238.176:443", "12.172.173.82:32101", "122.186.210.254:443", "82.125.44.236:2222", "84.108.200.161:443", "76.16.49.134:443", "70.28.50.223:32100", "12.172.173.82:465", "76.170.252.153:995", "184.182.66.109:443", "78.92.133.215:443", "50.68.204.71:993", "186.75.95.6:443", "113.11.92.30:443", "70.28.50.223:3389", "98.145.23.67:443", "85.57.212.13:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "12.172.173.82:22", "69.242.31.249:443", "81.101.185.146:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "86.195.14.72:2222", "81.229.117.95:2222", "220.240.164.182:443", "73.29.92.128:443", "12.172.173.82:21", "96.56.197.26:2222", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "124.122.47.148:443", "122.184.143.86:443", "92.186.69.229:2222", "70.28.50.223:2083", "89.129.109.27:2222", "147.147.30.126:2222", "125.99.76.102:443", "88.126.94.4:50000", "151.65.167.77:443", "86.132.236.117:443", "92.154.17.149:2222", "223.166.13.95:995", "89.36.206.69:995", "96.56.197.26:2083", "78.18.105.11:443", "82.127.153.75:2222", "90.78.147.141:2222", "82.131.141.209:443", "183.87.163.165:443", "92.9.45.20:2222", "80.6.50.34:443", "80.12.88.148:2222", "69.133.162.35:443", "172.115.17.50:443", "95.45.50.93:2222", "12.172.173.82:2087", "103.140.174.20:2222", "24.198.114.130:995", "50.68.204.71:443", "69.119.123.159:2222", "64.121.161.102:443", "2.82.8.80:443", "184.181.75.148:443", "70.112.206.5:443", "198.2.51.242:993", "2.36.64.159:2078", "79.77.142.22:2222", "84.215.202.8:443", "147.219.4.194:443", "116.74.164.81:443", "70.28.50.223:2078"]}

Sample uses string decryption to hide its real strings

Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: netstat -nao
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: runas
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ipconfig /all
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: net localgroup
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: nltest /domain_trusts /all_trusts
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %s %04x.%u %04x.%u res: %s seh_test: %u consts_test: %d vmdetected: %d createprocess: %d
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Microsoft
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SELF_TEST_1
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: p%08x
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Self test FAILED!!!
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Self test OK.
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: /t5
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: whoami /all
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: cmd
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: microsoft.com,google.com,cisco.com,oracle.com,verisign.com,broadcom.com,yahoo.com,xfinity.com,irs.gov,linkedin.com
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: ERROR_INSUFFICIENT_BUFFER
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: route print
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: .lnk
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: "%s\system32\schtasks.exe" /Create /ST %02u:%02u /RU "NT AUTHORITY\SYSTEM" /SC ONCE /tr "%s" /Z /ET %02u:%02u /tn %s
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: arp -a
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %s "$%s = \"%s\"; & $%s"
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: net share
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: cmd.exe /c set
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Self check
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %u;%u;%u;
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: /c ping.exe -n 6 127.0.0.1 & type "%s\System32\calc.exe" > "%s"
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ProfileImagePath
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: at.exe %u:%u "%s" /I
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ProgramData
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Self check ok!
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: powershell.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: qwinsta
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: net view
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%s
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Component_08
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Start screenshot
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: schtasks.exe /Delete /F /TN %u
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: appidapi.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %s \"$%s = \\\"%s\\\\; & $%s\"
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: c:\ProgramData
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Component_07
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: powershell.exe -encodedCommand %S
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: %u
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: powershell.exe -encodedCommand
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: \System32\WindowsPowerShell\v1.0\powershell.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN %u /TR "%s" /NP /F
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: netstat -nao
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: runas
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ipconfig /all
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SystemRoot
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: cscript.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: C:\INTERNAL\__empty
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: .dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_PhysicalMemory
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ALLUSERSPROFILE
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: image/jpeg
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: LocalLow
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: displayName
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: shlwapi.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: CommandLine
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: kernel32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SubmitSamplesConsent
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: 1234567890
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: wbj.go
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_DiskDrive
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: System32
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Name
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: WRSA.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: c:\\
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SpyNetReporting
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: FALSE
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: aswhookx.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Packages
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: application/x-shockwave-flash
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: RepUx.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Winsta0
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: avp.exe;kavtray.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: root\SecurityCenter2
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: MsMpEng.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: userenv.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: csc_ui.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: \\.\pipe\
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: pstorec.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: NTUSER.DAT
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: from
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: netapi32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: gdi32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: setupapi.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: iphlpapi.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Caption
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: CrAmTray.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_ComputerSystem
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: user32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: \sf2.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: egui.exe;ekrn.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Software\Microsoft
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %S.%06d
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: bcrypt.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: wtsapi32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: shell32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: TRUE
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_Bios
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: c:\hiberfil.sysss
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: /
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ByteFence.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: type=0x%04X
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: snxhk_border_mywnd
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ROOT\CIMV2
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: https
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: fshoster32.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: kernelbase.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: regsvr32.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %s\system32\
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_Process
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: rundll32.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: LOCALAPPDATA
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: cmd.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: APPDATA
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: select
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: .exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: mcshield.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: advapi32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ws2_32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: .cfg
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_Product
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: WQL
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: wininet.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: LastBootUpTime
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: urlmon.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Create
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_PnPEntity
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Initializing database...
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: winsta0\default
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: .dat
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: WBJ_IGNORE
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: next
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: wpcap.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: image/pjpeg
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: fmon.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: vbs
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: aswhooka.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SysWOW64
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: mpr.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: image/gif
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: crypt32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ntdll.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: open
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SystemRoot
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: cscript.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: C:\INTERNAL\__empty
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: .dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_PhysicalMemory
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ALLUSERSPROFILE
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: image/jpeg
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: LocalLow
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: displayName
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: shlwapi.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: CommandLine
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: kernel32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SubmitSamplesConsent
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: 1234567890
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: wbj.go
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_DiskDrive
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: System32
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Name
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: WRSA.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: c:\\
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SpyNetReporting
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: FALSE
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: aswhookx.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Packages
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: application/x-shockwave-flash
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: RepUx.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Winsta0
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: avp.exe;kavtray.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: root\SecurityCenter2
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: MsMpEng.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: userenv.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: csc_ui.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: \\.\pipe\
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: pstorec.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: NTUSER.DAT
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: from
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: netapi32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: gdi32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: setupapi.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: iphlpapi.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Caption
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: CrAmTray.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_ComputerSystem
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: user32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: \sf2.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: egui.exe;ekrn.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Software\Microsoft
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %S.%06d
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: bcrypt.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: wtsapi32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: shell32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: TRUE
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_Bios
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: c:\hiberfil.sysss
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: /
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ByteFence.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: type=0x%04X
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: snxhk_border_mywnd
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ROOT\CIMV2
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: https
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: fshoster32.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: kernelbase.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: regsvr32.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %s\system32\
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_Process
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: rundll32.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: LOCALAPPDATA
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: cmd.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: APPDATA
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: select
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: .exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: mcshield.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: advapi32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ws2_32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: .cfg
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_Product
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: WQL
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: wininet.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: LastBootUpTime
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: urlmon.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Create
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Win32_PnPEntity
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Initializing database...
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: winsta0\default
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: .dat
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: WBJ_IGNORE
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: next
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: wpcap.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: image/pjpeg
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: fmon.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: vbs
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: aswhooka.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: SysWOW64
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: mpr.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: image/gif
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: crypt32.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: ntdll.dll
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: open
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 7.2.rundll32.exe.180000.0.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000C0B0 mv_cast5_crypt2,	7_2_1000C0B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000B0D0 mv_camellia_crypt,	7_2_1000B0D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10013100 mv_encryption_init_info_alloc,mv_mallocz,mv_mallocz,mv_mallocz,mv_mallocz,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_calloc,	7_2_10013100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000C1B0 mv_cast5_crypt,	7_2_1000C1B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100132D0 mv_encryption_init_info_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,mv_free,	7_2_100132D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002480 mv_aes_ctr_crypt,mv_aes_crypt,	7_2_10002480
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10013480 mv_encryption_init_info_get_side_data,mv_encryption_init_info_alloc,mv_free,mv_free,mv_free,mv_free,mv_free,	7_2_10013480
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100084B0 mv_blowfish_crypt,mv_blowfish_crypt_ecb,mv_blowfish_crypt_ecb,	7_2_100084B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10032510 mv_get_random_seed,BCryptOpenAlgorithmProvider,BCryptGenRandom,BCryptCloseAlgorithmProvider,mvpriv_open,_read,_close,mvpriv_open,_read,_close,clock,clock,mv_sha_init,mv_sha_update,mv_sha_final,mv_log,abort,	7_2_10032510
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002523 mv_aes_crypt,	7_2_10002523
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004D590 mv_twofish_crypt,	7_2_1004D590
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001363B mv_encryption_init_info_alloc,	7_2_1001363B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000867B mv_blowfish_crypt_ecb,	7_2_1000867B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100136FB mv_encryption_init_info_alloc,	7_2_100136FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10013860 mv_encryption_init_info_add_side_data,mv_malloc,mv_malloc,	7_2_10013860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004A990 mv_tea_crypt,	7_2_1004A990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100339C0 mv_rc4_crypt,	7_2_100339C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10012A70 mv_encryption_info_alloc,mv_mallocz,mv_mallocz,mv_mallocz,mv_calloc,mv_free,mv_free,mv_free,mv_free,	7_2_10012A70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10012B40 mv_encryption_info_clone,mv_encryption_info_alloc,	7_2_10012B40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10001BF0 mv_aes_crypt,	7_2_10001BF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1008DCB0 mv_xtea_crypt,	7_2_1008DCB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10012CF0 mv_encryption_info_free,mv_free,mv_free,mv_free,	7_2_10012CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10012D40 mv_encryption_info_get_side_data,mv_encryption_info_alloc,	7_2_10012D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10007DC0 mv_blowfish_crypt_ecb,	7_2_10007DC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1008DDF0 mv_xtea_le_crypt,	7_2_1008DDF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10010E40 mv_des_crypt,	7_2_10010E40

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then push ebx		7_2_1008B470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]		7_2_1008B700

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 103.42.86.42:995
Source: Malware configuration extractor	IPs: 174.4.89.3:443
Source: Malware configuration extractor	IPs: 161.142.103.187:995
Source: Malware configuration extractor	IPs: 78.160.146.127:443
Source: Malware configuration extractor	IPs: 84.35.26.14:995
Source: Malware configuration extractor	IPs: 12.172.173.82:20
Source: Malware configuration extractor	IPs: 70.28.50.223:2078
Source: Malware configuration extractor	IPs: 124.149.143.189:2222
Source: Malware configuration extractor	IPs: 70.160.67.203:443
Source: Malware configuration extractor	IPs: 186.64.67.30:443
Source: Malware configuration extractor	IPs: 103.123.223.133:443
Source: Malware configuration extractor	IPs: 94.207.104.225:443
Source: Malware configuration extractor	IPs: 89.114.140.100:443
Source: Malware configuration extractor	IPs: 213.64.33.61:2222
Source: Malware configuration extractor	IPs: 86.176.144.234:2222
Source: Malware configuration extractor	IPs: 72.134.124.16:443
Source: Malware configuration extractor	IPs: 47.34.30.133:443
Source: Malware configuration extractor	IPs: 109.50.149.241:2222
Source: Malware configuration extractor	IPs: 85.104.105.67:443
Source: Malware configuration extractor	IPs: 81.111.108.123:443
Source: Malware configuration extractor	IPs: 86.173.2.12:2222
Source: Malware configuration extractor	IPs: 188.28.19.84:443
Source: Malware configuration extractor	IPs: 41.228.224.161:995
Source: Malware configuration extractor	IPs: 12.172.173.82:50001
Source: Malware configuration extractor	IPs: 178.175.187.254:443
Source: Malware configuration extractor	IPs: 65.95.141.84:2222
Source: Malware configuration extractor	IPs: 205.237.67.69:995
Source: Malware configuration extractor	IPs: 83.110.223.61:443
Source: Malware configuration extractor	IPs: 193.253.100.236:2222
Source: Malware configuration extractor	IPs: 27.0.48.233:443
Source: Malware configuration extractor	IPs: 102.159.188.125:443
Source: Malware configuration extractor	IPs: 71.38.155.217:443
Source: Malware configuration extractor	IPs: 58.186.75.42:443
Source: Malware configuration extractor	IPs: 76.178.148.107:2222
Source: Malware configuration extractor	IPs: 70.28.50.223:2087
Source: Malware configuration extractor	IPs: 114.143.176.236:443
Source: Malware configuration extractor	IPs: 51.14.29.227:2222
Source: Malware configuration extractor	IPs: 59.28.84.65:443
Source: Malware configuration extractor	IPs: 173.88.135.179:443
Source: Malware configuration extractor	IPs: 103.144.201.56:2078
Source: Malware configuration extractor	IPs: 96.87.28.170:2222
Source: Malware configuration extractor	IPs: 105.184.103.97:995
Source: Malware configuration extractor	IPs: 176.142.207.63:443
Source: Malware configuration extractor	IPs: 151.62.238.176:443
Source: Malware configuration extractor	IPs: 12.172.173.82:32101
Source: Malware configuration extractor	IPs: 122.186.210.254:443
Source: Malware configuration extractor	IPs: 82.125.44.236:2222
Source: Malware configuration extractor	IPs: 84.108.200.161:443
Source: Malware configuration extractor	IPs: 76.16.49.134:443
Source: Malware configuration extractor	IPs: 70.28.50.223:32100
Source: Malware configuration extractor	IPs: 12.172.173.82:465
Source: Malware configuration extractor	IPs: 76.170.252.153:995
Source: Malware configuration extractor	IPs: 184.182.66.109:443
Source: Malware configuration extractor	IPs: 78.92.133.215:443
Source: Malware configuration extractor	IPs: 50.68.204.71:993
Source: Malware configuration extractor	IPs: 186.75.95.6:443
Source: Malware configuration extractor	IPs: 113.11.92.30:443
Source: Malware configuration extractor	IPs: 70.28.50.223:3389
Source: Malware configuration extractor	IPs: 98.145.23.67:443
Source: Malware configuration extractor	IPs: 85.57.212.13:3389
Source: Malware configuration extractor	IPs: 50.68.186.195:443
Source: Malware configuration extractor	IPs: 47.205.25.170:443
Source: Malware configuration extractor	IPs: 12.172.173.82:993
Source: Malware configuration extractor	IPs: 12.172.173.82:22
Source: Malware configuration extractor	IPs: 69.242.31.249:443
Source: Malware configuration extractor	IPs: 81.101.185.146:443
Source: Malware configuration extractor	IPs: 79.168.224.165:2222
Source: Malware configuration extractor	IPs: 75.143.236.149:443
Source: Malware configuration extractor	IPs: 14.192.241.76:995
Source: Malware configuration extractor	IPs: 86.195.14.72:2222
Source: Malware configuration extractor	IPs: 81.229.117.95:2222
Source: Malware configuration extractor	IPs: 220.240.164.182:443
Source: Malware configuration extractor	IPs: 73.29.92.128:443
Source: Malware configuration extractor	IPs: 12.172.173.82:21
Source: Malware configuration extractor	IPs: 96.56.197.26:2222
Source: Malware configuration extractor	IPs: 75.109.111.89:443
Source: Malware configuration extractor	IPs: 76.86.31.59:443
Source: Malware configuration extractor	IPs: 201.244.108.183:995
Source: Malware configuration extractor	IPs: 68.203.69.96:443
Source: Malware configuration extractor	IPs: 124.122.47.148:443
Source: Malware configuration extractor	IPs: 122.184.143.86:443
Source: Malware configuration extractor	IPs: 92.186.69.229:2222
Source: Malware configuration extractor	IPs: 70.28.50.223:2083
Source: Malware configuration extractor	IPs: 89.129.109.27:2222
Source: Malware configuration extractor	IPs: 147.147.30.126:2222
Source: Malware configuration extractor	IPs: 125.99.76.102:443
Source: Malware configuration extractor	IPs: 88.126.94.4:50000
Source: Malware configuration extractor	IPs: 151.65.167.77:443
Source: Malware configuration extractor	IPs: 86.132.236.117:443
Source: Malware configuration extractor	IPs: 92.154.17.149:2222
Source: Malware configuration extractor	IPs: 223.166.13.95:995
Source: Malware configuration extractor	IPs: 89.36.206.69:995
Source: Malware configuration extractor	IPs: 96.56.197.26:2083
Source: Malware configuration extractor	IPs: 78.18.105.11:443
Source: Malware configuration extractor	IPs: 82.127.153.75:2222
Source: Malware configuration extractor	IPs: 90.78.147.141:2222
Source: Malware configuration extractor	IPs: 82.131.141.209:443
Source: Malware configuration extractor	IPs: 183.87.163.165:443
Source: Malware configuration extractor	IPs: 92.9.45.20:2222
Source: Malware configuration extractor	IPs: 80.6.50.34:443
Source: Malware configuration extractor	IPs: 80.12.88.148:2222
Source: Malware configuration extractor	IPs: 69.133.162.35:443
Source: Malware configuration extractor	IPs: 172.115.17.50:443
Source: Malware configuration extractor	IPs: 95.45.50.93:2222
Source: Malware configuration extractor	IPs: 12.172.173.82:2087
Source: Malware configuration extractor	IPs: 103.140.174.20:2222
Source: Malware configuration extractor	IPs: 24.198.114.130:995
Source: Malware configuration extractor	IPs: 50.68.204.71:443
Source: Malware configuration extractor	IPs: 69.119.123.159:2222
Source: Malware configuration extractor	IPs: 64.121.161.102:443
Source: Malware configuration extractor	IPs: 2.82.8.80:443
Source: Malware configuration extractor	IPs: 184.181.75.148:443
Source: Malware configuration extractor	IPs: 70.112.206.5:443
Source: Malware configuration extractor	IPs: 198.2.51.242:993
Source: Malware configuration extractor	IPs: 2.36.64.159:2078
Source: Malware configuration extractor	IPs: 79.77.142.22:2222
Source: Malware configuration extractor	IPs: 84.215.202.8:443
Source: Malware configuration extractor	IPs: 147.219.4.194:443
Source: Malware configuration extractor	IPs: 116.74.164.81:443
Source: Malware configuration extractor	IPs: 70.28.50.223:2078

Source: Joe Sandbox View	ASN Name: MEO-RESIDENCIALPT MEO-RESIDENCIALPT
Source: Joe Sandbox View	ASN Name: ASN-CXA-ALL-CCI-22773-RDCUS ASN-CXA-ALL-CCI-22773-RDCUS

Source: Joe Sandbox View

IP Address: 2.82.8.80 2.82.8.80

Source: unknown

Network traffic detected: IP country count 30

Source: rundll32.exe, rundll32.exe, 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmp, main.dll.2.dr

String found in binary or memory: https://streams.videolan.org/upload/

Source: 7.2.rundll32.exe.39a328.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 7.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 7.2.rundll32.exe.39a328.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\66172b.ipi

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\66172a.msi

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10079010	7_2_10079010
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000D060	7_2_1000D060
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10081091	7_2_10081091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000B0D0	7_2_1000B0D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007A0F3	7_2_1007A0F3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10098118	7_2_10098118
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002F110	7_2_1002F110
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10008144	7_2_10008144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100A415E	7_2_100A415E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100A615C	7_2_100A615C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10088194	7_2_10088194
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100101D0	7_2_100101D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001021B	7_2_1001021B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10007270	7_2_10007270
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002B270	7_2_1002B270
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004B2B0	7_2_1004B2B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100752F0	7_2_100752F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100842F0	7_2_100842F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10086310	7_2_10086310
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007D347	7_2_1007D347
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10021340	7_2_10021340
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002C390	7_2_1002C390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004D3B0	7_2_1004D3B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004E3E0	7_2_1004E3E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007C415	7_2_1007C415
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002C428	7_2_1002C428
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10013480	7_2_10013480
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000D4D0	7_2_1000D4D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100774E2	7_2_100774E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004C500	7_2_1004C500
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007D511	7_2_1007D511
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10025550	7_2_10025550
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10082550	7_2_10082550
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10028590	7_2_10028590
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004D590	7_2_1004D590
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100105C0	7_2_100105C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004D5C1	7_2_1004D5C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007C5E1	7_2_1007C5E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1008A640	7_2_1008A640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000164B	7_2_1000164B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100A566C	7_2_100A566C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10080660	7_2_10080660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10027690	7_2_10027690
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10066691	7_2_10066691
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100A46FC	7_2_100A46FC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100556F8	7_2_100556F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10024700	7_2_10024700
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10087748	7_2_10087748
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10079740	7_2_10079740
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10010750	7_2_10010750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10030750	7_2_10030750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10087750	7_2_10087750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000E760	7_2_1000E760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10021760	7_2_10021760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10010778	7_2_10010778
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100A57A5	7_2_100A57A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100767C0	7_2_100767C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100857F0	7_2_100857F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000B830	7_2_1000B830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10020830	7_2_10020830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100A5843	7_2_100A5843
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10032890	7_2_10032890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100218A0	7_2_100218A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10001900	7_2_10001900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007F900	7_2_1007F900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000D910	7_2_1000D910
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10010980	7_2_10010980
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004A990	7_2_1004A990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001099C	7_2_1001099C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100499A0	7_2_100499A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000C9F0	7_2_1000C9F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000FA00	7_2_1000FA00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004BA00	7_2_1004BA00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000AA10	7_2_1000AA10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10007A50	7_2_10007A50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007CAB7	7_2_1007CAB7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001EAB0	7_2_1001EAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000EAC0	7_2_1000EAC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000FAE0	7_2_1000FAE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000FAF7	7_2_1000FAF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10081AF0	7_2_10081AF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10020B00	7_2_10020B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10078B10	7_2_10078B10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000AB30	7_2_1000AB30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003BA5	7_2_10003BA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000FBC0	7_2_1000FBC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1004BC00	7_2_1004BC00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10001C10	7_2_10001C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000DC10	7_2_1000DC10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000EC10	7_2_1000EC10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000BC40	7_2_1000BC40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10088C48	7_2_10088C48
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007AC96	7_2_1007AC96
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10004C96	7_2_10004C96
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007DCA7	7_2_1007DCA7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10094CA9	7_2_10094CA9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000ECC9	7_2_1000ECC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10086CD0	7_2_10086CD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10027CE0	7_2_10027CE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002DCE0	7_2_1002DCE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007BD36	7_2_1007BD36
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000DD40	7_2_1000DD40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10084D40	7_2_10084D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000CD50	7_2_1000CD50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10023D50	7_2_10023D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1007FD75	7_2_1007FD75
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000EDB0	7_2_1000EDB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10007DC0	7_2_10007DC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10076DC0	7_2_10076DC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1008EDE0	7_2_1008EDE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1008DDF0	7_2_1008DDF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1009AE50	7_2_1009AE50

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 100089C0 appears 34 times

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 77620000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 77740000 page execute and read and write			Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\5q4psw.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\~DF081EC1EE06C4DD73.TMP

Jump to behavior

Source: metadata-2.2.dr	Binary string: highlight.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\66program files\windows sidebar\gadgets\rssfeeds.gadgeticon.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.dr	Binary string: wmplayer.exe.mui22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\BBprogram files (x86)\windows sidebar\gadgets\weather.gadget\images**undocked_black_moon-new_partly-cloudy.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\((windows\diagnostics\system\device\en-us
Source: metadata-2.2.dr	Binary string: buttonup_off.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.dr	Binary string: system.web.dynamicdata.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\BBprogram files (x86)\windows sidebar\gadgets\weather.gadget\images33docked_black_moon-waxing-gibbous_partly-cloudy.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.2.dr	Binary string: system.addin.contract.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.dr	Binary string: btn-previous-static.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.2.dr	Binary string: keypad.xml22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\99program files\dvd maker\shared\dvdstyles\specialoccasion,,specialnavigationup_selectionsubpicture.png22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.2.dr	Binary string: scenes_intro_bg_pal.wmv22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.2.dr	Binary string: acxtrnal.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\((windows\diagnostics\system\device\en-us
Source: metadata-2.2.dr	Binary string: sbdrop.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}

Source: classification engine

Classification label: mal96.troj.evad.winMSI@10/14@0/100

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{89DB3598-82DB-49D8-976D-727294C5AF4C}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{9F770E45-C862-4727-ABE3-3711E87F646A}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{89DB3598-82DB-49D8-976D-727294C5AF4C}

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1008C51C push es; ret		7_2_1008C521
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1008C5CA push es; ret		7_2_1008C5CB

Source: main.dll.2.dr

Static PE information: real checksum: 0xe9e0f should be: 0xf51fe

Source: metadata-2.2.dr	Binary or memory string: bcdedit.exe22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\
Source: metadata-2.2.dr	Binary or memory string: bcdedit.exe.mui22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: PID: 3476 base: 6E2AFF value: E9 B4 E8 9D FF

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROC_ANALYZER.EXE7:
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BEHAVIORDUMPER.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 00000009.00000003.1096224638.0000000001D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE'
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 00000009.00000003.1096224638.0000000001D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE9
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROC_ANALYZER.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 00000009.00000003.1096224638.0000000001D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE1
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE<
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 00000009.00000003.1096224638.0000000001D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE<
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: wermgr.exe, 00000009.00000003.1096148478.0000000001D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Windows\System32\msiexec.exe TID: 1076	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 1076	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\msiexec.exe TID: 2816	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3400	Thread sleep count: 120 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe TID: 3496	Thread sleep time: -45000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10032510 rdtsc

7_2_10032510

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 0.0 %

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: metadata-2.2.dr	Binary or memory string: lsm.exe22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\--windows\system32\migwiz\replacementmanifests,,microsoft-hyper-v-migration-replacement.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\
Source: metadata-2.2.dr	Binary or memory string: iasmigplugin-dl.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\--windows\system32\migwiz\replacementmanifests33microsoft-hyper-v-client-migration-replacement.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\##windows\system32\spp\tokens\ppdlic
Source: metadata-2.2.dr	Binary or memory string: iasmigplugin-dl.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\--windows\syswow64\migwiz\replacementmanifests33microsoft-hyper-v-client-migration-replacement.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\,,program files (x86)\internet explorer\en-us
Source: metadata-2.2.dr	Binary or memory string: imscmig.dll22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\--windows\system32\migwiz\replacementmanifests44microsoft-hyper-v-drivers-migration-replacement.man22\\?\Volume{8049f198-1016-11e7-b87b-806e6f6e6963}\

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10032510 Start: 100327F5 End: 1003263E

7_2_10032510

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10032510 rdtsc

7_2_10032510

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_3_00172297 mov eax, dword ptr fs:[00000030h]		7_3_00172297
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002A9E9 mov eax, dword ptr fs:[00000030h]		7_2_1002A9E9

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: F0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: C0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 6E2AFF	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: C0000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: F0000 protect: page read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: C:\Windows\SysWOW64\wermgr.exe base: C0000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_1008B030 cpuid

7_2_1008B030

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_1008F660 GetTimeZoneInformation,GetModuleHandleA,GetProcAddress,

7_2_1008F660

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 7.2.rundll32.exe.39a328.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.39a328.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1048899180.000000000257D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1048686575.000000000038D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 7.2.rundll32.exe.39a328.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.39a328.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1048899180.000000000257D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1048686575.000000000038D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	11 Scripting	2 Windows Service	2 Windows Service	11 Masquerading	1 Credential API Hooking	1 System Time Discovery	1 Replication Through Removable Media	1 Credential API Hooking	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 Bootkit	311 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	311 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Scripting	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Bootkit	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 File Deletion	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5q4psw.msi	5%	ReversingLabs
5q4psw.msi	5%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll	4%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://streams.videolan.org/upload/	rundll32.exe, rundll32.exe, 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmp, main.dll.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.82.8.80	unknown	Portugal	3243	MEO-RESIDENCIALPT	true
70.160.67.203	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
75.143.236.149	unknown	United States	20115	CHARTER-20115US	true
83.110.223.61	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	true
86.195.14.72	unknown	France	3215	FranceTelecom-OrangeFR	true
84.215.202.8	unknown	Norway	41164	GET-NOGETNorwayNO	true
184.182.66.109	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
105.184.103.97	unknown	South Africa	37457	Telkom-InternetZA	true
92.186.69.229	unknown	France	12479	UNI2-ASES	true
174.4.89.3	unknown	Canada	6327	SHAWCA	true
161.142.103.187	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	true
114.143.176.236	unknown	India	17762	HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN	true
14.192.241.76	unknown	Malaysia	9534	MAXIS-AS1-APBinariangBerhadMY	true
173.88.135.179	unknown	United States	10796	TWC-10796-MIDWESTUS	true
84.108.200.161	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	true
47.34.30.133	unknown	United States	20115	CHARTER-20115US	true
183.87.163.165	unknown	India	132220	JPRDIGITAL-INJPRDigitalPvtLtdIN	true
124.149.143.189	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
184.181.75.148	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
84.35.26.14	unknown	Netherlands	21221	INFOPACT-ASTheNetherlandsNL	true
73.29.92.128	unknown	United States	7922	COMCAST-7922US	true
68.203.69.96	unknown	United States	11427	TWC-11427-TEXASUS	true
82.131.141.209	unknown	Hungary	20845	DIGICABLEHU	true
64.121.161.102	unknown	United States	6079	RCN-ASUS	true
178.175.187.254	unknown	Moldova Republic of	43289	TRABIAMD	true
96.56.197.26	unknown	United States	6128	CABLE-NET-1US	true
186.64.67.30	unknown	Argentina	27953	NODOSUDSAAR	true
188.28.19.84	unknown	United Kingdom	206067	H3GUKGB	true
125.99.76.102	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
81.101.185.146	unknown	United Kingdom	5089	NTLGB	true
86.176.144.234	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
59.28.84.65	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
76.86.31.59	unknown	United States	20001	TWC-20001-PACWESTUS	true
147.147.30.126	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	true
96.87.28.170	unknown	United States	7922	COMCAST-7922US	true
75.109.111.89	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	true
78.92.133.215	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	true
124.122.47.148	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	true
88.126.94.4	unknown	France	12322	PROXADFR	true
51.14.29.227	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
85.57.212.13	unknown	Spain	12479	UNI2-ASES	true
47.205.25.170	unknown	United States	5650	FRONTIER-FRTRUS	true
95.45.50.93	unknown	Ireland	5466	EIRCOMInternetHouseIE	true
80.12.88.148	unknown	France	3215	FranceTelecom-OrangeFR	true
81.111.108.123	unknown	United Kingdom	5089	NTLGB	true
69.133.162.35	unknown	United States	11426	TWC-11426-CAROLINASUS	true
86.132.236.117	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
151.62.238.176	unknown	Italy	1267	ASN-WINDTREIUNETEU	true
70.112.206.5	unknown	United States	11427	TWC-11427-TEXASUS	true
41.228.224.161	unknown	Tunisia	37693	TUNISIANATN	true
205.237.67.69	unknown	Canada	11290	CC-3272CA	true
102.159.188.125	unknown	Tunisia	37705	TOPNETTN	true
151.65.167.77	unknown	Italy	1267	ASN-WINDTREIUNETEU	true
76.178.148.107	unknown	United States	10838	OCEANIC-INTERNET-RRUS	true
89.36.206.69	unknown	Italy	48544	TECNOADSL-ASIT	true
69.242.31.249	unknown	United States	7922	COMCAST-7922US	true
85.104.105.67	unknown	Turkey	9121	TTNETTR	true
94.207.104.225	unknown	United Arab Emirates	15802	DU-AS1AE	true
193.253.100.236	unknown	France	3215	FranceTelecom-OrangeFR	true
76.16.49.134	unknown	United States	7922	COMCAST-7922US	true
201.244.108.183	unknown	Colombia	19429	ETB-ColombiaCO	true
103.42.86.42	unknown	India	133660	EDIGITAL-ASE-InfrastructureandEntertainmentIndiaPvtLt	true
78.18.105.11	unknown	Ireland	2110	AS-BTIREBTIrelandwaspreviouslyknownasEsatNetEUnet	true
80.6.50.34	unknown	United Kingdom	5089	NTLGB	true
103.144.201.56	unknown	unknown	139762	MSSOLUTION-AS-APSolutionBD	true
27.0.48.233	unknown	India	132573	SAINGN-AS-INSAINGNNetworkServicesIN	true
70.28.50.223	unknown	Canada	577	BACOMCA	true
98.145.23.67	unknown	United States	20001	TWC-20001-PACWESTUS	true
82.125.44.236	unknown	France	3215	FranceTelecom-OrangeFR	true
81.229.117.95	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
89.129.109.27	unknown	Spain	12479	UNI2-ASES	true
122.186.210.254	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
79.77.142.22	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	true
90.78.147.141	unknown	France	3215	FranceTelecom-OrangeFR	true
122.184.143.86	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
186.75.95.6	unknown	Panama	11556	CableWirelessPanamaPA	true
50.68.186.195	unknown	Canada	6327	SHAWCA	true
12.172.173.82	unknown	United States	2386	INS-ASUS	true
213.64.33.61	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
79.168.224.165	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
176.142.207.63	unknown	France	5410	BOUYGTEL-ISPFR	true
86.173.2.12	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
92.154.17.149	unknown	France	3215	FranceTelecom-OrangeFR	true
78.160.146.127	unknown	Turkey	9121	TTNETTR	true
58.186.75.42	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	true
223.166.13.95	unknown	China	17621	CNCGROUP-SHChinaUnicomShanghainetworkCN	true
65.95.141.84	unknown	Canada	577	BACOMCA	true
50.68.204.71	unknown	Canada	6327	SHAWCA	true
71.38.155.217	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	true
220.240.164.182	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
103.123.223.133	unknown	India	138329	KWS-AS-APKenstarWebSolutionsPrivateLimitedIN	true
24.198.114.130	unknown	United States	11351	TWC-11351-NORTHEASTUS	true
2.36.64.159	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
198.2.51.242	unknown	United States	20001	TWC-20001-PACWESTUS	true
92.9.45.20	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	true
113.11.92.30	unknown	Bangladesh	7565	BDCOM-BDRangsNiluSquare5thFloorHouse75Road5AD	true
109.50.149.241	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
69.119.123.159	unknown	United States	6128	CABLE-NET-1US	true
172.115.17.50	unknown	United States	20001	TWC-20001-PACWESTUS	true
147.219.4.194	unknown	United States	1498	DNIC-ASBLK-01498-01499US	true

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	878635
Start date and time:	2023-05-30 22:49:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	5q4psw.msi
Detection:	MAL
Classification:	mal96.troj.evad.winMSI@10/14@0/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 81% Number of executed functions: 9 Number of non-executed functions: 276
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, VSSVC.exe, svchost.exe
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtFsControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:49:56	API Interceptor	1627x Sleep call for process: msiexec.exe modified
22:50:24	API Interceptor	21x Sleep call for process: rundll32.exe modified
22:50:24	API Interceptor	206x Sleep call for process: wscript.exe modified
22:50:26	API Interceptor	170x Sleep call for process: wermgr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
2.82.8.80	15dasx.msi	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	main2.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse
	graphically.dat.dll	Get hash	malicious	Qbot	Browse
	kxyj5.dat.dll	Get hash	malicious	Qbot	Browse
	PXNuYAPR.dat.dll	Get hash	malicious	Qbot	Browse
	TB9mkKe4Qzu.dat.dll	Get hash	malicious	Qbot	Browse
	leiotrichy.js	Get hash	malicious	Qbot	Browse
	a0UFMZnC6ltxphw.dat.dll	Get hash	malicious	Qbot	Browse
	msfilter.dll	Get hash	malicious	Qbot	Browse
	QPAWJ8VnpO.dll	Get hash	malicious	Qbot	Browse
	Cjpxxx.js	Get hash	malicious	Qbot	Browse
	analysis.dll	Get hash	malicious	Qbot	Browse
	ss3.dll	Get hash	malicious	Qbot	Browse
	Ffzknz.js	Get hash	malicious	Qbot	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MEO-RESIDENCIALPT	15dasx.msi	Get hash	malicious	Qbot	Browse	2.82.8.80
	licking.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	licking.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	main2.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	r3zg12.msi	Get hash	malicious	Qbot	Browse	2.82.8.80
	main.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	r3zg12.msi	Get hash	malicious	Qbot	Browse	2.82.8.80
	main.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	graphically.dat.dll	Get hash	malicious	Qbot	Browse	2.82.8.80
	LEo7jDCX96.elf	Get hash	malicious	Mirai	Browse	2.81.219.243
	yvweY4vsVq.elf	Get hash	malicious	Mirai	Browse	188.81.116.228
	8C3RpG9eka.elf	Get hash	malicious	Mirai	Browse	85.244.28.246
	Pc8ewtsPRR.elf	Get hash	malicious	Mirai	Browse	85.240.179.8
	33cWz2DNq2.elf	Get hash	malicious	Mirai	Browse	2.83.183.198
	pu3jOk0Q9u.elf	Get hash	malicious	Mirai	Browse	82.155.117.104
	6mu5y2WWPK.elf	Get hash	malicious	Mirai	Browse	85.246.119.61
	A6BM2Ru5xc.elf	Get hash	malicious	Mirai	Browse	37.189.107.20
	43acf3.msi	Get hash	malicious	Qbot	Browse	188.83.251.100
	43acf3.msi	Get hash	malicious	Qbot	Browse	188.83.251.100
	666.dat.dll	Get hash	malicious	Qbot	Browse	188.83.251.100
ASN-CXA-ALL-CCI-22773-RDCUS	15dasx.msi	Get hash	malicious	Qbot	Browse	184.181.75.148
	licking.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	licking.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	main2.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	r3zg12.msi	Get hash	malicious	Qbot	Browse	184.181.75.148
	main.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	r3zg12.msi	Get hash	malicious	Qbot	Browse	184.181.75.148
	main.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	graphically.dat.dll	Get hash	malicious	Qbot	Browse	184.181.75.148
	UMyY7qXi7b.elf	Get hash	malicious	Mirai	Browse	68.6.72.41
	udxyqUncDs.elf	Get hash	malicious	Gafgyt, Mirai	Browse	184.188.248.242
	KipHfbWc5u.elf	Get hash	malicious	Mirai	Browse	174.74.5.188
	CT1zp877iP.elf	Get hash	malicious	Mirai	Browse	68.108.254.249
	65cBS6uCoV.elf	Get hash	malicious	Mirai	Browse	70.187.92.80
	gLeiWqaVuD.elf	Get hash	malicious	Mirai	Browse	24.249.120.101
	RW3fkwplaC.elf	Get hash	malicious	Mirai	Browse	70.171.100.214
	i12DwPGkzd.elf	Get hash	malicious	Mirai	Browse	68.101.71.203
	65iP0qrS2t.elf	Get hash	malicious	Mirai	Browse	68.107.216.55
	1ETFmiL6wm.elf	Get hash	malicious	Mirai	Browse	72.213.79.128
	0ngHKmaLgS.elf	Get hash	malicious	Unknown	Browse	72.208.54.96

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	8650
Entropy (8bit):	5.542664536260259
Encrypted:	false
SSDEEP:	96:JrM26KeS3YqUTyyPw9CsAqnUTyyPw9C6jUzJU/Aq1HVP0BSxaGcciBoFj+vCUVp6:JlexTyOwg3TyOwgi1dRUVp6
MD5:	6CE8B30BD7FFE8CB9684B5ED6A3470DE
SHA1:	23ACE6CF9C76CFBB72A4A15DDCE2461C9E8230A4
SHA-256:	DF4366ECE40B234F7DDD38A2FFCBF0B9C0D21DF6E02F1CFE7E86B08D975698DB
SHA-512:	414EA03D2AD73A2FFB3DF195E458AD6DDDE7F952E7DB90779333183426AAF64A7258EB3F62BEFB3627A9A49D88ACAE66862834499A0EB507A1C64F8DDF641200
Malicious:	false
Preview:	...@IXOS.@.....@...V.@.....@.....@.....@.....@.....@......&.{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}'.Adobe Acrobat PDF Browser Plugin 4.8.25..5q4psw.msi.@.....@.....@.....@........&.{D557C495-7A3E-4038-8369-B6EDCD5EFABE}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}&.{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..:.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\....B.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll....D.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs....WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@....%.Software\AdobeAcrobatPDFBrowserPlugin...@....(.&...AdobeAcrobatPDFBro

C:\System Volume Information\SPP\OnlineMetadataCache\{95bd4ba6-e44e-4e3d-aced-35775530fd8d}_OnDiskSnapshotProp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2984
Entropy (8bit):	3.6765846959388937
Encrypted:	false
SSDEEP:	48:i7Nhr1JzN38RN3x0/7wP8aZntCwL7feGp9bHfOIgbR1fOIgBKEBKRC6v6ReyZ:whr1JB4uU/vfHzbOHXOHB9BpiW
MD5:	AC8EE2E678671D2990AF13E9ED309F72
SHA1:	E5E6A81618D6218DF707212BA9E2141BE27A3186
SHA-256:	20716FE7E8B8ABFA2CA44309973CE9534B95DA9DD4576DB304421F514F5F17AB
SHA-512:	4C5F9163ACA63A378E7517457A13D7A363AF21124EEF39141B879A2D628A4B3F7A6E193B9AD417F87A2AE7ED65653D238AEC791BFBE1EB709DBEE3F8B4FBA51B
Malicious:	false
Preview:	.D.....M..,....c.g.t....................K..N.=N..5wU0..8........3..............M..0.<fK...; ...............................$.......8...2.......2...I.n.s.t.a.l.l.e.d. .A.d.o.b.e. .A.c.r.o.b.a.t. .P.D.F. .B.r.o.w.s.e.r. .P.l.u.g.i.n. .4...8...2.5...............C.:.\.W.i.n.d.o.w.s.\...............2.1.6.8.6.5.................W.O.R.K.G.R.O.U.P..........}.*.M..........................).(?..P............. ...2.......2...\.\.?.\.V.o.l.u.m.e.{.8.0.4.9.f.1.9.8.-.1.0.1.6.-.1.1.e.7.-.b.8.7.b.-.8.0.6.e.6.f.6.e.6.9.6.3.}.\...............C.:.\...........N).A.j..j...............(...0.......,...2.......2...\.\.?.\.V.o.l.u.m.e.{.8.0.4.9.f.1.9.8.-.1.0.1.6.-.1.1.e.7.-.b.8.7.b.-.8.0.6.e.6.f.6.e.6.9.6.3.}.\.......4...............(.C.:.).........<...@...D...H...L...P...T...X...\...`...d...h...l...p...t...x...\|.......%.......%...A.d.o.b.e. .A.c.r.o.b.a.t. .R.e.a.d.e.r. .D.C. .1.9...0.1.0...2.0.0.9.8.....).......)...A.d.o.b.e. .F.l.a.s.h. .P.l.a.y.e.r. .2.5. .A.c.t.i.v.e.X. .2.5...0...0...1.2.7.....'.......

C:\System Volume Information\SPP\metadata-2

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	SysEx File - Twister
Category:	dropped
Size (bytes):	8733112
Entropy (8bit):	3.681615069579119
Encrypted:	false
SSDEEP:	12288:+8+YgOpYEzT4G09wYKc9rMjG/BWigr7dCKV0/HwLQt+Y/g4zsuAvm7gPI+PhgcIi:dljYY8BWitXZh7TeQsPIy1YQz
MD5:	0B6F6F2272DF0BF059F2EC14DDA9DADD
SHA1:	F1511D2A105AF4A2656ED256E911682544333A37
SHA-256:	950B15ECF1D3DFAFC56D902DA651E82DE8DAAFAE164A4974336C1CCCA62BDE9F
SHA-512:	417D99DCD572EA6EF93D54C0E0551B5688043D7B026C3F80BBF0E12EA3A3D53B06A56A246E1F5B171C711BC3ADE7773965F6E411AA0B916175AABD24216ED563
Malicious:	false
Preview:	.%..=..J.....>.(.}.............A...................... ...Y.......Y...<.B.A.C.K.U.P._.C.O.M.P.O.N.E.N.T.S. .x.m.l.n.s.=.".x.-.s.c.h.e.m.a.:.#.V.s.s.C.o.m.p.o.n.e.n.t.M.e.t.a.d.a.t.a.". .v.e.r.s.i.o.n.=.".1...2.". .b.o.o.t.a.b.l.e.S.y.s.t.e.m.S.t.a.t.e.B.a.c.k.u.p.=.".y.e.s.". .s.e.l.e.c.t.C.o.m.p.o.n.e.n.t.s.=.".y.e.s.". .b.a.c.k.u.p.T.y.p.e.=.".f.u.l.l.". .p.a.r.t.i.a.l.F.i.l.e.S.u.p.p.o.r.t.=.".y.e.s.". .s.n.a.p.s.h.o.t.S.e.t.I.d.=.".9.5.b.d.4.b.a.6.-.e.4.4.e.-.4.e.3.d.-.a.c.e.d.-.3.5.7.7.5.5.3.0.f.d.8.d.".>.<.W.R.I.T.E.R._.C.O.M.P.O.N.E.N.T.S. .i.n.s.t.a.n.c.e.I.d.=.".4.5.8.b.f.6.d.0.-.9.8.7.c.-.4.5.2.7.-.b.7.b.9.-.5.d.4.0.5.2.4.a.2.1.2.4.". .w.r.i.t.e.r.I.d.=.".e.8.1.3.2.9.7.5.-.6.f.9.3.-.4.4.6.4.-.a.5.3.e.-.1.0.5.0.2.5.3.a.e.2.2.0.". .b.a.c.k.u.p.S.c.h.e.m.a.=.".0.".>.<.C.O.M.P.O.N.E.N.T. .c.o.m.p.o.n.e.n.t.N.a.m.e.=.".S.y.s.t.e.m. .F.i.l.e.s.". .c.o.m.p.o.n.e.n.t.T.y.p.e.=.".f.i.l.e.g.r.o.u.p."./.>.<./.W.R.I.T.E.R._.C.O.M.P.O.N.E.N.T.S.>.<.W.R.I.T.E.R._.C.O.M.P.O.N.E.N.T.S. .i.

C:\System Volume Information\SPP\snapshot-2

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2984
Entropy (8bit):	3.6765846959388937
Encrypted:	false
SSDEEP:	48:i7Nhr1JzN38RN3x0/7wP8aZntCwL7feGp9bHfOIgbR1fOIgBKEBKRC6v6ReyZ:whr1JB4uU/vfHzbOHXOHB9BpiW
MD5:	AC8EE2E678671D2990AF13E9ED309F72
SHA1:	E5E6A81618D6218DF707212BA9E2141BE27A3186
SHA-256:	20716FE7E8B8ABFA2CA44309973CE9534B95DA9DD4576DB304421F514F5F17AB
SHA-512:	4C5F9163ACA63A378E7517457A13D7A363AF21124EEF39141B879A2D628A4B3F7A6E193B9AD417F87A2AE7ED65653D238AEC791BFBE1EB709DBEE3F8B4FBA51B
Malicious:	false
Preview:	.D.....M..,....c.g.t....................K..N.=N..5wU0..8........3..............M..0.<fK...; ...............................$.......8...2.......2...I.n.s.t.a.l.l.e.d. .A.d.o.b.e. .A.c.r.o.b.a.t. .P.D.F. .B.r.o.w.s.e.r. .P.l.u.g.i.n. .4...8...2.5...............C.:.\.W.i.n.d.o.w.s.\...............2.1.6.8.6.5.................W.O.R.K.G.R.O.U.P..........}.*.M..........................).(?..P............. ...2.......2...\.\.?.\.V.o.l.u.m.e.{.8.0.4.9.f.1.9.8.-.1.0.1.6.-.1.1.e.7.-.b.8.7.b.-.8.0.6.e.6.f.6.e.6.9.6.3.}.\...............C.:.\...........N).A.j..j...............(...0.......,...2.......2...\.\.?.\.V.o.l.u.m.e.{.8.0.4.9.f.1.9.8.-.1.0.1.6.-.1.1.e.7.-.b.8.7.b.-.8.0.6.e.6.f.6.e.6.9.6.3.}.\.......4...............(.C.:.).........<...@...D...H...L...P...T...X...\...`...d...h...l...p...t...x...\|.......%.......%...A.d.o.b.e. .A.c.r.o.b.a.t. .R.e.a.d.e.r. .D.C. .1.9...0.1.0...2.0.0.9.8.....).......)...A.d.o.b.e. .F.l.a.s.h. .P.l.a.y.e.r. .2.5. .A.c.t.i.v.e.X. .2.5...0...0...1.2.7.....'.......

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	952832
Entropy (8bit):	6.765764209638377
Encrypted:	false
SSDEEP:	24576:UkgLxg2eMP8EN8Vo7zgDQ9uo4iZSBi/u3wXqx9jKVM5qx0YJ:x/jDQMo49wpq
MD5:	0C8E5B12B177A199008B2282C7506FFF
SHA1:	0DFEE8BAE7073512F8BFDABAF0C0B7C882B3864E
SHA-256:	9A407A2F0BA3C0E3BA3CFA2FFD6472DB3BC572B8EF08F1FBA7139CBD36CC8DCA
SHA-512:	6464EC42CCCB85E7C067AD9F7C8B804D064A6974E8184BC5134436FAD004BF87630869C107BB91F87BDC59F7938A8A157F59A436CE0265C070DB32A54C4541B5
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m..d...........#...8...................................................... ...........@... .........................hC......<............................ ...?..........................$J.......................................................text...4...........................`.0`.data...............................@.0..rdata..\|...........................@.0@.bss....D....p.......>................0..edata..hC.......D...>..............@.0@.idata..<...........................@.0..CRT....0...........................@.0..tls................................@.0..rsrc...b...........................@.0..reloc...?.......@...J..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	132
Entropy (8bit):	4.599233980549996
Encrypted:	false
SSDEEP:	3:LwBxFkvH4dGmMKLVKRLGPz4VAFkvH4dGmMKLVKRLGH:cHFkvYdlZKRLi7FkvYdlZKRL4
MD5:	0D4C9F15CE74465C59AE36A27F98C817
SHA1:	9CCE8EEFA4D3D9C5E161C5DBB860CFE1489C6B1A
SHA-256:	D24E3399060B51F3A1C9D41A67DE2601888A35C99DA8DB70070D757BB3F1913A
SHA-512:	9BED0EAFC2CF2A2360850CA1070FFB04AC14F04C78379485998A93F45012B5C11CC7F6F68129F65B8B5F90437CB965908C6A1BB9D83A56B068D6BDE1D5FDAD1F
Malicious:	false
Preview:	MsgBox "Adobe Acrobat PDF Browser Plugin installation error 0x00000328", 16, "Adobe Acrobat PDF Browser Plugin installation error"..

C:\Users\user\AppData\Local\Temp\~DF081EC1EE06C4DD73.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12106622410839882
Encrypted:	false
SSDEEP:	24:IUM7E818lOdWmDqqrb9ipVIdWmDqqrb9ipV7VIwGblrkg/+XJb:D5818lEOMSoOMS5Er/A
MD5:	7F93A52E440F4EAED2C4D1B2B4228C6E
SHA1:	66F146E9B131E8B3EB8A2BE4BCC48A719AF682DF
SHA-256:	3EEA36DA85DC276A4BB1EE35DCAEEACD5E768ABF84B6104C900C5E8F7007B1FE
SHA-512:	45CA91C3AD0C7E78912E282169838C3AB544356B1A5F06163ED0FB6DD9550D5C21B6964F6398053F438DF49D9485FA81CB97630134F24AB83D4BAF1E66ED21F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF26027B870D05A567.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD45D14352E4E4A80.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06981105571250576
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOSlgOda8971N5QVky6lS:2F0i8n0itFzDHFSiOdbFS
MD5:	5958014AA25C5536AC922FB0F2586B9F
SHA1:	AE9F32F875238BDDEA22C343217DF64FB74AFE59
SHA-256:	D4E0FBF5B4E51B6A1076DFBE9B346D390714A0F796BC73C9D2CB187793961966
SHA-512:	DF3C3E2E61AB5EAB0C4A5CCEC40A07F9E3491CE7C0D6C4A74D476ADD9179A6494963789898DCD7E5741BCD9437B01E4D333F08729EAFDB37220BEB3647C0B73A
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\66172a.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {D557C495-7A3E-4038-8369-B6EDCD5EFABE}, Create Time/Date: Tue May 30 14:26:08 2023, Last Saved Time/Date: Tue May 30 14:26:08 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	507904
Entropy (8bit):	7.919619627017417
Encrypted:	false
SSDEEP:	12288:wn+NgINNEcfjVRMigNFoILI8KviLjvhAol71Q:wnX9gjVRMDqH8fL154
MD5:	E35727B10193FE55DF216A1F9D166997
SHA1:	9DDAFA77FC9FDEA0085E41AA0F3A1EE0D15D9C8A
SHA-256:	696156D9A4117CBA652B18B012DB376FDDFBD7DB8B26A638C760D61B98D3590D
SHA-512:	2BBA74B0B7F5EE8509310030BB45DEF13B87394E55EDF8D0E51595D6CC669F4B2C7497D95331C09C9F7B453F3C9ACDEB03E41CD5E5DC14F9ECB9DD9F79D7AD8D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\66172b.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5270036864906151
Encrypted:	false
SSDEEP:	24:JKFC/lym6cpmUHCAjvuSTQJj+rdWmDqqrb9ipV7VIwGblrkgsdWmDqqrb9ipVi8R:E0+cDHBvuOauOMS5ErmOMSI818lI
MD5:	7B5B369F167CD164FFD9B8C6C5539E2F
SHA1:	B529F5853F3DB7C99443E293AD19554A5CC84C18
SHA-256:	56115F36679BAC14B426F657F2DA5514E2F0AC2346860FDF9C1BA1BAB8EBAED8
SHA-512:	84065ECA2463FC890B172EA204454435DDF862F7631E42263F952566511C990B7CEEA58DCEC63586EE8542ED2EAE26FDD52E918ECCF994F4859F3A493ECCE7D9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\66172d.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {D557C495-7A3E-4038-8369-B6EDCD5EFABE}, Create Time/Date: Tue May 30 14:26:08 2023, Last Saved Time/Date: Tue May 30 14:26:08 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	507904
Entropy (8bit):	7.919619627017417
Encrypted:	false
SSDEEP:	12288:wn+NgINNEcfjVRMigNFoILI8KviLjvhAol71Q:wnX9gjVRMDqH8fL154
MD5:	E35727B10193FE55DF216A1F9D166997
SHA1:	9DDAFA77FC9FDEA0085E41AA0F3A1EE0D15D9C8A
SHA-256:	696156D9A4117CBA652B18B012DB376FDDFBD7DB8B26A638C760D61B98D3590D
SHA-512:	2BBA74B0B7F5EE8509310030BB45DEF13B87394E55EDF8D0E51595D6CC669F4B2C7497D95331C09C9F7B453F3C9ACDEB03E41CD5E5DC14F9ECB9DD9F79D7AD8D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIABDA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2138
Entropy (8bit):	5.591360062877065
Encrypted:	false
SSDEEP:	48:YWozIAJwCP3NDufg7YjRBoD8SY1eU/dnMhaEVltgI4ta:YrMizYjrAuei8aEPNr
MD5:	20E0FCD7F06ADA3EB0A4D114A59A3827
SHA1:	7A633819C34AF72788899ACF1866DE1AAEC33798
SHA-256:	11DDB4D087D3498DE2F22DCE503B778BCEED800DCF52F6BCAA723D7969EC1C12
SHA-512:	4A537A0C8132A3C6DEFA89319DFFD350F10891E4A3C92004AC5590BDF4E1BAACF9660B34F37B5E394800A25EF4DCCE6A64C6B878B393F87CED90D159E8BB6E68
Malicious:	false
Preview:	...@IXOS.@.....@...V.@.....@.....@.....@.....@.....@......&.{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}'.Adobe Acrobat PDF Browser Plugin 4.8.25..5q4psw.msi.@.....@.....@.....@........&.{D557C495-7A3E-4038-8369-B6EDCD5EFABE}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}F.01:\Software\AdobeAcrobatPDFBrowserPlugin\AdobeAcrobatPDFBrowserPlugin.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@......:.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\..).1\xssanpen\\|AdobeAcrobatPDFBrowserPlugin\......Please insert the disk: ..media3.cab.@.....@......C:\Windows\Installer\66172a.msi.........@........main.dll..dll_main..main.dll.@.....@.....@.......@...

C:\Windows\Installer\SourceHash{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1633152870579164
Encrypted:	false
SSDEEP:	12:JSbX72FjjAGiLIlHVRpth/7777777777777777777777777vDHFSiOdbEpSl0i8Q:JRQI5pidyF
MD5:	511E527D4026F33946CCBFCA96C5CFAE
SHA1:	9FC6F019853ED4F0FD57720329B2A77407CFA303
SHA-256:	87B237324E922DEB42A9528790975F754EC03C9BA6DCED8A0C96177FE9DF9914
SHA-512:	1A88BCB05D17A6F88C811AC899CF2A111B988CB325FD098B8370BCBA3B0F549F48F759AF2939954CC4C64EEC958328C56374A4D7A4FCF0DAD4BC1564A1C1AE7C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {D557C495-7A3E-4038-8369-B6EDCD5EFABE}, Create Time/Date: Tue May 30 14:26:08 2023, Last Saved Time/Date: Tue May 30 14:26:08 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Entropy (8bit):	7.919619627017417
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	5q4psw.msi
File size:	507904
MD5:	e35727b10193fe55df216a1f9d166997
SHA1:	9ddafa77fc9fdea0085e41aa0f3a1ee0d15d9c8a
SHA256:	696156d9a4117cba652b18b012db376fddfbd7db8b26a638c760d61b98d3590d
SHA512:	2bba74b0b7f5ee8509310030bb45def13b87394e55edf8d0e51595d6cc669f4b2c7497d95331c09c9f7b453f3c9acdeb03e41cd5e5dc14f9ecb9dd9f79d7ad8d
SSDEEP:	12288:wn+NgINNEcfjVRMigNFoILI8KviLjvhAol71Q:wnX9gjVRMDqH8fL154
TLSH:	DDB423597606A371C4C82A72A63F77CAB6B17CA547074833C33FB2DE0D3657829267A1
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Target ID:	1
Start time:	22:49:56
Start date:	30/05/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\5q4psw.msi"
Imagebase:	0xff020000
File size:	128512 bytes
MD5 hash:	AC2E7152124CEED36846BD1B6592A00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	2
Start time:	22:49:57
Start date:	30/05/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0xff020000
File size:	128512 bytes
MD5 hash:	AC2E7152124CEED36846BD1B6592A00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	5
Start time:	22:50:24
Start date:	30/05/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Imagebase:	0xfff50000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	22:50:24
Start date:	30/05/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
Imagebase:	0xff070000
File size:	168960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	22:50:24
Start date:	30/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Imagebase:	0x230000
File size:	44544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000007.00000002.1048899180.000000000257D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000007.00000002.1048686575.000000000038D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	22:50:26
Start date:	30/05/2023
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0x6e0000
File size:	53760 bytes
MD5 hash:	C9905EA4C326DAB778B9297BA5BD1889
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00170499 Relevance: 2.6, APIs: 2, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?), ref: 0017051C

Memory Dump Source

Source File: 00000007.00000003.1043646144.0000000000170000.00000020.00001000.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_170000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 647806292e40d76c1808ca0a8b573877cb0d1ed87da1151593330ae6246e7e91
Instruction ID: 2f684714ef0f2ef2fed548f423b8f0a5e5c67df277463c438cc83852ed6b3e31
Opcode Fuzzy Hash: 647806292e40d76c1808ca0a8b573877cb0d1ed87da1151593330ae6246e7e91
Instruction Fuzzy Hash: 1B1170A2D48348EFDF1AC660DDC876D66B6EB1C305F6AC465E50E5B282D7314E80AB01

Uniqueness

Uniqueness Score: -1.00%

Function 001711A5 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.1043646144.0000000000170000.00000020.00001000.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_170000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0092f584a839dd62b4c13f44ce63d536f0c9e1244b20ab5f9c8e56308dbb263e
Instruction ID: 6fd9b26ad7ce6a2e4d174502409ac271e7fb7137f5ee6b61ab19cfcfcefab4aa
Opcode Fuzzy Hash: 0092f584a839dd62b4c13f44ce63d536f0c9e1244b20ab5f9c8e56308dbb263e
Instruction Fuzzy Hash: 133193B5D44209FBDF14EABCD885BAE7675EB18300FB5C051EA0EAB253D3354E80A751

Uniqueness

Uniqueness Score: -1.00%

Function 001707A4 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 001707D5

Memory Dump Source

Source File: 00000007.00000003.1043646144.0000000000170000.00000020.00001000.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_170000_rundll32.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 67133743171ce9d8cdc9a07f765dc30c570cf60d44af1830f195452f5f9a1b35
Instruction ID: d319bd11b4e6e186e2be8d1f1ae37068b5ba8ed2eefdfebcb073ee061efbd660
Opcode Fuzzy Hash: 67133743171ce9d8cdc9a07f765dc30c570cf60d44af1830f195452f5f9a1b35
Instruction Fuzzy Hash: 81013C34909349DFCB5ACF94C884EADB7B4BF08324F22C8C5E51AAB252C731A980DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00171C80 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00171C80

Memory Dump Source

Source File: 00000007.00000003.1043646144.0000000000170000.00000020.00001000.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_170000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fdae159f5b63167561a356be9577cc6a5469f915a5d238255440c61cf8b3ecaf
Instruction ID: 7f9e278f2a91e92e70ed19b542a3b0b78f32ad242de2182d4632738a100b18fd
Opcode Fuzzy Hash: fdae159f5b63167561a356be9577cc6a5469f915a5d238255440c61cf8b3ecaf
Instruction Fuzzy Hash: C8E04F70945209EACF15CBD8D1492FCB7F4AB14359F318416D40BAA100E3304A84EA51

Uniqueness

Uniqueness Score: -1.00%

Function 0017044F Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?), ref: 00170BBB

Memory Dump Source

Source File: 00000007.00000003.1043646144.0000000000170000.00000020.00001000.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_170000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2efa1e35d57d1254694c6657700579f5ecd92471f7d6fffa99b604cb6f312ba0
Instruction ID: b982426ab08416bb96dffab875d87644fcd27e8a466cc38b46f0e2d230d3c171
Opcode Fuzzy Hash: 2efa1e35d57d1254694c6657700579f5ecd92471f7d6fffa99b604cb6f312ba0
Instruction Fuzzy Hash: DFE04CB9914218EFDB5ACB54CD84EBDB775FB18304F658484E41573251C7319E50EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00170BB1 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?), ref: 00170BBB

Memory Dump Source

Source File: 00000007.00000003.1043646144.0000000000170000.00000020.00001000.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_170000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 11959dc47cbe69a1d1983ee25c8494f456e1724cc526d44f32103389f00dccd7
Instruction ID: d2dbcc55ca89c92fbf4b6cb785030ef6b70f07d5893bf8463ec9690cd0a155f5
Opcode Fuzzy Hash: 11959dc47cbe69a1d1983ee25c8494f456e1724cc526d44f32103389f00dccd7
Instruction Fuzzy Hash: 9EB01261404B40C3EB6B16504548BB8AF70AB0631CF56C8C4C1CF5140B8B748A48B772

Uniqueness

Uniqueness Score: -1.00%

Function 1002A53A Relevance: 1.3, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,00007E7E,00007E7E), ref: 1002A5FE

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d2d32f6414cb2bdb90e2278249cfc263d5e95a1b9243a6c2b3b9ae838f1e9570
Instruction ID: ee5bacc9b31a87c68dd149840c7c0cb0e2f944a2a3b9815833a80f196adc5e09
Opcode Fuzzy Hash: d2d32f6414cb2bdb90e2278249cfc263d5e95a1b9243a6c2b3b9ae838f1e9570
Instruction Fuzzy Hash: 88215B30D08929EFDF65CF84E988A8E7BB1FB06314FA040A1ED04A6111CB719ED0FB40

Uniqueness

Uniqueness Score: -1.00%

Function 1002A600 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00007E7E,00007E7E), ref: 1002A5FE

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a838df6ee52d58e2f5186a0d0d75b5f2ffc51b907e2f04fbf32939c20e722116
Instruction ID: 278c5a9de3e714cf87e1ab2279faa75398506c58c2b692d3dc3f64c22d89b254
Opcode Fuzzy Hash: a838df6ee52d58e2f5186a0d0d75b5f2ffc51b907e2f04fbf32939c20e722116
Instruction Fuzzy Hash: 54F05E71909515EFDF61DE40FC8878E3AB1FB86304FA44521FD1961151DB759AD0F640

Uniqueness

Uniqueness Score: -1.00%

Function 001704E8 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00002F24,?,00002F24), ref: 001704CD

Memory Dump Source

Source File: 00000007.00000003.1043646144.0000000000170000.00000020.00001000.00020000.00000000.sdmp, Offset: 00170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_170000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 459ceca762080cf357c362edab4f1ee4805586002f586a962786011784d06284
Instruction ID: 5a9f7b8fe7169759bdaa6b49b08ff65c10acbcbea61d76838b125431d07ca229
Opcode Fuzzy Hash: 459ceca762080cf357c362edab4f1ee4805586002f586a962786011784d06284
Instruction Fuzzy Hash: EAD01270C14348FFDB49CE908A847AD79B5FB08309F328414A20E66142C3340F10A600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 100A615C Relevance: 51.4, APIs: 14, Strings: 15, Instructions: 664COMMON

Download Yara Rule

APIs

mv_get_cpu_flags.MAIN ref: 100A61C1
mv_fast_realloc.MAIN ref: 100A640E
mv_bprint_init.MAIN ref: 100A6504
mv_bprintf.MAIN ref: 100A6538
mv_bprintf.MAIN ref: 100A65C8
mv_bprintf.MAIN ref: 100A65D8

Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DAAB
Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DB07
Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DB2B
Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DB5A
Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DB99
Part of subcall function 1004DA90: mv_bprintf.MAIN ref: 1004DBB9

mv_bprintf.MAIN ref: 100A6611
mv_bprintf.MAIN ref: 100A6636

Strings

mdct_int32, xrefs: 100A65A6
fft_int32, xrefs: 100A659F
unknown, xrefs: 100A6579
%s, xrefs: 100A68C4
fft_double, xrefs: 100A658A
rdft_int32, xrefs: 100A65AD
any, xrefs: 100A6574
mdct_float, xrefs: 100A6562
rdft_double, xrefs: 100A6598
(, xrefs: 100A6908
inverse, xrefs: 100A650E
mdct_double, xrefs: 100A6591
rdft_float, xrefs: 100A6583
fft_float, xrefs: 100A6551
forward, xrefs: 100A6509

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf$mv_bprint_initmv_fast_reallocmv_get_cpu_flags
String ID: %s$($any$fft_double$fft_float$fft_int32$forward$inverse$mdct_double$mdct_float$mdct_int32$rdft_double$rdft_float$rdft_int32$unknown
API String ID: 3119210720-3272017958
Opcode ID: 25040e6d6a9753b456abe214fbca7a930a5edd2d292909d605851bf2564771d6
Instruction ID: 8e365c97db9984c6de8945a7e442cfdf49085734b6247471425ef2e3cf29c5ab
Opcode Fuzzy Hash: 25040e6d6a9753b456abe214fbca7a930a5edd2d292909d605851bf2564771d6
Instruction Fuzzy Hash: 6A521275A09741CFCB50CF68C88065EBBF2FBC8250F658A2DE8999B354D735E981CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1002F110 Relevance: 39.2, APIs: 13, Strings: 9, Instructions: 668COMMON

Download Yara Rule

APIs

mv_small_strptime.MAIN ref: 1002F188

Strings

%H:%M, xrefs: 1002F68A
%J:%M:%S, xrefs: 1002F17C
%Y%m%d, xrefs: 1002F26D
gfff, xrefs: 1002F5CF
now, xrefs: 1002F233
%M:%S, xrefs: 1002F744
%H%M%S, xrefs: 1002F2E5
%H:%M:%S, xrefs: 1002F2CA
%Y - %m - %d, xrefs: 1002F251

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_small_strptime
String ID: %H%M%S$%H:%M$%H:%M:%S$%J:%M:%S$%M:%S$%Y - %m - %d$%Y%m%d$gfff$now
API String ID: 1704653723-929505383
Opcode ID: 02e139faec9299b2c862389e2453493f24e0b8e412685161cdfeeff446f18a58
Instruction ID: 646b59ec4b146e931ed9e50608571c6f79c7907caae039c014e067c05dcc172a
Opcode Fuzzy Hash: 02e139faec9299b2c862389e2453493f24e0b8e412685161cdfeeff446f18a58
Instruction Fuzzy Hash: 8042F471A083458FD714CF28D48076AFBE2EFC5384F95897EE889C7352E631D9468B82

Uniqueness

Uniqueness Score: -1.00%

Function 1000D4D0 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 306COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000D54C
mv_bprintf.MAIN ref: 1000D8F7

Strings

AMBI%d, xrefs: 1000D85F
%d channels (, xrefs: 1000D5A5
NONE, xrefs: 1000D60B
@%s, xrefs: 1000D642
USR%d, xrefs: 1000D808
%d channels, xrefs: 1000D8E7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: %d channels$%d channels ($@%s$AMBI%d$NONE$USR%d
API String ID: 3083893021-1306170362
Opcode ID: efc4cf4070b613ff96981b1c53d9dde21975b7a6fb51727448d4ce29c3f6a9dc
Instruction ID: a65011a6159dd3c9d8d2b84384c130b43f4f86832dc80880a9240f1aa98400e9
Opcode Fuzzy Hash: efc4cf4070b613ff96981b1c53d9dde21975b7a6fb51727448d4ce29c3f6a9dc
Instruction Fuzzy Hash: E6B1A675A087468BD704EF68C48062EB7E1FF98394F15882EE989C7345EB31ED44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10032510 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 10032539
BCryptGenRandom.BCRYPT ref: 10032563
BCryptCloseAlgorithmProvider.BCRYPT ref: 1003257A
mvpriv_open.MAIN ref: 10032597
_read.MSVCRT ref: 100325B7
_close.MSVCRT ref: 100325C1
mvpriv_open.MAIN ref: 100325DC
_read.MSVCRT ref: 100325FC
_close.MSVCRT ref: 10032606
clock.MSVCRT ref: 100326E8

Strings

Microsoft Primitive Provider, xrefs: 10032514
RNG, xrefs: 1003251A
N, xrefs: 10032855

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Crypt$AlgorithmProvider_close_readmvpriv_open$CloseOpenRandomclock
String ID: Microsoft Primitive Provider$N$RNG
API String ID: 4139849330-2077157618
Opcode ID: 18afe3c33630559fbd0355b581881ae8f3aa94268538246d15ca1b824b2066d5
Instruction ID: 296a7b6315f8af7d09067326692401f592c87ee6f10d7706e56fdac5cef6b261
Opcode Fuzzy Hash: 18afe3c33630559fbd0355b581881ae8f3aa94268538246d15ca1b824b2066d5
Instruction Fuzzy Hash: 55918E75A093108FE304EF38C9C061ABBE2EFC9312F95893EE9889B355E675D944CB51

Uniqueness

Uniqueness Score: -1.00%

Function 100132D0 Relevance: 28.6, APIs: 19, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd52e100bb25c0641e34a9b4921baf3855db5dcfffc71db4c92606c3f5dca5a
Instruction ID: 64132198df639edcb8f9d9942dd31ac045c1fee33f6b38aeafb66a389db015b7
Opcode Fuzzy Hash: cbd52e100bb25c0641e34a9b4921baf3855db5dcfffc71db4c92606c3f5dca5a
Instruction Fuzzy Hash: 2851AE79A04B518FCB10EF79D4C595AF7E0FF48214F41892DE9A98B309EB30F9858B91

Uniqueness

Uniqueness Score: -1.00%

Function 1002C390 Relevance: 28.4, APIs: 6, Strings: 10, Instructions: 402COMMON

Download Yara Rule

APIs

mv_opt_find2.MAIN ref: 1002C491

Strings

const_values array too small for %s, xrefs: 1002C984
all, xrefs: 1002C56F
max, xrefs: 1002C505
Unable to parse option value "%s", xrefs: 1002C9BD
The "%s" option is deprecated: %s, xrefs: 1002C850
default, xrefs: 1002C4D2
min, xrefs: 1002C51F
-, xrefs: 1002C7A2
%d%*1[:/]%d%c, xrefs: 1002C919
none, xrefs: 1002C54A

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_opt_find2
String ID: %d%*1[:/]%d%c$-$The "%s" option is deprecated: %s$Unable to parse option value "%s"$all$const_values array too small for %s$default$max$min$none
API String ID: 2189843566-679463259
Opcode ID: 4759d47900ada6b9e9bf303824872e064e666305b03fd95eb96eca29edeb881a
Instruction ID: 478a8a207ff5b5307f9cfef852e9a26e9f05da79b4c8f966c849b1b138e3b10c
Opcode Fuzzy Hash: 4759d47900ada6b9e9bf303824872e064e666305b03fd95eb96eca29edeb881a
Instruction Fuzzy Hash: CF023475A087498FC390DF69D08065BFBE5FFC9350F918A2EE9D987250EB35D8448B82

Uniqueness

Uniqueness Score: -1.00%

Function 1004C500 Relevance: 26.2, APIs: 17, Instructions: 666COMMON

Download Yara Rule

APIs

mv_tree_insert.MAIN ref: 1004C57E
mv_tree_find.MAIN ref: 1004C757
mv_tree_find.MAIN ref: 1004C776

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find$mv_tree_insert
String ID:
API String ID: 3047205218-0
Opcode ID: 80c4f16b25e93cf13fac10a13682a04c4d944ea14c030e41bdf2d1b908fff40c
Instruction ID: a50688713867d27fbf14d738fefbaa6eb2d970f68efb82bc5577a16e2e7c4afa
Opcode Fuzzy Hash: 80c4f16b25e93cf13fac10a13682a04c4d944ea14c030e41bdf2d1b908fff40c
Instruction Fuzzy Hash: 7152CF75A087499FC344DF1AC08091AFBE2FFC8654F658A2DE889DB315E730E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 10020830 Relevance: 23.4, APIs: 11, Strings: 2, Instructions: 634COMMON

Download Yara Rule

APIs

mv_image_get_buffer_size.MAIN ref: 10020869

Part of subcall function 10020660: mv_pix_fmt_desc_get.MAIN ref: 1002067F
Part of subcall function 10020660: mv_image_get_linesize.MAIN ref: 100206B4
Part of subcall function 10020660: mv_image_fill_linesizes.MAIN(?), ref: 10020748
Part of subcall function 10020660: mv_image_fill_plane_sizes.MAIN(?), ref: 100207AB

mv_pix_fmt_desc_get.MAIN ref: 10020873
mv_image_fill_linesizes.MAIN ref: 1002090C
mv_log.MAIN ref: 10020AE8
abort.MSVCRT ref: 10020AED
mv_pix_fmt_desc_get.MAIN ref: 10020B14
mv_pix_fmt_count_planes.MAIN ref: 10020B1E

Strings

Assertion %s failed at %s:%d, xrefs: 10020AE0
, xrefs: 10021013

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_pix_fmt_desc_get$mv_image_fill_linesizes$abortmv_image_fill_plane_sizesmv_image_get_buffer_sizemv_image_get_linesizemv_logmv_pix_fmt_count_planes
String ID: $Assertion %s failed at %s:%d
API String ID: 1281078460-3513380740
Opcode ID: c6aa44ff7cc2dd3ec536464cbf8ee4c7033008b01ecee55ae96f81af4c4c6a53
Instruction ID: 773bde96130699db78e658d80479c0383b6257f66772b6af4f59ee2ed46427a0
Opcode Fuzzy Hash: c6aa44ff7cc2dd3ec536464cbf8ee4c7033008b01ecee55ae96f81af4c4c6a53
Instruction Fuzzy Hash: E9427E75A083858FC760CF28D48069EBBE2FFC8354F96892DF99997312D771E9418B42

Uniqueness

Uniqueness Score: -1.00%

Function 10013100 Relevance: 22.6, APIs: 15, Instructions: 142COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 10013116
mv_mallocz.MAIN ref: 10013128
mv_mallocz.MAIN ref: 10013154
mv_mallocz.MAIN ref: 100131C3
mv_calloc.MAIN ref: 100132A0

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_calloc
String ID:
API String ID: 1417229449-0
Opcode ID: 11c5df3fdc17ecbdb580f76e82102d0b651416b72ae8ebbfb0f71fad63a734a3
Instruction ID: 5eac887c21a6c61861bed7af62f95aa57474651100df0996b3e61034f298f0f1
Opcode Fuzzy Hash: 11c5df3fdc17ecbdb580f76e82102d0b651416b72ae8ebbfb0f71fad63a734a3
Instruction Fuzzy Hash: 4151F574605B529BC750EF69D88061AF7E0FF48794F42892CE9958B309EB34F890CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 1004E3E0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1004E40E
mv_log.MAIN ref: 1004E4A5
mv_log.MAIN ref: 1004E518
mv_log.MAIN ref: 1004E583
mv_log.MAIN ref: 1004E5F6
mv_log.MAIN ref: 1004E66A
mv_log.MAIN ref: 1004E6DA
mv_log.MAIN ref: 1004E74A
mv_log.MAIN ref: 1004E7BA

Strings

, xrefs: 1004E3FB, 1004E48C, 1004E4FF, 1004E56A, 1004E5DD, 1004E657, 1004E6C7, 1004E737, 1004E7A7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID:
API String ID: 2418673259-399585960
Opcode ID: 22cdb019eb22855181cd6e508c806dde92fa5c269c700c41bc7c92eb19578fc7
Instruction ID: 2a63a735ee4446ece5056bc05f6be1e2204befa447e9d9112aa6660a5f998af8
Opcode Fuzzy Hash: 22cdb019eb22855181cd6e508c806dde92fa5c269c700c41bc7c92eb19578fc7
Instruction Fuzzy Hash: C7F10974A083468FC754CF29C480A4BB7E1FF88354F61892EE999D7312E770E9458B86

Uniqueness

Uniqueness Score: -1.00%

Function 1002C428 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 134COMMON

Download Yara Rule

APIs

mv_opt_find2.MAIN ref: 1002C491
mv_expr_parse_and_eval.MAIN ref: 1002C5F5

Strings

all, xrefs: 1002C56F
max, xrefs: 1002C505
min, xrefs: 1002C51F
default, xrefs: 1002C4D2
none, xrefs: 1002C54A

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_expr_parse_and_evalmv_opt_find2
String ID: all$default$max$min$none
API String ID: 1085414910-3292705889
Opcode ID: 4ac8a3243c0db78ed30247e43ff312a6be18ac279b61e635c90502b5a9933884
Instruction ID: 18531c70e26c900463f27e75ba25a0c49568f7c26c871f4daec10b5f5a2a946d
Opcode Fuzzy Hash: 4ac8a3243c0db78ed30247e43ff312a6be18ac279b61e635c90502b5a9933884
Instruction Fuzzy Hash: FD512574A097458BC391EF68E04079BBBE5FFC9354F618A2EE8C8C7200EB71D8448B42

Uniqueness

Uniqueness Score: -1.00%

Function 10012A70 Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 10012A96
mv_mallocz.MAIN ref: 10012AA8
mv_mallocz.MAIN ref: 10012AB6
mv_calloc.MAIN ref: 10012ACD

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_calloc
String ID:
API String ID: 1417229449-0
Opcode ID: 120c092516309b251ece8b0e79d11a8b170fe8de52fc652575ee7012228408d0
Instruction ID: 92956a2d1d3baa5ba05d42f33decdb2ad021b9d4684d2735edf6a3dd4ed8fbb8
Opcode Fuzzy Hash: 120c092516309b251ece8b0e79d11a8b170fe8de52fc652575ee7012228408d0
Instruction Fuzzy Hash: 0421F4B89087508BCB44DF2595C011BBBE0FF88654F82496DED849B30AE734EA61CB86

Uniqueness

Uniqueness Score: -1.00%

Function 1000D910 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000DA4E
mv_bprint_chars.MAIN ref: 1000DAA5
mv_channel_layout_describe_bprint.MAIN ref: 1000DAB5
mv_log.MAIN ref: 1000DB8E
abort.MSVCRT ref: 1000DB93

Strings

ambisonic %d, xrefs: 1000DA42

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_bprint_charsmv_bprintfmv_channel_layout_describe_bprintmv_log
String ID: ambisonic %d
API String ID: 3836754782-1019176007
Opcode ID: b34a5ce10fbd8834e3f4ae1ba03fa64c57cec5e69a3d579a25b9253d3ac1963c
Instruction ID: fcb70f02e0754f6f7d847351f1522eb27181b5797a445abb94d138a7096ea4de
Opcode Fuzzy Hash: b34a5ce10fbd8834e3f4ae1ba03fa64c57cec5e69a3d579a25b9253d3ac1963c
Instruction Fuzzy Hash: B66182B3B246054BE704DE28C88135DB6D2EBD8274F0DC63EE98AD7749EA34DD418792

Uniqueness

Uniqueness Score: -1.00%

Function 10013480 Relevance: 9.3, APIs: 6, Instructions: 286COMMON

Download Yara Rule

APIs

mv_encryption_init_info_alloc.MAIN ref: 10013562

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_encryption_init_info_alloc
String ID:
API String ID: 3189372936-0
Opcode ID: 40eb082df2a873b27e792bc7caffd1106743bd01b0e16bd1d615b7bb6c7bfb03
Instruction ID: a1e043498c3c16070c5ce0a7d842a7d55674a9d60fbffb8ceeaa7ba958246eb1
Opcode Fuzzy Hash: 40eb082df2a873b27e792bc7caffd1106743bd01b0e16bd1d615b7bb6c7bfb03
Instruction Fuzzy Hash: ACB169B1A083418FC764CF29C58461BFBE2FFC8254F56896DE9899B350E731E981CB52

Uniqueness

Uniqueness Score: -1.00%

Function 10028590 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 267stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10028711

Strings

INT64_MIN, xrefs: 100288C6
INT64_MAX, xrefs: 10028886
%d:%02d.%06d, xrefs: 10028700
%d.%06d, xrefs: 100288F3
%lld:%02d:%02d.%06d, xrefs: 10028866

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strlen
String ID: %d.%06d$%d:%02d.%06d$%lld:%02d:%02d.%06d$INT64_MAX$INT64_MIN
API String ID: 39653677-2240581584
Opcode ID: 0fc159dbdf919121d5ae85b4b67d03e61a1cce094bcc318245b853e9ada1757b
Instruction ID: c54e951a0f1896a6386a6c5c1f669f1c3c64ce07789a61242c38440661c84367
Opcode Fuzzy Hash: 0fc159dbdf919121d5ae85b4b67d03e61a1cce094bcc318245b853e9ada1757b
Instruction Fuzzy Hash: A8A16D76A193118FC308CF6DC44421EFBE6EBC8350F998A2EF488D7364DA74D9058B82

Uniqueness

Uniqueness Score: -1.00%

Function 1000C9F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

%d channels, xrefs: 1000CAF8

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %d channels
API String ID: 0-1351059727
Opcode ID: 125e0846f57f9b032cdce6562afb1258b5259d1002a50140fed6246712bc4ce9
Instruction ID: fbd93282e394e78ed831cdfa1163249771b383e02731abb89eb949a6102d5748
Opcode Fuzzy Hash: 125e0846f57f9b032cdce6562afb1258b5259d1002a50140fed6246712bc4ce9
Instruction Fuzzy Hash: 5551B776B147458BD308DF68D85121EB7E2FBD43A0F58C82DE586C7345DA35ED428782

Uniqueness

Uniqueness Score: -1.00%

Function 10007270 Relevance: 6.3, APIs: 4, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355135263088e94a10b3081d7ca45438585c75b071c068879c5feec0f380323f
Instruction ID: 51e70f272ae0093965207845ec1cb951f05259167ff59344558e7544d7b47f58
Opcode Fuzzy Hash: 355135263088e94a10b3081d7ca45438585c75b071c068879c5feec0f380323f
Instruction Fuzzy Hash: 69C19E71A087858BD350CF2D888064EBBE1FFC9294F198A2EF9D8C7355E675D9448B42

Uniqueness

Uniqueness Score: -1.00%

Function 10020B00 Relevance: 6.2, APIs: 4, Instructions: 194COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN ref: 10020B14
mv_pix_fmt_count_planes.MAIN ref: 10020B1E
mv_write_image_line.MAIN(?), ref: 10020D5C
mv_image_get_linesize.MAIN ref: 10020DA4

Strings

Assertion %s failed at %s:%d, xrefs: 10020AE0
, xrefs: 10021013

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_image_get_linesizemv_pix_fmt_count_planesmv_pix_fmt_desc_getmv_write_image_line
String ID: $Assertion %s failed at %s:%d
API String ID: 2742463661-3513380740
Opcode ID: dfac4c9c3e2b2a6659d2d83ec8970682280816447ca476019a7c42da2599a3de
Instruction ID: 7291b42ecfa30c9ded9631a3f5ec54be9a0a2bb908f309bcd4ce331d09022d6a
Opcode Fuzzy Hash: dfac4c9c3e2b2a6659d2d83ec8970682280816447ca476019a7c42da2599a3de
Instruction Fuzzy Hash: 0F7129759093458BC761DF69E48029AFBE2FFC8354F968D2EE899C7211D770E8408B82

Uniqueness

Uniqueness Score: -1.00%

Function 10098118 Relevance: 5.3, Strings: 4, Instructions: 270COMMON

Download Yara Rule

Strings

gfff, xrefs: 10098243
., xrefs: 10098414
gfff, xrefs: 1009822C
@, xrefs: 100982D9

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: .$@$gfff$gfff
API String ID: 0-2633265772
Opcode ID: 1a96870f25700b4f619f96355033705c23d8640121cae616d73658099f59e725
Instruction ID: 88ed55b374b91f7029d25279d4dc518c5e58f5803cb7bd7bc1eaa9a5779130ae
Opcode Fuzzy Hash: 1a96870f25700b4f619f96355033705c23d8640121cae616d73658099f59e725
Instruction Fuzzy Hash: D0A16E71A04746CBD704CE29C88430BBBE1EF84794F19C92DE8989B355E770EE49DB92

Uniqueness

Uniqueness Score: -1.00%

Function 1008F660 Relevance: 4.6, APIs: 3, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 1008F681

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: b69c75700f75219a74068cccd1dca2d98ce45db577427034a577193da62bee99
Instruction ID: 644768b22c3724b228d8b808f31f7f684975bc292c311e4257fcfe74704407b1
Opcode Fuzzy Hash: b69c75700f75219a74068cccd1dca2d98ce45db577427034a577193da62bee99
Instruction Fuzzy Hash: D32125B08093119FDB10EF34D5C936ABBE0FF88354F018A2DE88587254E778D884CB52

Uniqueness

Uniqueness Score: -1.00%

Function 10080660 Relevance: 4.0, Strings: 2, Instructions: 1532COMMON

Download Yara Rule

Strings

, xrefs: 10081A6D
, xrefs: 10081A74

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 6fd3c9181117af1588f895db508848a7fe2041e06b4ede146a6400b05576f826
Instruction ID: 27a4ed98bf9c25b7b0ab4f703cc1de2c0a71aadacb2ac3823d64191068bff582
Opcode Fuzzy Hash: 6fd3c9181117af1588f895db508848a7fe2041e06b4ede146a6400b05576f826
Instruction Fuzzy Hash: 78E224B1B003598FDB28CF2DC991389B7E6BB8C310F09863EAC89D7755D6789D458B81

Uniqueness

Uniqueness Score: -1.00%

Function 1004B2B0 Relevance: 4.0, Strings: 3, Instructions: 239COMMON

Download Yara Rule

Strings

gfff, xrefs: 1004B311
gfff, xrefs: 1004B3FC
gfff, xrefs: 1004B48C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: gfff$gfff$gfff
API String ID: 0-4275324669
Opcode ID: fe7beb6bbb1309a31ac6102e863e5a24cddba949dbada84ffe1642a77b23e691
Instruction ID: 6e38d88d3cd0efd9d9cd182852fcce1d7090011af53c37e374a65a5619e36939
Opcode Fuzzy Hash: fe7beb6bbb1309a31ac6102e863e5a24cddba949dbada84ffe1642a77b23e691
Instruction Fuzzy Hash: 10719532B047164BD358CE2ECD8020ABBD7EBC8350F598A3DE599CB395DA70ED158B81

Uniqueness

Uniqueness Score: -1.00%

Function 100857F0 Relevance: 3.3, Strings: 2, Instructions: 814COMMON

Download Yara Rule

Strings

, xrefs: 1008625C
, xrefs: 10086254

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: a91a1251ad0a0e377302b14c4af55ce309aa8aa50d665d79167b33421984c126
Instruction ID: 972c1d3150a0c6be4cbba2329d1db571b0fd8e8f06b051dbdb6a50c66f540437
Opcode Fuzzy Hash: a91a1251ad0a0e377302b14c4af55ce309aa8aa50d665d79167b33421984c126
Instruction Fuzzy Hash: 7F72F675B047069FC70CDE2DC891399F7E5BB8C310F09C63EA89A83745DB78A9598B81

Uniqueness

Uniqueness Score: -1.00%

Function 10088194 Relevance: 3.3, Strings: 2, Instructions: 800COMMON

Download Yara Rule

Strings

, xrefs: 10088B62
, xrefs: 10088B67

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 190c9ede49d876a345d641f98c1cb4f45a22d81b33dfb6ccf71ac0a7e3213ad1
Instruction ID: 8fc681939e9e3bb15c4cfec1c3dbff6a6facdc0add524c48ef0f17546c9d919b
Opcode Fuzzy Hash: 190c9ede49d876a345d641f98c1cb4f45a22d81b33dfb6ccf71ac0a7e3213ad1
Instruction Fuzzy Hash: 587238B1B003558FDB28CF2DC881389B7E6BBCC310F09C63EA949DB755D6749A498B85

Uniqueness

Uniqueness Score: -1.00%

Function 10081091 Relevance: 3.3, Strings: 2, Instructions: 778COMMON

Download Yara Rule

Strings

, xrefs: 10081A6D
, xrefs: 10081A74

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: b4afbf0de2936a940502192aa127a54f7e5d45448a1c3de9945ab114a676ba9a
Instruction ID: 7ea1a9c3d22071ba8789d8348bc838f98b70990652e341448c655628b0634421
Opcode Fuzzy Hash: b4afbf0de2936a940502192aa127a54f7e5d45448a1c3de9945ab114a676ba9a
Instruction Fuzzy Hash: 63622475B043488FDB68CE2DC9913C9B7E2BB8C310F09863EA88DDB745D6789D458B81

Uniqueness

Uniqueness Score: -1.00%

Function 10087748 Relevance: 3.3, Strings: 2, Instructions: 777COMMON

Download Yara Rule

Strings

, xrefs: 10088173
, xrefs: 10088178

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 16f6de066b279db5e54fcd4adaf93d1368a37d6b99bafdb5bc801e57391512ac
Instruction ID: ce981d1cc0724b58033acc55b46a376f784f2f1e6f2710373a118482dca14d85
Opcode Fuzzy Hash: 16f6de066b279db5e54fcd4adaf93d1368a37d6b99bafdb5bc801e57391512ac
Instruction Fuzzy Hash: C2623671B003598FDB28CF2DC9913C9B6E6BBCC310F09863EA889DB755D6749E458B81

Uniqueness

Uniqueness Score: -1.00%

Function 100842F0 Relevance: 3.3, Strings: 2, Instructions: 776COMMON

Download Yara Rule

Strings

, xrefs: 10084D18
, xrefs: 10084D13

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 948bf2bd23e64e35a61d3ded842bee3e0d4ec94bc0de09769f67e650174ebafe
Instruction ID: b19f2a14b5ade5b0b8083f0bfe019e2d0c6b2526b01c4da696241c83efedee47
Opcode Fuzzy Hash: 948bf2bd23e64e35a61d3ded842bee3e0d4ec94bc0de09769f67e650174ebafe
Instruction Fuzzy Hash: 98622B71B002598FDB28CE2DC9813CDB6E6BBCC314F09C53EA889DB755DA749E458B81

Uniqueness

Uniqueness Score: -1.00%

Function 10087750 Relevance: 3.3, Strings: 2, Instructions: 776COMMON

Download Yara Rule

Strings

, xrefs: 10088173
, xrefs: 10088178

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: f0cd3dabb9e9b6583c0ed00182b844eedfd5536ca59a638b0eb35a6b9abb8002
Instruction ID: 034730f4c7d74994eeddd26650854f6c448e29a341e3b0a91aca4cb0aa753e9a
Opcode Fuzzy Hash: f0cd3dabb9e9b6583c0ed00182b844eedfd5536ca59a638b0eb35a6b9abb8002
Instruction Fuzzy Hash: 6E623671B003598FDB28CF2DC9913C9B6E6BBCC310F09863EA889DB755D6749E458B81

Uniqueness

Uniqueness Score: -1.00%

Function 10086310 Relevance: 3.2, Strings: 2, Instructions: 743COMMON

Download Yara Rule

Strings

, xrefs: 10086CA3
, xrefs: 10086CA8

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 2adc38692b4dba453ddc0daa820c9e46ea653bb0c5d31e5813356c9d36655b72
Instruction ID: 88364c6e534ce9109b01b87a12bc7110fb245ac6aa888d6aecf88a9e786e3146
Opcode Fuzzy Hash: 2adc38692b4dba453ddc0daa820c9e46ea653bb0c5d31e5813356c9d36655b72
Instruction Fuzzy Hash: 7D623A71B002598FDB28CF2DCD8538DB6E6BBCC314F0AC23AA949DB754D6749E458B84

Uniqueness

Uniqueness Score: -1.00%

Function 10082550 Relevance: 3.2, Strings: 2, Instructions: 743COMMON

Download Yara Rule

Strings

, xrefs: 10082EE8
, xrefs: 10082EE3

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 7bb440087b05080476a02e4a1ddb46d1ca10b6288ac3f83932febcf60076a0ba
Instruction ID: 034d2c67b359ae69a957bb0842cf7cad10bcd7b786eb12866f5fd0dccb38987e
Opcode Fuzzy Hash: 7bb440087b05080476a02e4a1ddb46d1ca10b6288ac3f83932febcf60076a0ba
Instruction Fuzzy Hash: B26248B1B002598FCB28CE2DCD953CDB6E6BBCC314F09823EA949DB745D6749E458B84

Uniqueness

Uniqueness Score: -1.00%

Function 10013860 Relevance: 3.2, APIs: 2, Instructions: 222COMMON

Download Yara Rule

APIs

mv_malloc.MAIN ref: 10013AE8

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_malloc
String ID:
API String ID: 3797683224-0
Opcode ID: d0f46ac01df2d66eedf7921aeb8116c9143c8572b1c9a41cb75b5c2ebe5f539e
Instruction ID: d9cd303cd0cdd735b109894e0513b1deaf0e71c410b9c65df79ef7a199e1e6cc
Opcode Fuzzy Hash: d0f46ac01df2d66eedf7921aeb8116c9143c8572b1c9a41cb75b5c2ebe5f539e
Instruction Fuzzy Hash: B3718CB2A042568BCB14CF28C88175AB7E2FF84354F66C568ED899F341E671ED81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 100084B0 Relevance: 3.2, APIs: 2, Instructions: 185COMMON

Download Yara Rule

APIs

mv_blowfish_crypt_ecb.MAIN ref: 10008642

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_blowfish_crypt_ecb
String ID:
API String ID: 997994871-0
Opcode ID: e25778ea9fdb925930b24f7ee5b61e2c5b198a0ae9bacbd401b09897083a4e10
Instruction ID: d8ffb9ab9be6425fb2f2151958634ca33b63df147d529954a2eeef9d18f7c60e
Opcode Fuzzy Hash: e25778ea9fdb925930b24f7ee5b61e2c5b198a0ae9bacbd401b09897083a4e10
Instruction Fuzzy Hash: 537145B19097818BC709CF29D5C846AFBE1FFC9245F118A5EE8DC87344E270AA04CB62

Uniqueness

Uniqueness Score: -1.00%

Function 100774E2 Relevance: 2.4, Strings: 1, Instructions: 1133COMMON

Download Yara Rule

Strings

<, xrefs: 10078382

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: c7787c3b14f80e01f53518ebbce28839c2deec08409873a47eabaf8b3c714c82
Instruction ID: 3fd6811098af7138a6a9628f140dfff3b7bdce2196f1c46684414acbc60ce241
Opcode Fuzzy Hash: c7787c3b14f80e01f53518ebbce28839c2deec08409873a47eabaf8b3c714c82
Instruction Fuzzy Hash: 83B20675A083458FC318CF6DC881B4AFBE2BBC8354F198A3EE58987765D674E845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 100752F0 Relevance: 2.2, Strings: 1, Instructions: 980COMMON

Download Yara Rule

Strings

, xrefs: 10075E70

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 641a198c02e26966d2062e0053ab908e5e5a277c8f98988520ef612f009bed59
Instruction ID: 43e44a4b83fab764415e1025b301afb79c6204bc9dcc01db161338078a8a8597
Opcode Fuzzy Hash: 641a198c02e26966d2062e0053ab908e5e5a277c8f98988520ef612f009bed59
Instruction Fuzzy Hash: AC920676B047148FC718CE29D98024AFBE2BBCC314F1A8A3EAD9993755D674ED058F81

Uniqueness

Uniqueness Score: -1.00%

Function 100218A0 Relevance: 2.2, APIs: 1, Instructions: 724COMMON

Download Yara Rule

APIs

mv_mod_i.MAIN ref: 10022129

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mod_i
String ID:
API String ID: 416848386-0
Opcode ID: a8d4099fe6c0eb055b727cce64fe07889f2056542eb8a35ea18b6c28ee92d382
Instruction ID: 1978e8aa041b561afe43b5e1e9d69cc5e5589bc87bfac444af9f8de18395159f
Opcode Fuzzy Hash: a8d4099fe6c0eb055b727cce64fe07889f2056542eb8a35ea18b6c28ee92d382
Instruction Fuzzy Hash: CE623875A083A18BD324CF69C04066EF7E2FFC8750F568A1EE9D997390D774A840CB96

Uniqueness

Uniqueness Score: -1.00%

Function 1007A0F3 Relevance: 2.1, Strings: 1, Instructions: 886COMMON

Download Yara Rule

Strings

$, xrefs: 1007AA97

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: fe4a0db042f0e8aae59756d567f16e575c9402a786daae64c0709e6c3677e7bd
Instruction ID: 2178077c91711aa46356c5d4d239d896c71c523479eaa19c43c4ee5b4459259c
Opcode Fuzzy Hash: fe4a0db042f0e8aae59756d567f16e575c9402a786daae64c0709e6c3677e7bd
Instruction Fuzzy Hash: 3D823575B083418FD718CF2DC88175AF7E6BBC8314F098A2EE98AD7755D674E8448B82

Uniqueness

Uniqueness Score: -1.00%

Function 10079740 Relevance: 2.0, Strings: 1, Instructions: 765COMMON

Download Yara Rule

Strings

8, xrefs: 10079EFD

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 4bb01df27a01def8c24a3064336be394080f429d78acff62f573d229e26dba3e
Instruction ID: 659be22c3e52018aa2745c097637c4ffca2e202117ad66bf3827cb74a2e1471d
Opcode Fuzzy Hash: 4bb01df27a01def8c24a3064336be394080f429d78acff62f573d229e26dba3e
Instruction Fuzzy Hash: 6A6202757083058FC748CF6DC89175AF7E6BBCC304F098A3EA98AC7765D678A8458B42

Uniqueness

Uniqueness Score: -1.00%

Function 1007D347 Relevance: 1.9, Strings: 1, Instructions: 665COMMON

Download Yara Rule

Strings

$, xrefs: 1007DA42

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: aa70a164bd52ec31f03b4266804eca02e75dabac3be788ef91e1de1e2c1590b5
Instruction ID: ce5b39af18f764baa09b40a2238384aa5d89d39e9ed9e4e5b8039b7fba20e69b
Opcode Fuzzy Hash: aa70a164bd52ec31f03b4266804eca02e75dabac3be788ef91e1de1e2c1590b5
Instruction Fuzzy Hash: 28523875A083458FC728CF2DC58075AFBE6FBC8304F098A2EE98997755D674A944CF82

Uniqueness

Uniqueness Score: -1.00%

Function 10032890 Relevance: 1.9, APIs: 1, Instructions: 385COMMON

Download Yara Rule

APIs

mv_gcd.MAIN ref: 1003292D

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_gcd
String ID:
API String ID: 2848192316-0
Opcode ID: 94c61de4151f85b2e349843c83d37783726b6990a1d380f2b046a8bb30d58925
Instruction ID: bae91829bd6a7d55044bc074d33ea4c9e53b069e54380698bce3da439848f8c3
Opcode Fuzzy Hash: 94c61de4151f85b2e349843c83d37783726b6990a1d380f2b046a8bb30d58925
Instruction Fuzzy Hash: A3F1CE75A083518FC358CF2AC48061AFBE6BFC8750F559A2EF998D7360D670E8458F82

Uniqueness

Uniqueness Score: -1.00%

Function 10079010 Relevance: 1.8, Strings: 1, Instructions: 574COMMON

Download Yara Rule

Strings

(, xrefs: 10079507

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 162831e4797be57d8b0c67c98ae7b1737106273c419fc07e23e37c8db0e1006c
Instruction ID: c9b53467aca63bfb1ff6328fb2ba50d2d2c897da2dfc5778b259f989fe58c822
Opcode Fuzzy Hash: 162831e4797be57d8b0c67c98ae7b1737106273c419fc07e23e37c8db0e1006c
Instruction Fuzzy Hash: 2032E175A083058FC708CF29C98175AF7E6BBC8314F098A3EA989D7766D674ED058B42

Uniqueness

Uniqueness Score: -1.00%

Function 1001EAB0 Relevance: 1.8, APIs: 1, Instructions: 297COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,1001B0CD), ref: 1001EAC6

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_pix_fmt_desc_get
String ID:
API String ID: 2427544746-0
Opcode ID: b892691f4f349c96ba1384667e915caf21722faef09a2027f66083ef5ed52c75
Instruction ID: 783a62940874baa8ec3945e1bd9358386c9619e9dd1953521893957c1d9dab46
Opcode Fuzzy Hash: b892691f4f349c96ba1384667e915caf21722faef09a2027f66083ef5ed52c75
Instruction Fuzzy Hash: BDA1D27070839A8FD748DF29C85166EBBD1EB84350F154A3EE866CF791EA31ED858B40

Uniqueness

Uniqueness Score: -1.00%

Function 1007D511 Relevance: 1.8, Strings: 1, Instructions: 533COMMON

Download Yara Rule

Strings

$, xrefs: 1007DA42

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1b42ee59f21a204cb6b077af68c2de368fdd964a749b776b237f483907014f4d
Instruction ID: 260964c7a2cfbcc0de303297e479b20c25a7b76d0ed562b33145cefc6d544c56
Opcode Fuzzy Hash: 1b42ee59f21a204cb6b077af68c2de368fdd964a749b776b237f483907014f4d
Instruction Fuzzy Hash: B6322776A083458FC318CF6DC98075AF7E6FBC8304F098A2EE98997755D674A845CF82

Uniqueness

Uniqueness Score: -1.00%

Function 1002B270 Relevance: 1.7, APIs: 1, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_d2q.MAIN ref: 1002B5CC

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_d2q
String ID:
API String ID: 1563177686-0
Opcode ID: 45c5f2c89ee507ef39802a9a888517dd343027a0df61cf4b6a57416ffd5af97e
Instruction ID: 1f0a7b361e8469cdb879426936d90b34354dbc15308211f32f0c3676d5f7708e
Opcode Fuzzy Hash: 45c5f2c89ee507ef39802a9a888517dd343027a0df61cf4b6a57416ffd5af97e
Instruction Fuzzy Hash: 19715C34608F46CFC356DF38D08060AF7B1FF86340F968B99E9566B256EB31E8859B41

Uniqueness

Uniqueness Score: -1.00%

Function 1001363B Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

mv_encryption_init_info_alloc.MAIN ref: 10013562

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_encryption_init_info_alloc
String ID:
API String ID: 3189372936-0
Opcode ID: cd6924afccd7b87e315566fc0b34ac7627ccdbad5b7df46105264a39c2b01be1
Instruction ID: 78d0e82bed4cec982bfd679939fa63163902b3eee1ff480991edcad54221ee49
Opcode Fuzzy Hash: cd6924afccd7b87e315566fc0b34ac7627ccdbad5b7df46105264a39c2b01be1
Instruction Fuzzy Hash: 1951F5B1A087419FC744CF29C58451ABBE2FFC8654F56CA2DF889A7350D731ED458B82

Uniqueness

Uniqueness Score: -1.00%

Function 100136FB Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

mv_encryption_init_info_alloc.MAIN ref: 10013562

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_encryption_init_info_alloc
String ID:
API String ID: 3189372936-0
Opcode ID: ef5d398cf4f7091da99b035e9d0245d92d88978e73b2c3d1eb8e068e5064dbea
Instruction ID: 95a8c643b77e51546d68e8d33e3f4ed292e5d24ad01eeb6ce01257d6c0bf5d32
Opcode Fuzzy Hash: ef5d398cf4f7091da99b035e9d0245d92d88978e73b2c3d1eb8e068e5064dbea
Instruction Fuzzy Hash: 2D5128B1A087419FC744CF29C58461AFBE2FFC8654F56C92DE889AB350D731ED428B82

Uniqueness

Uniqueness Score: -1.00%

Function 10002480 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

mv_aes_crypt.MAIN ref: 10002554

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_aes_crypt
String ID:
API String ID: 1547198422-0
Opcode ID: a76755bfb4d6463656838ecde433fd04cde547babbb3dbb5163c6ebd5a4d3b10
Instruction ID: 6533aa27bc2eace4d46e94b1d96a72d5c0883edd5f4be066e5c3eb9db2eb8fbd
Opcode Fuzzy Hash: a76755bfb4d6463656838ecde433fd04cde547babbb3dbb5163c6ebd5a4d3b10
Instruction Fuzzy Hash: 81419D3510D7C18FD301CF69848054AFFE1FF99288F198A6DE8D993306D260EA09CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1000EAC0 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

mv_channel_layout_index_from_string.MAIN ref: 1000EAD6

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_layout_index_from_string
String ID:
API String ID: 1941520394-0
Opcode ID: b5427e202f8ac7429ec52a8e90e2a2ab38b9bd65bff75006616c9072962c14a1
Instruction ID: dd8c77e47ba7934b60b61c42e329a9640ddafb1186b5f9bdd33cfe49ccecab15
Opcode Fuzzy Hash: b5427e202f8ac7429ec52a8e90e2a2ab38b9bd65bff75006616c9072962c14a1
Instruction Fuzzy Hash: 6331E4B7F1476A0BE7209999DCC0216B3C0EB88270B4E863DDE5AA7786F551BD1582C1

Uniqueness

Uniqueness Score: -1.00%

Function 10002523 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

mv_aes_crypt.MAIN ref: 10002554

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_aes_crypt
String ID:
API String ID: 1547198422-0
Opcode ID: 3928a72eaf0bdf75db777ef61b97453f1547db555a5c878ed5744eb0c7f909a7
Instruction ID: b15eea7d1e62e16a03610dfd725cbd08b0199710858140edd711ee624ae9ea9b
Opcode Fuzzy Hash: 3928a72eaf0bdf75db777ef61b97453f1547db555a5c878ed5744eb0c7f909a7
Instruction Fuzzy Hash: DC31C47610D7C18FD302CB6990C0099FFE1FF99248F198AADE4DD93706D264EA19CB62

Uniqueness

Uniqueness Score: -1.00%

Function 100A5843 Relevance: 1.6, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

((((, xrefs: 100A60F0

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: ((((
API String ID: 0-443828677
Opcode ID: 4973b07765d4ec89b018a8d06673ab4f666873d277b7ebb3a3bf4dc23d5cb217
Instruction ID: 0194c72f9be4bebdfae36609316a9b213b64d1e624968bee424045f40660fc3c
Opcode Fuzzy Hash: 4973b07765d4ec89b018a8d06673ab4f666873d277b7ebb3a3bf4dc23d5cb217
Instruction Fuzzy Hash: 18C1942810D3D18AD745CF7880A05AFBFE2AFDA245F455D6DE4D997302C32A890DDB63

Uniqueness

Uniqueness Score: -1.00%

Function 1000867B Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

mv_blowfish_crypt_ecb.MAIN ref: 100086C2

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_blowfish_crypt_ecb
String ID:
API String ID: 997994871-0
Opcode ID: acf8950ea6c148c44c64157bc22eca501f0550abc9d144bf7c67352d16790dd9
Instruction ID: 3ce9d50094e6346554c2820e15aae8c95f0dca09f8e32c6084807ed2f7b375be
Opcode Fuzzy Hash: acf8950ea6c148c44c64157bc22eca501f0550abc9d144bf7c67352d16790dd9
Instruction Fuzzy Hash: 26019DB59093448FC709CF18E48842AFBE0FB8C355F11892EF8CCA7740E774AA448B46

Uniqueness

Uniqueness Score: -1.00%

Function 10010750 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

9%lld, xrefs: 10010911

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: bcdcc6efd6621e1f85b7218b7b67dfd4e03329ea09515bb0419dbee41511919b
Instruction ID: 101352dd42f6db591cdfd1097ab698e3354d26ef9933b018def11634da6c13ef
Opcode Fuzzy Hash: bcdcc6efd6621e1f85b7218b7b67dfd4e03329ea09515bb0419dbee41511919b
Instruction Fuzzy Hash: AB613D76A187158FD308DF29D88025AF7E2FBC8310F49892DF999DB351E674EC059B82

Uniqueness

Uniqueness Score: -1.00%

Function 10010980 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

9%lld, xrefs: 10010B38

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: 5513a2eee4d2361defe977553411883ee58bb0119317c7a243b664d72bd759ad
Instruction ID: d0a6a35fac9b25aaf09e145393e53881d6b3ad243d3648f8ad8ecf29fe2e883f
Opcode Fuzzy Hash: 5513a2eee4d2361defe977553411883ee58bb0119317c7a243b664d72bd759ad
Instruction Fuzzy Hash: DB515976A187158FD308DF19C88025AF7E2FBC8350F4A892DE999DB351E670EC159B82

Uniqueness

Uniqueness Score: -1.00%

Function 10010778 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

9%lld, xrefs: 10010911

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: 0fa6dd96bcb8b49d32427fa14dca801b7d20183067ebe2f5af9251743fd18f1c
Instruction ID: 07c5791c45fa29d35386c44efcc7358132a53f75d1a9a2a1ef31ce81eb8ddbf6
Opcode Fuzzy Hash: 0fa6dd96bcb8b49d32427fa14dca801b7d20183067ebe2f5af9251743fd18f1c
Instruction Fuzzy Hash: F6513876A187158FD308DF19D88025AF7E2FBC8310F49892DFA999B351E774EC059B82

Uniqueness

Uniqueness Score: -1.00%

Function 1001099C Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

9%lld, xrefs: 10010B38

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 9%lld
API String ID: 0-1067827528
Opcode ID: 456f62df167c221b4f35950558ada73559cb89ee4e5f1ccf327e946437bed8b3
Instruction ID: f07b37fba5f5260aea86cb94400ce6e638a8eff9ebd999678f623fdff0880617
Opcode Fuzzy Hash: 456f62df167c221b4f35950558ada73559cb89ee4e5f1ccf327e946437bed8b3
Instruction Fuzzy Hash: 97516B76A187158FD308DF19C88025AF7E2FBC8350F4A892DE999DB351D770EC159B82

Uniqueness

Uniqueness Score: -1.00%

Function 1004BA00 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

%02u:%02u:%02u%c%02u, xrefs: 1004BB30

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %02u:%02u:%02u%c%02u
API String ID: 0-3773705257
Opcode ID: 2318787c02257443c440dfa009ff6961f21b6026df1628d6fdca24855cc61d32
Instruction ID: be09c1d04eb864e1d0c66810dd1fbff98504cdf9198dbc8e4368de8c9c13ae5b
Opcode Fuzzy Hash: 2318787c02257443c440dfa009ff6961f21b6026df1628d6fdca24855cc61d32
Instruction Fuzzy Hash: 25516BB16087458FC754CF29C48066AB7E2FBC8345F50492EF4C9C7392E675D909CB46

Uniqueness

Uniqueness Score: -1.00%

Function 100105C0 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

*, xrefs: 100106C6

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-163128923
Opcode ID: f7bbd7721ca75eba7fa29301916c8371da0f62bce0992595b79b08e752eb8dc5
Instruction ID: c15c81efb2fd65274e57c9dcba0b9463b5106a8dfd25bbab1057f7fea26fdb11
Opcode Fuzzy Hash: f7bbd7721ca75eba7fa29301916c8371da0f62bce0992595b79b08e752eb8dc5
Instruction Fuzzy Hash: 94413CB6E083515FD340CE29C88125AF7E1EBC8754F5A892EF8D8DB351E674EC518B82

Uniqueness

Uniqueness Score: -1.00%

Function 10081AF0 Relevance: .7, Instructions: 703COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bffe5be5ea0cf8eb244358c7295bde7d5fedb614219cf83f2f51a3cfabbc894a
Instruction ID: 93fe30d614f698e6f7524963f1120bb93ea648e144f849a3bf42169f72f169c8
Opcode Fuzzy Hash: bffe5be5ea0cf8eb244358c7295bde7d5fedb614219cf83f2f51a3cfabbc894a
Instruction Fuzzy Hash: 7F622172B012148FD749CF2DC895384B7EAABC8710F0E827ADC4DDFB5ADA3899458B54

Uniqueness

Uniqueness Score: -1.00%

Function 10025550 Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db034cff99af1e7203ee44394934ffb7567196ced3806a0dc990b907df53bb
Instruction ID: aff783430aa08d586327c987e6b98b0e0f6b454682ab812075f4302f75d353d4
Opcode Fuzzy Hash: d6db034cff99af1e7203ee44394934ffb7567196ced3806a0dc990b907df53bb
Instruction Fuzzy Hash: D632503274471D4BC708EEE9DC811D5B3D2BB88614F49813C9E15D3706FBB8BA6A96C8

Uniqueness

Uniqueness Score: -1.00%

Function 1007CAB7 Relevance: .6, Instructions: 623COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc47b0294c599dff906ad907c3cacd309aa326f7ee51b28907f233fc23d8642
Instruction ID: 14305647c684428e38f4d4ef692b208b9fdd6583e9eb12280074a993664fc603
Opcode Fuzzy Hash: ecc47b0294c599dff906ad907c3cacd309aa326f7ee51b28907f233fc23d8642
Instruction Fuzzy Hash: F4420575B083458FC718CF6DC99075AF7E6BBCC304F098A3EE98A83765D674A8458B42

Uniqueness

Uniqueness Score: -1.00%

Function 10030750 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14eaf38118c7a759d371acee2a165523bb4c76873ad4d0c9062ae67b0ecb1890
Instruction ID: ad852b38171cb1c4d6d317ab4e6fcc7a614a1a6681d72d6e7d093d2c3d42b063
Opcode Fuzzy Hash: 14eaf38118c7a759d371acee2a165523bb4c76873ad4d0c9062ae67b0ecb1890
Instruction Fuzzy Hash: E7227A32A093568FCB15DF29C89051AB7F1FF89316F19892DE9D99B210D270FE05DB82

Uniqueness

Uniqueness Score: -1.00%

Function 1000B0D0 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33419a9aeb14ce56b4ab0fd1bc83750a17983b722cf78c8c468c2c97687aa838
Instruction ID: 3194deff8c1016480bd4981d57c44dc359412b19884f203e35b39e086724ce96
Opcode Fuzzy Hash: 33419a9aeb14ce56b4ab0fd1bc83750a17983b722cf78c8c468c2c97687aa838
Instruction Fuzzy Hash: D342DE756087409FC754CF29C58099AFBE2BFCE250F16C92EE899C7356D630E942CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100556F8 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e67863a46a38232c1c98f3bbb28cce13b0c6a915783b56d779cb3c3c48640e6
Instruction ID: 6d42d01cb552ea32de216882ba5b35338e805864c61f81a166e561337f25913f
Opcode Fuzzy Hash: 0e67863a46a38232c1c98f3bbb28cce13b0c6a915783b56d779cb3c3c48640e6
Instruction Fuzzy Hash: D5423F31A18F548EC327DF39C46066BF7A9BFDB280F01C71EE85A6B621DB31A5468741

Uniqueness

Uniqueness Score: -1.00%

Function 10066691 Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ee1f807265c2448a5d30af4e3355bf754649fac8893e35c5f8cfddf926455e
Instruction ID: 7174ebee63d6dac74c7d8e3f892b5b6b3bbf86c4982769087327a44f26b8845a
Opcode Fuzzy Hash: 15ee1f807265c2448a5d30af4e3355bf754649fac8893e35c5f8cfddf926455e
Instruction Fuzzy Hash: C3422431928B498FC712CF7BC48016ABBE1BFDE340F29CB1AE95467275D730B4959A81

Uniqueness

Uniqueness Score: -1.00%

Function 100A46FC Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa19670d3522c833027b14a21b852b8c85cf28517cca30d9fd8a4cb5d6ff739
Instruction ID: 44859fa2464e6453f4b820bd8b2f52594cd8254e22ee146d3a9af27ba666f937
Opcode Fuzzy Hash: daa19670d3522c833027b14a21b852b8c85cf28517cca30d9fd8a4cb5d6ff739
Instruction Fuzzy Hash: 39325E31900A7DCFE748EF59C8D4826B3A1FB5E71078B469BDA8627261C330F911DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1007C415 Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf90d1ec7f19272728b93ae722b4d7a072b3c1b91d2b09d409b5cad2029abf1
Instruction ID: 0ebc0afddda2170bd2b3075ce7c9f010085fa9f9e3ca4f134125014cc1f34513
Opcode Fuzzy Hash: 5cf90d1ec7f19272728b93ae722b4d7a072b3c1b91d2b09d409b5cad2029abf1
Instruction Fuzzy Hash: B0220975A083458FC718CF2DC88075AF7E5FBC8304F098A2EE98A97755D734A945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 100767C0 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d96f62cfcfe5e8f43553fb10e8c7896314ef3273b4a86c5c7ff97399bd6d748f
Instruction ID: 9e1727fd26884bf5191195720f30de30c932b0be7b7d484b7602d5863f15af54
Opcode Fuzzy Hash: d96f62cfcfe5e8f43553fb10e8c7896314ef3273b4a86c5c7ff97399bd6d748f
Instruction Fuzzy Hash: C4120375B043158FC708CF6DC98074AF7E6BBCC714F0A8A2EE88993765D674AC458B82

Uniqueness

Uniqueness Score: -1.00%

Function 10027690 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 253541403ddb90a967318677e255df3c3d66526af601f855756530808c7de0cf
Instruction ID: 7fd1eb89d7e446ca535b3a7c4e5df40feba04e1f10e452d83e5af9dd3013d807
Opcode Fuzzy Hash: 253541403ddb90a967318677e255df3c3d66526af601f855756530808c7de0cf
Instruction Fuzzy Hash: 6202D171A083458FC314CF28D48025ABBE2FFC6344F698A6ED8988F756D375D946CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1007F900 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a489710fe13c5f607167066acbb31749c07d198f3adc71dd6de5721242b9bd
Instruction ID: a785d5b36ca4f2da05d37b54d5474f66753fb8429adb014802f9a6764e65f914
Opcode Fuzzy Hash: 86a489710fe13c5f607167066acbb31749c07d198f3adc71dd6de5721242b9bd
Instruction Fuzzy Hash: 0AF11C72A043148FC748CF2DC984749BBE6BBC8710F1A866EED48D775ADA74EC458B81

Uniqueness

Uniqueness Score: -1.00%

Function 10024700 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff52c7ffbd1d9107fcbef65328e3878b9d8ec7e0a566bd5413746ddd724ee47a
Instruction ID: 17bda300cafbee541834c927e7bcf7240875502bd3d5a4043446c7d08037228a
Opcode Fuzzy Hash: ff52c7ffbd1d9107fcbef65328e3878b9d8ec7e0a566bd5413746ddd724ee47a
Instruction Fuzzy Hash: 84E10775B083408FC304CE29D88060AFBF6EFC9364F598A2DF999D73A1D671E9458B42

Uniqueness

Uniqueness Score: -1.00%

Function 100499A0 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8d4379c629bcd2e40492a2a49cc2a68a8e13a90f0cec3b32964914661c2c3e
Instruction ID: 68076dcebb193b58b9e24264a5a3b86d03840a9afd49eb0c7633087c8305a4f6
Opcode Fuzzy Hash: ce8d4379c629bcd2e40492a2a49cc2a68a8e13a90f0cec3b32964914661c2c3e
Instruction Fuzzy Hash: 63D1F2729183618BD710CE28C88136AB7E2EF85310F3989B9DC96CF356E335D845D795

Uniqueness

Uniqueness Score: -1.00%

Function 10078B10 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f315496cc42e06e35b9f9c064188ae51dc9ded88c6bc92d1747087161525bbd0
Instruction ID: 7a853b8a20996199dba5b5a5e17ca19378e119ea9c999e0c2545a79d357b8191
Opcode Fuzzy Hash: f315496cc42e06e35b9f9c064188ae51dc9ded88c6bc92d1747087161525bbd0
Instruction Fuzzy Hash: 38F12575A083458FC718CF18C891B5AF7E6FBCC314F09892EE98A97762D734E9458B42

Uniqueness

Uniqueness Score: -1.00%

Function 100A415E Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc127aefda8e8853143bf40c7bccf88c13436e1413f53e6a311513c7283cbfcc
Instruction ID: dd9df089b2ede18d61b09027eb04b9aada35eebc959f886a42edaf749e851632
Opcode Fuzzy Hash: fc127aefda8e8853143bf40c7bccf88c13436e1413f53e6a311513c7283cbfcc
Instruction Fuzzy Hash: B002A1B4A18794CBD754CF29C58068ABBE1FBC9350F118A2EF9A887364D7749845CF82

Uniqueness

Uniqueness Score: -1.00%

Function 1007C5E1 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b99305d6d228989113bd8aeb6dd86713a4088cf676f62655ee97cb44f0bb1a
Instruction ID: 3d0870fb63785ee3d087e596b45700dc7f5735dee0ab32d5e0c75b3dd3c3cef2
Opcode Fuzzy Hash: c3b99305d6d228989113bd8aeb6dd86713a4088cf676f62655ee97cb44f0bb1a
Instruction Fuzzy Hash: 72E1F475B083458FC718CF6DC88075AF7E2FBC8704F098A3EE98997765D634A9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 1000B830 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2f94ac762cd677dc8362f514d4668eefae1739862ad9c7aa78fec698a4c789
Instruction ID: be10b61e0e400d7f3c7b246480c7663c1106f3f721ef33eb9267169c2a0f6ae4
Opcode Fuzzy Hash: 5a2f94ac762cd677dc8362f514d4668eefae1739862ad9c7aa78fec698a4c789
Instruction Fuzzy Hash: 1FC14D3160496CCFD75CEF29D8E48753393ABE831174B86ADD6034B3A5CA30B925DB94

Uniqueness

Uniqueness Score: -1.00%

Function 1004D590 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f94882668a57adb90dd1fc6bb69396616865b816e18890b60b974d0b6ce670
Instruction ID: e9c25fcd0952e9e9d916294726128921c44990a4fb84a511dd07ae25fe2c2566
Opcode Fuzzy Hash: 28f94882668a57adb90dd1fc6bb69396616865b816e18890b60b974d0b6ce670
Instruction Fuzzy Hash: 09C140302087959FC745DF2AC4805A6FBF1EF9A200F49C55EE8D8CB346D634EA15DB91

Uniqueness

Uniqueness Score: -1.00%

Function 10021340 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee0655b07f9a60d7e6c93e24dd163bbcdd8dd7aa916f57eec32edbbdc4cc49b7
Instruction ID: 1db670544306bd251aebef4a7dbe6716f8247bd2a01bbc6002f53e6d6edf3967
Opcode Fuzzy Hash: ee0655b07f9a60d7e6c93e24dd163bbcdd8dd7aa916f57eec32edbbdc4cc49b7
Instruction Fuzzy Hash: 7BA14C745083168BD750DF16E4442AFF7E0FF94B84F958A2EF898DB250E234D981DB92

Uniqueness

Uniqueness Score: -1.00%

Function 1004D5C1 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d016340bc325db1fd1648bbb37fa4be5db1333341c3535a9616d09fdc8b0c0ba
Instruction ID: 5b61de884d90df82446b19460e85b2eea36a0198e06777fdadc74bd29ad9c96a
Opcode Fuzzy Hash: d016340bc325db1fd1648bbb37fa4be5db1333341c3535a9616d09fdc8b0c0ba
Instruction Fuzzy Hash: DDB15F302087959FC745DF2AC4805A6FBF1AF9A200F89C55EE8D8CB347D634EA15DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10008144 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fdca86bf5610cf8d83fc9a2a9123c7de6589e9a7e00ce3a8cca6f1a48dd3632
Instruction ID: 8c294614796abfce7a9b313687c0130c20c351539878b9b69ed8c38673feebb7
Opcode Fuzzy Hash: 0fdca86bf5610cf8d83fc9a2a9123c7de6589e9a7e00ce3a8cca6f1a48dd3632
Instruction Fuzzy Hash: 2DA134356002118FD398DE1FD8D0D6A7393ABC432DF5BC26E9E445B3AACD38B4669790

Uniqueness

Uniqueness Score: -1.00%

Function 10007A50 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930e695f6b8eca41130a53b596d6cf8baec4992ec9755c4dd3e6ab00923b5f85
Instruction ID: ebf589678dd2b21f450bef16afd8acf277a4c86fda3af18da15dd9d105d6ad1f
Opcode Fuzzy Hash: 930e695f6b8eca41130a53b596d6cf8baec4992ec9755c4dd3e6ab00923b5f85
Instruction Fuzzy Hash: 0CA13C70E003198FD39CDE1ED850E7A73A3AFC8229B8B865E95464F2F6DD346461C798

Uniqueness

Uniqueness Score: -1.00%

Function 1004A990 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdeefbb9b1cc8c6670991cf24b173620491e3b0587a273fc61fabb3fb5080e81
Instruction ID: f4f4e952c433a0949d58c36d6cc90477ad4d8c83a35f662541151486efee236c
Opcode Fuzzy Hash: cdeefbb9b1cc8c6670991cf24b173620491e3b0587a273fc61fabb3fb5080e81
Instruction Fuzzy Hash: 076190716093959FC701CF69848055AFBF1FF9A200F19896EE9D8D7342D330EA15CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1000E760 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7460696957a74314385251e6c6bcc12f45c6b26b427e07c74903d9ed9e685e2
Instruction ID: a9fd71970cc6ae0704401159e34ccb1fdaf457640d2c7af12330d1c819c8daf0
Opcode Fuzzy Hash: f7460696957a74314385251e6c6bcc12f45c6b26b427e07c74903d9ed9e685e2
Instruction Fuzzy Hash: 8941B173F2582507E7188828CC05319B2C3DBE4271B1EC37AED59EB789E934ED1686C2

Uniqueness

Uniqueness Score: -1.00%

Function 10001900 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95de5cfb7fefc0799c9c6931d173e6ec651f50519c43e477457960f263de7522
Instruction ID: a62b2dee07404cea211b2efb13baac961549e0bcf9cdcf768083b85999019a1a
Opcode Fuzzy Hash: 95de5cfb7fefc0799c9c6931d173e6ec651f50519c43e477457960f263de7522
Instruction Fuzzy Hash: B691D7755042628FDB40CF29C580692BBE1FF99320F5D85BAED989F31AD270A951CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1008A640 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a242dc87f5c93d7af9d14441f2c5b7f2a550f65f8e3fc145424b163f276814f
Instruction ID: df19a67aeb3eb1ac8f7c04359b992b1f8df16513256b81dfba3ade0116543761
Opcode Fuzzy Hash: 8a242dc87f5c93d7af9d14441f2c5b7f2a550f65f8e3fc145424b163f276814f
Instruction Fuzzy Hash: E571FCC55496F08DD70E8A3682F16F27FE00B67122F1D47EBAAD50F693C2298149EB35

Uniqueness

Uniqueness Score: -1.00%

Function 1000164B Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5339e86325d42bd6281c81f51f6f83cb80fe511d73c762a27f573bff63cef8
Instruction ID: 40aabe202a40184f6c89db9be28c5e271f9100c876ec067dbcd78a5b86649b1c
Opcode Fuzzy Hash: 2e5339e86325d42bd6281c81f51f6f83cb80fe511d73c762a27f573bff63cef8
Instruction Fuzzy Hash: 5681CD745042528FDB94CF29C5C0A96BBE1FF99310F5988B9ED9C8F61AE230A941DF60

Uniqueness

Uniqueness Score: -1.00%

Function 1004D3B0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b576644014d14f1c54322c87fd66bbfde8640324f1e42ad5ea2fc848f20d65e
Instruction ID: 3b5e75aad5a0c08e1416bd72158d909f1297ac2347114389bb20aec0d49765e5
Opcode Fuzzy Hash: 7b576644014d14f1c54322c87fd66bbfde8640324f1e42ad5ea2fc848f20d65e
Instruction Fuzzy Hash: 26516B71A043148FC314DF5AC480956B3E1FF8C218F8A896EDA855B363CB74B812CB94

Uniqueness

Uniqueness Score: -1.00%

Function 1008B470 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2513f73ccef5aec2b55aaaa03c115ed443044f3c6124b9d960365810a0306e
Instruction ID: abf727b3a972acfad7dcd21eee2ec69e4a3f2dc070b43d75464f4bdfea808785
Opcode Fuzzy Hash: 6a2513f73ccef5aec2b55aaaa03c115ed443044f3c6124b9d960365810a0306e
Instruction Fuzzy Hash: 1241E53AD097449FD325CE3484C6491B7A0FE86260B0A478FECD0571A3FB32945BC796

Uniqueness

Uniqueness Score: -1.00%

Function 10021760 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e1bf70edc85c72b57ecd771a589712a2623989afca4d70576e69868d5c536e
Instruction ID: 9aaf14044436f1b2b42603b9fb6b72ce4f3e40e728a04a0e74472568190d7af2
Opcode Fuzzy Hash: 21e1bf70edc85c72b57ecd771a589712a2623989afca4d70576e69868d5c536e
Instruction Fuzzy Hash: 5E419866B0833196E314ABEDF4C049DF2E1FED1BA1B824A69D2952F141D330D449C7E7

Uniqueness

Uniqueness Score: -1.00%

Function 100A566C Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b90650c6bf10e00771a62b178fc97b98f7b28062ca67f212be0d6454448b7df
Instruction ID: a1ee27c0dc52f8c5174c005de0bcff99ec75529c3159a0a458bf5de33efdcca9
Opcode Fuzzy Hash: 8b90650c6bf10e00771a62b178fc97b98f7b28062ca67f212be0d6454448b7df
Instruction Fuzzy Hash: 70413E0914D3E44ECB8E9B3A00B58F67FE1AC5B11536EC1EFE9C60F293C619450AEB60

Uniqueness

Uniqueness Score: -1.00%

Function 1000D060 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01961a118ebc83994ce737a496e9055b1f8ab46d9bbd015c8cfe35346e32c7fc
Instruction ID: 6d93bd8323a72235920ba6e149a4a7bae96c73b66a2dfad555009d0c6ff0ce4f
Opcode Fuzzy Hash: 01961a118ebc83994ce737a496e9055b1f8ab46d9bbd015c8cfe35346e32c7fc
Instruction Fuzzy Hash: 5311D2B3F2453203E71CD4199C2136D828387E82B071FC23FDE47A7286EC609D5682D1

Uniqueness

Uniqueness Score: -1.00%

Function 1000FA00 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16418492506d26e88d9ea5ffe778ecedbadd0674902667d5b4f3f091e616a9e4
Instruction ID: 959dd8b958685b2c602623f8f1487b2043f59aa88e98173f8505a8abe479dfa4
Opcode Fuzzy Hash: 16418492506d26e88d9ea5ffe778ecedbadd0674902667d5b4f3f091e616a9e4
Instruction Fuzzy Hash: 01214F33BA0CAB07D748CD7ACC823DA62D3E7C4209F49C6789556D7649D53DD8429680

Uniqueness

Uniqueness Score: -1.00%

Function 1000FAE0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3141d09b1683437dc047317c092a48923b199cea0971d17c0b8de08017b4ddf
Instruction ID: 7401ec26052bbdd11a75dd464f743d8617a1d02d8098354ba99e3f62ca5db7ec
Opcode Fuzzy Hash: f3141d09b1683437dc047317c092a48923b199cea0971d17c0b8de08017b4ddf
Instruction Fuzzy Hash: A8219D73F300320BC728CD7D8C5825662C1D7C8295B4E8BB9EE58EF786E668DD419AC0

Uniqueness

Uniqueness Score: -1.00%

Function 1000C0B0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de151643a332339ce823666c471d4da1aa7b144928b0c7d3fd1e004a2c822b77
Instruction ID: 192b5b8e635135c3962563ef613f7b52fce4010c0b042699b34e9086fceffb22
Opcode Fuzzy Hash: de151643a332339ce823666c471d4da1aa7b144928b0c7d3fd1e004a2c822b77
Instruction Fuzzy Hash: 38316F651087D85ECB11CF3544904EABFE09EAB581B09C49EF8E84B247C524EB09EB71

Uniqueness

Uniqueness Score: -1.00%

Function 100101D0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78873d4f70a7114040ce7729ab5ab63925d14f9cd724e7e38f810f9ad5a330b
Instruction ID: 7615e6e647f5862a10f08712ea71b14590be4302af2179b17c0dfb1654340f57
Opcode Fuzzy Hash: c78873d4f70a7114040ce7729ab5ab63925d14f9cd724e7e38f810f9ad5a330b
Instruction Fuzzy Hash: FF2122726042658BCB14DE19C8D86AB73E2FBC9314F168A68E9C55F205C234F84ACBD1

Uniqueness

Uniqueness Score: -1.00%

Function 1000FAF7 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e8cd7bf255c7c8b941f54418a5bf7396c934417188cacc302b08a8026b8cc6
Instruction ID: e42923ef10120b0fce72e2dfd62ff0f6b1e92c6f034ab2fe8244b6ba9566043e
Opcode Fuzzy Hash: 21e8cd7bf255c7c8b941f54418a5bf7396c934417188cacc302b08a8026b8cc6
Instruction Fuzzy Hash: 2F115E73E301320BC724CD7D8C4834262C1D788256B4E8BB5DE98EF342E268ED429AC0

Uniqueness

Uniqueness Score: -1.00%

Function 1000AA10 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2855c1fd0bc473689ac7151c799de4b67eb7dbd14f8e375b0c1984da4defb2b2
Instruction ID: bb67aa5c3e79cddec5f4daef0c555e321a96bdb8e320fd3e56e053c9fc0aa2d4
Opcode Fuzzy Hash: 2855c1fd0bc473689ac7151c799de4b67eb7dbd14f8e375b0c1984da4defb2b2
Instruction Fuzzy Hash: 5A312DB1A146309BE358CF1AEDE462AF3E2E38C320F46416DD989933B1D9786C25C790

Uniqueness

Uniqueness Score: -1.00%

Function 100339C0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad436124cf0627712d9c57b5f9352303ce41f418a33c0e13c018656ee81bd46e
Instruction ID: d55ec0bf4d8ccb7feddbac453193f8db4f74bc196d46466865d676d0862984f4
Opcode Fuzzy Hash: ad436124cf0627712d9c57b5f9352303ce41f418a33c0e13c018656ee81bd46e
Instruction Fuzzy Hash: DC21AD3400D7E05EC712DB66809007AFFE1AE97112F09C9EEE8E84B383D1399204DB23

Uniqueness

Uniqueness Score: -1.00%

Function 1008B700 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcfb03660752ab5eb4e93aa23948fa86d37fc4137dad975b936b97558449d880
Instruction ID: 08507b88d5ea8c10eecfe47a9cb0e80ccc9b4415782bb3c2fd75addcbcacf11c
Opcode Fuzzy Hash: fcfb03660752ab5eb4e93aa23948fa86d37fc4137dad975b936b97558449d880
Instruction Fuzzy Hash: F411A235808B868BD315CF38C482465B7A0FFCA294F058759D99577153E731E88B8756

Uniqueness

Uniqueness Score: -1.00%

Function 1002A9E9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c76c69a6e16dc7822b4f5a1a757f8ccc5bafd5d8a12991ea2ea248d2ead5663
Instruction ID: cb6bd734151cd8d44044ce49627ebacfeb84b08cb3a248c712c7f8227f187652
Opcode Fuzzy Hash: 0c76c69a6e16dc7822b4f5a1a757f8ccc5bafd5d8a12991ea2ea248d2ead5663
Instruction Fuzzy Hash: 2321E471A08105DFCB68CF88E690A9DB7F5EF0A314FA00095E905AB612DB34EDC0EB56

Uniqueness

Uniqueness Score: -1.00%

Function 1001021B Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123d4edf2cae72c4cb44158153aca10c35860e83f93e9ec1453424ef70596d6d
Instruction ID: bcaa8491dccb865917a35a3d808823525e0e43ff59a73624eea8fea794acadd0
Opcode Fuzzy Hash: 123d4edf2cae72c4cb44158153aca10c35860e83f93e9ec1453424ef70596d6d
Instruction Fuzzy Hash: 141134326041618BCB15CE69C8D86AA73D2FBC9315F17C968E9C69F245C334F94ACBD0

Uniqueness

Uniqueness Score: -1.00%

Function 100A57A5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9acf928a80fa7d5092a9227ffdde5a5ec425d920ddeb07c3dbf611afe1a34b73
Instruction ID: 105999df1bb95d177b10598adac08acd804ba4400ef6563b978d1058cdfb1ef1
Opcode Fuzzy Hash: 9acf928a80fa7d5092a9227ffdde5a5ec425d920ddeb07c3dbf611afe1a34b73
Instruction Fuzzy Hash: E511254900D3D919DB469F3904748FBBFF1ACCB205F8969EBE8D146643C118915EE762

Uniqueness

Uniqueness Score: -1.00%

Function 1000C1B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7d7dad83a973bb790b37e6832e95b579524e0ac113e1f4aa988c8562b958bd
Instruction ID: f8771a243a862af8759e5689c7b57640d36b1020b076dab7645bd5d8fe9118fc
Opcode Fuzzy Hash: ca7d7dad83a973bb790b37e6832e95b579524e0ac113e1f4aa988c8562b958bd
Instruction Fuzzy Hash: BDF0F676B1435947E900DF459C40B8BB7D9FFC42D8F16052EED48A3305C630BD0586A1

Uniqueness

Uniqueness Score: -1.00%

Function 1008B030 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566e91d0b8d452359c7bb78fe999ee31250548b62ca49a35f0ac2a50155920e7
Instruction ID: fb49bc79d4318df5132ff4e8978937c42cbf5c601f0cfd761cb428f5592a7514
Opcode Fuzzy Hash: 566e91d0b8d452359c7bb78fe999ee31250548b62ca49a35f0ac2a50155920e7
Instruction Fuzzy Hash: 19E0C9B62193159FE314DE09E8808A7FBECEBD8664B10492FF4C493300C231AC448BB1

Uniqueness

Uniqueness Score: -1.00%

Function 10017162 Relevance: 100.1, APIs: 56, Strings: 1, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_mallocz.MAIN ref: 10017236

Strings

Invalid chars '%s' at the end of expression '%s', xrefs: 1001726C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz
String ID: Invalid chars '%s' at the end of expression '%s'
API String ID: 1901900789-1422635149
Opcode ID: b9b5404f8f7a3a855f615fbe720d284632f6c1f76810d66ba6a38d70fdf3f15c
Instruction ID: bac24a0257c5d849bb0dbfe2b802779c263aec53df092acb8c93c3cd01452c15
Opcode Fuzzy Hash: b9b5404f8f7a3a855f615fbe720d284632f6c1f76810d66ba6a38d70fdf3f15c
Instruction Fuzzy Hash: CBE184B89097819FC780DF68C48191ABBF1FF88250F85586DF8C58B316E735E881CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10017261 Relevance: 98.3, APIs: 55, Strings: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_log.MAIN ref: 10017289
mv_freep.MAIN ref: 100172E8
mv_freep.MAIN ref: 100172F4
mv_expr_free.MAIN ref: 100172D9

Part of subcall function 10015280: mv_freep.MAIN ref: 10015588
Part of subcall function 10015280: mv_freep.MAIN ref: 10015594
Part of subcall function 10015280: mv_freep.MAIN ref: 100155DB
Part of subcall function 10015280: mv_freep.MAIN ref: 100155E7
Part of subcall function 10015280: mv_freep.MAIN ref: 100155F6
Part of subcall function 10015280: mv_freep.MAIN ref: 10015602
Part of subcall function 10015280: mv_freep.MAIN ref: 10015667
Part of subcall function 10015280: mv_freep.MAIN ref: 10015673
Part of subcall function 10015280: mv_freep.MAIN ref: 100156BA

mv_expr_free.MAIN ref: 100172CA

Part of subcall function 10015280: mv_freep.MAIN ref: 1001542C
Part of subcall function 10015280: mv_freep.MAIN ref: 10015438
Part of subcall function 10015280: mv_freep.MAIN ref: 10015447
Part of subcall function 10015280: mv_freep.MAIN ref: 10015453
Part of subcall function 10015280: mv_freep.MAIN ref: 1001549A
Part of subcall function 10015280: mv_freep.MAIN ref: 100154A6
Part of subcall function 10015280: mv_freep.MAIN ref: 100154B5
Part of subcall function 10015280: mv_freep.MAIN ref: 100154C1
Part of subcall function 10015280: mv_freep.MAIN ref: 10015517
Part of subcall function 10015280: mv_freep.MAIN ref: 10015523

mv_expr_free.MAIN ref: 100172BB

Part of subcall function 10015280: mv_freep.MAIN ref: 100152FA
Part of subcall function 10015280: mv_freep.MAIN ref: 10015306
Part of subcall function 10015280: mv_freep.MAIN ref: 1001534D
Part of subcall function 10015280: mv_freep.MAIN ref: 10015359
Part of subcall function 10015280: mv_freep.MAIN ref: 10015368
Part of subcall function 10015280: mv_freep.MAIN ref: 10015374
Part of subcall function 10015280: mv_freep.MAIN ref: 100153D9
Part of subcall function 10015280: mv_freep.MAIN ref: 100153E5

mv_expr_free.MAIN ref: 1001730E
mv_expr_free.MAIN ref: 1001731D
mv_expr_free.MAIN ref: 1001732C
mv_freep.MAIN ref: 1001733B
mv_freep.MAIN ref: 10017347
mv_expr_free.MAIN ref: 10017361
mv_expr_free.MAIN ref: 10017370
mv_expr_free.MAIN ref: 1001737F
mv_freep.MAIN ref: 1001738E
mv_freep.MAIN ref: 1001739A
mv_freep.MAIN ref: 100173A9
mv_freep.MAIN ref: 100173B5
mv_expr_free.MAIN ref: 100173DE
mv_expr_free.MAIN ref: 100173ED
mv_expr_free.MAIN ref: 100173FC
mv_freep.MAIN ref: 1001740B
mv_freep.MAIN ref: 10017417
mv_expr_free.MAIN ref: 10017431
mv_expr_free.MAIN ref: 10017440
mv_expr_free.MAIN ref: 1001744F
mv_freep.MAIN ref: 1001745E
mv_freep.MAIN ref: 1001746A
mv_expr_free.MAIN ref: 10017484
mv_expr_free.MAIN ref: 10017493
mv_expr_free.MAIN ref: 100174A2
mv_freep.MAIN ref: 100174B1
mv_freep.MAIN ref: 100174BD
mv_freep.MAIN ref: 100174CC
mv_freep.MAIN ref: 100174D8
mv_expr_free.MAIN ref: 10017501
mv_expr_free.MAIN ref: 10017510
mv_expr_free.MAIN ref: 1001751F
mv_freep.MAIN ref: 1001752E
mv_freep.MAIN ref: 1001753A
mv_expr_free.MAIN ref: 10017554
mv_expr_free.MAIN ref: 10017563
mv_expr_free.MAIN ref: 10017572
mv_freep.MAIN ref: 10017581
mv_freep.MAIN ref: 1001758D
mv_expr_free.MAIN ref: 100175A7
mv_expr_free.MAIN ref: 100175B6
mv_expr_free.MAIN ref: 100175C5
mv_freep.MAIN ref: 100175D4
mv_freep.MAIN ref: 100175E0
mv_freep.MAIN ref: 100175EF
mv_freep.MAIN ref: 100175FB
mv_freep.MAIN ref: 1001760A
mv_freep.MAIN ref: 10017616

Strings

Invalid chars '%s' at the end of expression '%s', xrefs: 1001726C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_expr_free$mv_log
String ID: Invalid chars '%s' at the end of expression '%s'
API String ID: 75827668-1422635149
Opcode ID: 868f8d433a9d4ff7ca381ed327b9c79258ebc14a83ef6ba52564f0dccba394d0
Instruction ID: 47d116fedaedebc931fd27d2d79ea71f155cf045d5fda504e80a0eb2e0d77697
Opcode Fuzzy Hash: 868f8d433a9d4ff7ca381ed327b9c79258ebc14a83ef6ba52564f0dccba394d0
Instruction Fuzzy Hash: 86C146B95097519FC784EFA8D48581EBBE0FF88350F85586DF8C18B316E735E8848B92

Uniqueness

Uniqueness Score: -1.00%

Function 100177F0 Relevance: 75.3, APIs: 50, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_expr_parse.MAIN ref: 10017862

Part of subcall function 10017110: strlen.MSVCRT ref: 10017141
Part of subcall function 10017110: mv_malloc.MAIN ref: 1001714A

mv_expr_free.MAIN ref: 100178D7
mv_expr_free.MAIN ref: 100178E6
mv_expr_free.MAIN ref: 100178F5
mv_freep.MAIN ref: 10017904
mv_freep.MAIN ref: 1001790C
mv_expr_free.MAIN ref: 10017926
mv_expr_free.MAIN ref: 10017935
mv_expr_free.MAIN ref: 10017944
mv_freep.MAIN ref: 10017953
mv_freep.MAIN ref: 1001795B
mv_expr_free.MAIN ref: 10017975
mv_expr_free.MAIN ref: 10017984
mv_expr_free.MAIN ref: 10017993
mv_freep.MAIN ref: 100179A2
mv_freep.MAIN ref: 100179AA
mv_freep.MAIN ref: 100179B9
mv_freep.MAIN ref: 100179C5
mv_expr_free.MAIN ref: 100179EE
mv_freep.MAIN ref: 10017A1B
mv_freep.MAIN ref: 10017A23
mv_freep.MAIN ref: 10017A79
mv_freep.MAIN ref: 10017A81
mv_expr_free.MAIN ref: 10017A6A

Part of subcall function 10015280: mv_freep.MAIN ref: 100159C5
Part of subcall function 10015280: mv_freep.MAIN ref: 100159D1
Part of subcall function 10015280: mv_freep.MAIN ref: 100159E0
Part of subcall function 10015280: mv_freep.MAIN ref: 100159EC
Part of subcall function 10015280: mv_freep.MAIN ref: 100159FB
Part of subcall function 10015280: mv_freep.MAIN ref: 10015A07
Part of subcall function 10015280: mv_freep.MAIN ref: 10015A16
Part of subcall function 10015280: mv_freep.MAIN ref: 10015A22

mv_expr_free.MAIN ref: 10017A5B

Part of subcall function 10015280: mv_freep.MAIN ref: 1001584F
Part of subcall function 10015280: mv_freep.MAIN ref: 1001585B
Part of subcall function 10015280: mv_freep.MAIN ref: 100158A2
Part of subcall function 10015280: mv_freep.MAIN ref: 100158AE
Part of subcall function 10015280: mv_freep.MAIN ref: 100158BD
Part of subcall function 10015280: mv_freep.MAIN ref: 100158C9
Part of subcall function 10015280: mv_freep.MAIN ref: 1001591F
Part of subcall function 10015280: mv_freep.MAIN ref: 1001592B
Part of subcall function 10015280: mv_freep.MAIN ref: 10015972
Part of subcall function 10015280: mv_freep.MAIN ref: 1001597E

mv_expr_free.MAIN ref: 10017A4C

Part of subcall function 10015280: mv_freep.MAIN ref: 100156C6
Part of subcall function 10015280: mv_freep.MAIN ref: 100156D5
Part of subcall function 10015280: mv_freep.MAIN ref: 100156E1
Part of subcall function 10015280: mv_freep.MAIN ref: 100156F0
Part of subcall function 10015280: mv_freep.MAIN ref: 100156FC
Part of subcall function 10015280: mv_freep.MAIN ref: 10015770
Part of subcall function 10015280: mv_freep.MAIN ref: 1001577C
Part of subcall function 10015280: mv_freep.MAIN ref: 1001579A
Part of subcall function 10015280: mv_freep.MAIN ref: 100157A6
Part of subcall function 10015280: mv_freep.MAIN ref: 100157FC
Part of subcall function 10015280: mv_freep.MAIN ref: 10015808

mv_freep.MAIN ref: 10017A90
mv_freep.MAIN ref: 10017A9C
mv_expr_free.MAIN ref: 10017AC5
mv_expr_free.MAIN ref: 10017AD4
mv_expr_free.MAIN ref: 10017AE3
mv_freep.MAIN ref: 10017AF2
mv_freep.MAIN ref: 10017AFA
mv_expr_free.MAIN ref: 10017B14
mv_expr_free.MAIN ref: 10017B23
mv_expr_free.MAIN ref: 10017B32
mv_freep.MAIN ref: 10017B41
mv_freep.MAIN ref: 10017B49
mv_expr_free.MAIN ref: 10017A32

Part of subcall function 10015280: mv_freep.MAIN ref: 10015588
Part of subcall function 10015280: mv_freep.MAIN ref: 10015594
Part of subcall function 10015280: mv_freep.MAIN ref: 100155DB
Part of subcall function 10015280: mv_freep.MAIN ref: 100155E7
Part of subcall function 10015280: mv_freep.MAIN ref: 100155F6
Part of subcall function 10015280: mv_freep.MAIN ref: 10015602
Part of subcall function 10015280: mv_freep.MAIN ref: 10015667
Part of subcall function 10015280: mv_freep.MAIN ref: 10015673
Part of subcall function 10015280: mv_freep.MAIN ref: 100156BA

mv_expr_free.MAIN ref: 10017A0C

Part of subcall function 10015280: mv_freep.MAIN ref: 1001542C
Part of subcall function 10015280: mv_freep.MAIN ref: 10015438
Part of subcall function 10015280: mv_freep.MAIN ref: 10015447
Part of subcall function 10015280: mv_freep.MAIN ref: 10015453
Part of subcall function 10015280: mv_freep.MAIN ref: 1001549A
Part of subcall function 10015280: mv_freep.MAIN ref: 100154A6
Part of subcall function 10015280: mv_freep.MAIN ref: 100154B5
Part of subcall function 10015280: mv_freep.MAIN ref: 100154C1
Part of subcall function 10015280: mv_freep.MAIN ref: 10015517
Part of subcall function 10015280: mv_freep.MAIN ref: 10015523

mv_expr_free.MAIN ref: 100179FD

Part of subcall function 10015280: mv_freep.MAIN ref: 100152FA
Part of subcall function 10015280: mv_freep.MAIN ref: 10015306
Part of subcall function 10015280: mv_freep.MAIN ref: 1001534D
Part of subcall function 10015280: mv_freep.MAIN ref: 10015359
Part of subcall function 10015280: mv_freep.MAIN ref: 10015368
Part of subcall function 10015280: mv_freep.MAIN ref: 10015374
Part of subcall function 10015280: mv_freep.MAIN ref: 100153D9
Part of subcall function 10015280: mv_freep.MAIN ref: 100153E5

mv_expr_free.MAIN ref: 10017B63
mv_expr_free.MAIN ref: 10017B72
mv_expr_free.MAIN ref: 10017B81
mv_freep.MAIN ref: 10017B90
mv_freep.MAIN ref: 10017B98
mv_freep.MAIN ref: 10017BA7
mv_freep.MAIN ref: 10017BB3
mv_freep.MAIN ref: 10017BC2
mv_freep.MAIN ref: 10017BCE

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_expr_free$mv_expr_parsemv_mallocstrlen
String ID:
API String ID: 1389959791-0
Opcode ID: 8ed2cf0b96ea738395e10688aaa6a7ba80d46e84586e5b5581eb5791b7552261
Instruction ID: 676c052f7482def6436772c87c2f32b108e761ae451283d38321aee012e0f911
Opcode Fuzzy Hash: 8ed2cf0b96ea738395e10688aaa6a7ba80d46e84586e5b5581eb5791b7552261
Instruction Fuzzy Hash: 1BD173B9A187418FC750EF68D48191ABBF0FF89214F45496DE9D48B315E736E8848F82

Uniqueness

Uniqueness Score: -1.00%

Function 1004E110 Relevance: 57.9, APIs: 15, Strings: 18, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_bprint_init.MAIN ref: 1004E14E
mv_bprintf.MAIN ref: 1004E165

Strings

mdct_int32, xrefs: 1004E2C0
fft_int32, xrefs: 1004E2D0
unknown, xrefs: 1004E369
, prio: %i, xrefs: 1004E3A7
%s, xrefs: 1004E297
fft_double, xrefs: 1004E2F0
rdft_int32, xrefs: 1004E2B0
[%i, , xrefs: 1004E1C4
], , xrefs: 1004E25A
any, xrefs: 1004E351, 1004E36E, 1004E3C3
mdct_float, xrefs: 1004E180
rdft_double, xrefs: 1004E300
%s, factors: [, xrefs: 1004E1FE
mdct_double, xrefs: 1004E2E0
rdft_float, xrefs: 1004E310
%s - type: , xrefs: 1004E155
fft_float, xrefs: 1004E320
, len: , xrefs: 1004E1A5

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_initmv_bprintf
String ID: %s$%s - type: $%s, factors: [$, len: $, prio: %i$[%i, $], $any$fft_double$fft_float$fft_int32$mdct_double$mdct_float$mdct_int32$rdft_double$rdft_float$rdft_int32$unknown
API String ID: 3566169034-155954179
Opcode ID: 81df4f6659a1d45bf056d6d3f9a5766262a3584ff400d984b9363f1ccdd33eb0
Instruction ID: a933a466284158a9cdbf5e2fa88c9023184ecaf356d014cc5bc8696811956cc8
Opcode Fuzzy Hash: 81df4f6659a1d45bf056d6d3f9a5766262a3584ff400d984b9363f1ccdd33eb0
Instruction Fuzzy Hash: 5051F7B8A08784CBD740EF29858191EBBE1FB84350F65892EE8C9CB355DB38DC409B46

Uniqueness

Uniqueness Score: -1.00%

Function 10029950 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_log.MAIN ref: 10029459
mv_log.MAIN ref: 10029593
mv_log.MAIN ref: 100295B8
mv_log.MAIN ref: 1002964D
mv_log.MAIN ref: 1002967C
mv_log.MAIN ref: 100296AB
mv_freep.MAIN ref: 10029721
mv_freep.MAIN ref: 1002972D
mv_log.MAIN ref: 10029985

Strings

%-12lld , xrefs: 10029961
%d/%d, xrefs: 10029A8B
%s, xrefs: 100295A3
to , xrefs: 10029667
%c%c%c%c%c%c%c%c%c%c%c, xrefs: 1002957E
(from , xrefs: 10029638
(default , xrefs: 10029762
"%s", xrefs: 100297AF
%-12s , xrefs: 10029440
%lld, xrefs: 10029876
%-15s , xrefs: 100292D4

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$mv_freep
String ID: %-15s $ %s$ (default $ (from $ to $"%s"$%-12lld $%-12s $%c%c%c%c%c%c%c%c%c%c%c$%d/%d$%lld
API String ID: 3216983768-538076109
Opcode ID: fe8bf675046af0f29d531435944fbc74d31e1b5dd77af1cbcd62e325a06ac8c6
Instruction ID: 6669a645e77abe44fb88f8918c652bef149803a1577f2af9334f6d103ff6ece3
Opcode Fuzzy Hash: fe8bf675046af0f29d531435944fbc74d31e1b5dd77af1cbcd62e325a06ac8c6
Instruction Fuzzy Hash: 6102E3B4A187418FC714CF28D48065EBBE1FF89790F95C92EF8A98B391D774E8458B42

Uniqueness

Uniqueness Score: -1.00%

Function 10009730 Relevance: 51.1, APIs: 23, Strings: 6, Instructions: 372
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097AD
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB
strchr.MSVCRT ref: 1000983B
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009920
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C05

Strings

&, xrefs: 1000979B, 10009AA7, 10009BB3, 10009C33
<, xrefs: 10009ADF, 10009BD3, 10009BF3, 10009C13
", xrefs: 10009B1A, 10009C53
>, xrefs: 100097E9, 1000990E, 10009A69, 10009AC3
', xrefs: 10009A23, 10009AFB
'\'', xrefs: 100098C3

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf$strchr
String ID: &$'$>$<$"$'\''
API String ID: 2626076477-3929336650
Opcode ID: 12b6750b4a52a26ed5acad3795ae941bdf77578173880ce7d0d3f74c73066fa8
Instruction ID: db27ddebd36c8a04df1f9b29fc46dfe65a5f1e33d3c32a01edac565b911f7663
Opcode Fuzzy Hash: 12b6750b4a52a26ed5acad3795ae941bdf77578173880ce7d0d3f74c73066fa8
Instruction Fuzzy Hash: 7BD18174908B95CAE710DF29804076EBBE1FF826C0F56881EF9D58B20AD735E985D783

Uniqueness

Uniqueness Score: -1.00%

Function 10015A2B Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10016E19: mv_mallocz.MAIN ref: 10016ECF

mv_mallocz.MAIN ref: 10015A99

Strings

*, xrefs: 10015A8F

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz
String ID: *
API String ID: 1901900789-163128923
Opcode ID: f34b66a1ccc27e32b7c57b1c91422b2d98364e726381d3d9b355eaa3350dc528
Instruction ID: 14329a75bb3270f280874b1f9c34d30974718639eef1760a85213997015026ea
Opcode Fuzzy Hash: f34b66a1ccc27e32b7c57b1c91422b2d98364e726381d3d9b355eaa3350dc528
Instruction Fuzzy Hash: 5791D4B9608701CFC344DF64D48141ABBE1FF88354F558A2EE8989F316D736E9868F92

Uniqueness

Uniqueness Score: -1.00%

Function 10028940 Relevance: 47.4, APIs: 14, Strings: 13, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_log.MAIN(?,?,?,?,?,?,?,?,?,?,100299E3), ref: 10028A2C
mv_log.MAIN(?,?,?,?,?,?,?,?,?,?,100299E3), ref: 10028A75

Strings

UINT32_MAX, xrefs: 10028AC3
I64_MAX, xrefs: 10028A83
FLT_MAX, xrefs: 10028B03
DBL_MIN, xrefs: 10028B81
I64_MIN, xrefs: 10028AA3
DBL_MAX, xrefs: 10028B62
INT_MAX, xrefs: 10028A63
-DBL_MAX, xrefs: 10028BC5
-FLT_MIN, xrefs: 10028B43
-DBL_MIN, xrefs: 10028A1A
INT_MIN, xrefs: 10028A3B
FLT_MIN, xrefs: 10028B23
-FLT_MAX, xrefs: 10028AE3

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: -DBL_MAX$-DBL_MIN$-FLT_MAX$-FLT_MIN$DBL_MAX$DBL_MIN$FLT_MAX$FLT_MIN$I64_MAX$I64_MIN$INT_MAX$INT_MIN$UINT32_MAX
API String ID: 2418673259-2628725902
Opcode ID: 6453b15dceaf4b7331f14c8ad6eaaf5a7c0dbe11f287a6335f0ed953db9f3e8b
Instruction ID: c151ce863bab8d22e13df11496c1752d1bc59b589b709a0be275ec7c3333394e
Opcode Fuzzy Hash: 6453b15dceaf4b7331f14c8ad6eaaf5a7c0dbe11f287a6335f0ed953db9f3e8b
Instruction Fuzzy Hash: DC5133BD8067009ED355DF25B05121EFBE0FF84740FE5C92EA5C957211EB399685AB03

Uniqueness

Uniqueness Score: -1.00%

Function 100195E0 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10019633
mv_calloc.MAIN ref: 1001964E
MultiByteToWideChar.KERNEL32 ref: 10019685
mv_calloc.MAIN ref: 100196D7
mv_freep.MAIN ref: 10019713
wcslen.MSVCRT ref: 1001971F
_wsopen.MSVCRT ref: 1001974B
mv_freep.MAIN ref: 10019758
_sopen.MSVCRT ref: 1001978A
_errno.MSVCRT ref: 100197F5
wcslen.MSVCRT ref: 1001981B
mv_calloc.MAIN ref: 10019857
wcscpy.MSVCRT ref: 10019872
wcscat.MSVCRT ref: 10019882
mv_freep.MAIN ref: 1001988A
_errno.MSVCRT ref: 100198E1
mv_freep.MAIN ref: 100198F4
mv_calloc.MAIN ref: 10019912
wcscpy.MSVCRT ref: 10019929
wcscat.MSVCRT ref: 1001993C
_errno.MSVCRT ref: 10019946
_errno.MSVCRT ref: 10019958

Strings

\\?\, xrefs: 10019869
\\?\UNC\, xrefs: 10019920

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _errnomv_callocmv_freep$ByteCharMultiWidewcscatwcscpywcslen$_sopen_wsopen
String ID: \\?\$\\?\UNC\
API String ID: 2585690843-3019864461
Opcode ID: 3b770d789a6b7b9b259c4104553542867824734224feeea9d00b87784f6ee047
Instruction ID: f678d7e62f75a51a3396b5e92a4772b9af71e601e6ce56c2c03e9c047c1b1921
Opcode Fuzzy Hash: 3b770d789a6b7b9b259c4104553542867824734224feeea9d00b87784f6ee047
Instruction Fuzzy Hash: 8F91C2B49097119FD350EF69C98421EBBE0FF89754F55892EF898CB390E774D8809B82

Uniqueness

Uniqueness Score: -1.00%

Function 100118C0 Relevance: 43.8, APIs: 29, Instructions: 289
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mv_get_token.MAIN ref: 10011913

Part of subcall function 10006940: strlen.MSVCRT ref: 10006950
Part of subcall function 10006940: mv_malloc.MAIN ref: 10006959
Part of subcall function 10006940: strspn.MSVCRT ref: 10006980
Part of subcall function 10006940: strspn.MSVCRT ref: 100069C1

mv_freep.MAIN ref: 10011930
mv_freep.MAIN ref: 1001193C
strspn.MSVCRT ref: 1001195F
mv_get_token.MAIN ref: 1001197C
mv_strdup.MAIN ref: 100119B2
mv_strdup.MAIN ref: 100119CA
mv_freep.MAIN ref: 10011A5F
mv_freep.MAIN ref: 10011A6B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$strspn$mv_get_tokenmv_strdup$mv_mallocstrlen
String ID:
API String ID: 2603649322-0
Opcode ID: a48f40283b9e65b32d1f5a6441022cda31c27f9d96bb31350562698b963a6cb7
Instruction ID: 9fb1d64ee0f767fe4cf9b76db285c661084ffa79d26213b968ed75a23716e163
Opcode Fuzzy Hash: a48f40283b9e65b32d1f5a6441022cda31c27f9d96bb31350562698b963a6cb7
Instruction Fuzzy Hash: D3B128759097419FC744DF25D58069EBBE5FF88690F96892EF8C89B311E730E980CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001C790 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

mv_strcasecmp.MAIN ref: 1001C7BE
mv_mallocz.MAIN ref: 1001C7E7

Strings

MD5, xrefs: 1001C791

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_malloczmv_strcasecmp
String ID: MD5
API String ID: 1451953452-1168476579
Opcode ID: fd8ebb722839f17aaf6157ba037008f289ae86b4bf847cb60b004431fafa5101
Instruction ID: eb5494de89beb9ab75199d641261a1b3f1512631375a939401cd0d8990c0213e
Opcode Fuzzy Hash: fd8ebb722839f17aaf6157ba037008f289ae86b4bf847cb60b004431fafa5101
Instruction Fuzzy Hash: BB91F4B4909705DFC710DF68C080A1EBBE0FF89354F55896EE9888B362E735D980EB56

Uniqueness

Uniqueness Score: -1.00%

Function 10011560 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 216stringCOMMON

Download Yara Rule

APIs

mv_strdup.MAIN ref: 100115BA

Part of subcall function 100267C0: strlen.MSVCRT ref: 100267DE
Part of subcall function 100267C0: _aligned_realloc.MSVCRT ref: 10026805

mv_strdup.MAIN ref: 10011673
mv_dict_get.MAIN ref: 100116EB
mv_mallocz.MAIN ref: 10011707
mv_freep.MAIN ref: 100117A1
mv_realloc_array.MAIN ref: 100117C6
strlen.MSVCRT ref: 100117E4
strlen.MSVCRT ref: 100117EE
mv_realloc.MAIN ref: 10011804
mv_freep.MAIN ref: 1001182E

Strings

, xrefs: 10011618
%lld, xrefs: 10011587

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strlen$mv_freepmv_strdup$_aligned_reallocmv_dict_getmv_malloczmv_reallocmv_realloc_array
String ID: $%lld
API String ID: 420417855-3617178099
Opcode ID: d510e7aac1835d2d14d11394022ecc06c06f3c51c024d220679ff3e81abd8013
Instruction ID: 1aac3acce1ec20135028bdf280dbd7ca7379982b25da7d1f386a19304280214e
Opcode Fuzzy Hash: d510e7aac1835d2d14d11394022ecc06c06f3c51c024d220679ff3e81abd8013
Instruction Fuzzy Hash: 0C912AB5909751CBC754DF28C58065EBBE0FF88384F56892DED848B345EB74E884DB82

Uniqueness

Uniqueness Score: -1.00%

Function 100192E0 Relevance: 38.6, APIs: 18, Strings: 4, Instructions: 150fileCOMMON

Download Yara Rule

APIs

mvpriv_open.MAIN ref: 1001933F

Part of subcall function 100195E0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10019633
Part of subcall function 100195E0: mv_calloc.MAIN ref: 1001964E
Part of subcall function 100195E0: MultiByteToWideChar.KERNEL32 ref: 10019685
Part of subcall function 100195E0: mv_calloc.MAIN ref: 100196D7
Part of subcall function 100195E0: mv_freep.MAIN ref: 10019713
Part of subcall function 100195E0: wcslen.MSVCRT ref: 1001971F
Part of subcall function 100195E0: _wsopen.MSVCRT ref: 1001974B

_fstat64.MSVCRT ref: 10019366
_close.MSVCRT ref: 10019394
_get_osfhandle.MSVCRT ref: 100193C5
CreateFileMappingA.KERNEL32 ref: 100193ED
MapViewOfFile.KERNEL32 ref: 10019422
CloseHandle.KERNEL32 ref: 10019434
mv_log.MAIN ref: 1001945D
_close.MSVCRT ref: 10019465
_errno.MSVCRT ref: 10019480
mv_strerror.MAIN ref: 100194A1
mv_log.MAIN ref: 100194C7
_errno.MSVCRT ref: 100194D8
mv_strerror.MAIN ref: 100194FE
mv_log.MAIN ref: 1001951B
_close.MSVCRT ref: 10019523
mv_log.MAIN ref: 1001954F
_close.MSVCRT ref: 10019557

Strings

Cannot read file '%s': %s, xrefs: 100194A6
Error occurred in CreateFileMapping(), xrefs: 10019561
File size for file '%s' is too big, xrefs: 10019535
Error occurred in fstat(): %s, xrefs: 1001950B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _closemv_log$ByteCharFileMultiWide_errnomv_callocmv_strerror$CloseCreateHandleMappingView_fstat64_get_osfhandle_wsopenmv_freepmvpriv_openwcslen
String ID: Cannot read file '%s': %s$Error occurred in CreateFileMapping()$Error occurred in fstat(): %s$File size for file '%s' is too big
API String ID: 2213036534-2445208470
Opcode ID: 115248d222d0207b4b6978023f43e634846f62dc27148f7a7cd2e032391e2a57
Instruction ID: 617e9db2a449c1ebb97318d6d46501e643e1f1538bb2456b081f200f3c68d203
Opcode Fuzzy Hash: 115248d222d0207b4b6978023f43e634846f62dc27148f7a7cd2e032391e2a57
Instruction Fuzzy Hash: 6861C0B59097459FC310EF29C48529EFBE4FF88700F41892EE9D98B351E774E9809B82

Uniqueness

Uniqueness Score: -1.00%

Function 10012850 Relevance: 37.7, APIs: 25, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de691f1ba13835e21657e86075408ec6b0dc09785dc25b7b1d0ef4953b892b6e
Instruction ID: 2f248bfe3db45479d33083a71d7c86b86264631c37f86e05a0edac7835ee7c2e
Opcode Fuzzy Hash: de691f1ba13835e21657e86075408ec6b0dc09785dc25b7b1d0ef4953b892b6e
Instruction Fuzzy Hash: 2A6192B8A04B558FC704EF69D4C191AB7E0FF48254F51891CE9948B31AEB30F896CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 1004DA90 Relevance: 36.9, APIs: 11, Strings: 10, Instructions: 196COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1004DAAB
mv_bprintf.MAIN ref: 1004DB07
mv_bprintf.MAIN ref: 1004DB2B
mv_bprintf.MAIN ref: 1004DB5A
mv_bprintf.MAIN ref: 1004DB99
mv_bprintf.MAIN ref: 1004DBB9
mv_bprintf.MAIN ref: 1004DC25
mv_bprintf.MAIN ref: 1004DC52
mv_bprintf.MAIN ref: 1004DC84
mv_bprintf.MAIN ref: 1004DCA0
mv_bprintf.MAIN ref: 1004DD2D

Strings

%sunaligned, xrefs: 1004DAFB
%simdct_full, xrefs: 1004DB8D
aligned, xrefs: 1004DC93
%sinplace, xrefs: 1004DB1F
%sout_of_place, xrefs: 1004DD21
%sasm_call, xrefs: 1004DC78
flags: [, xrefs: 1004DA9A
%spreshuf, xrefs: 1004DC43
%sinv_only, xrefs: 1004DC19
%sfwd_only, xrefs: 1004DB4E

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: %sasm_call$%sfwd_only$%simdct_full$%sinplace$%sinv_only$%sout_of_place$%spreshuf$%sunaligned$aligned$flags: [
API String ID: 3083893021-1441846183
Opcode ID: 16923d63af30e83d2c7efbf8c1da79df8fe88a9a1f2f24f8342d05ec943732c7
Instruction ID: 1dc6e91ea481e811bfe5c5906a416067f5532a53e96b106321926297a6af6804
Opcode Fuzzy Hash: 16923d63af30e83d2c7efbf8c1da79df8fe88a9a1f2f24f8342d05ec943732c7
Instruction Fuzzy Hash: DD6110B5A186858BE300EF19C492B1FBAD1EB84794F66883EF0C8C7240D778DD41D78A

Uniqueness

Uniqueness Score: -1.00%

Function 100296D4 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 221COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 100296DC
mv_freep.MAIN ref: 100296E8
mv_freep.MAIN ref: 10029721
mv_freep.MAIN ref: 1002972D
mv_log.MAIN ref: 1002977B

Strings

%d/%d, xrefs: 10029A8B
(default , xrefs: 10029762
"%s", xrefs: 100297AF
%lld, xrefs: 10029876
%-15s , xrefs: 100292D4

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_log
String ID: %-15s $ (default $"%s"$%d/%d$%lld
API String ID: 2749705325-3616743394
Opcode ID: 54d7423ecd114c77d54f3555a7fa34dbefed27d13947955652e8fafffa582ee6
Instruction ID: a78736eaf865b939ee6902c1b70fed4f9ad85332988bb7fcaf3499c0514d5393
Opcode Fuzzy Hash: 54d7423ecd114c77d54f3555a7fa34dbefed27d13947955652e8fafffa582ee6
Instruction Fuzzy Hash: D191AF78A087459FC750DF28E48065EFBE1FF89780F91892EF8998B351E774E9418B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002E900 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 199stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 1002E948
mv_strlcpy.MAIN ref: 1002E96B
strchr.MSVCRT ref: 1002E97C
strlen.MSVCRT ref: 1002E996
mv_strcasecmp.MAIN ref: 1002E9AF
mv_strcasecmp.MAIN ref: 1002E9C4
mv_get_random_seed.MAIN ref: 1002E9D1
strtoul.MSVCRT ref: 1002EA06

Strings

0123456789ABCDEFabcdef, xrefs: 1002EACB
Invalid 0xRRGGBB[AA] color string: '%s', xrefs: 1002EBF7
Invalid alpha value specifier '%s' in '%s', xrefs: 1002EBC4
bikeshed, xrefs: 1002E9BB
random, xrefs: 1002E9A6

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strcasecmpstrlen$mv_get_random_seedmv_strlcpystrchrstrtoul
String ID: 0123456789ABCDEFabcdef$Invalid 0xRRGGBB[AA] color string: '%s'$Invalid alpha value specifier '%s' in '%s'$bikeshed$random
API String ID: 887406882-1143575717
Opcode ID: 36b8675d15f54015864d4cad0e834c3d0155204aa8deb69ae3f5c7034227c4af
Instruction ID: 5528a354f5a3b115f7f47ff1570fdc362057e49d17d9d5bd6ab876f37a57e2b2
Opcode Fuzzy Hash: 36b8675d15f54015864d4cad0e834c3d0155204aa8deb69ae3f5c7034227c4af
Instruction Fuzzy Hash: 5F819A749487819ED342DF38D49064EBBE0EF85380F95CE6EE8C99B241E778D980DB42

Uniqueness

Uniqueness Score: -1.00%

Function 10011210 Relevance: 30.2, APIs: 20, Instructions: 223COMMON

Download Yara Rule

APIs

mv_strdup.MAIN ref: 10011353
mv_strdup.MAIN ref: 10011383
mv_dict_get.MAIN ref: 100113B1
mv_mallocz.MAIN ref: 100113C7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strdup$mv_dict_getmv_mallocz
String ID:
API String ID: 3834523185-0
Opcode ID: 34b8535691b7a7fadd794d32cbd0790fd03931f9f00ffb340a5a63087569dce7
Instruction ID: 095bdf82c674aaefaf2cda3429f550f943fa4cc151a1ce18d08b383c11ff4614
Opcode Fuzzy Hash: 34b8535691b7a7fadd794d32cbd0790fd03931f9f00ffb340a5a63087569dce7
Instruction Fuzzy Hash: F39127B5A087518FC754DF68C48065EBBE1FF88794F12892DED989B344E770E981CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001A6C0 Relevance: 28.8, APIs: 19, Instructions: 325COMMON

Download Yara Rule

APIs

mv_dict_copy.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A89A
mv_dict_copy.MAIN ref: 1001A996
mv_buffer_ref.MAIN ref: 1001A9EC
mv_realloc.MAIN ref: 1001AA26
mv_mallocz.MAIN ref: 1001AA40
mv_buffer_replace.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AB9F
mv_buffer_replace.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001ABBD

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_replacemv_dict_copy$mv_buffer_refmv_malloczmv_realloc
String ID:
API String ID: 1780483662-0
Opcode ID: 07b599f6d8ee219048b6128147e910c9945fa735575f1c6576c8cbb7c6ffcc6f
Instruction ID: 1c222d73e1748437048cd959b4fb099db9e50fe00274f25359b61923485b158e
Opcode Fuzzy Hash: 07b599f6d8ee219048b6128147e910c9945fa735575f1c6576c8cbb7c6ffcc6f
Instruction Fuzzy Hash: 71F1B5B49043468FC764CF29C580799BBE1FF49350F058A6EE9899B712E730E985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 10023730 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 193COMMON

Download Yara Rule

APIs

mv_bprint_init.MAIN ref: 1002377E
mv_bprint_init.MAIN ref: 10023795
mv_bprint_init.MAIN ref: 100237AC
mv_bprint_init.MAIN ref: 100237C5
mv_bprintf.MAIN ref: 10023824
mv_bprintf.MAIN ref: 10023847
mv_vbprintf.MAIN ref: 10023885
mv_bprint_finalize.MAIN ref: 10023929
mv_bprint_init.MAIN ref: 100239C2
mv_bprint_init.MAIN ref: 100239E7
mv_bprint_init.MAIN ref: 100239F9
mv_bprint_init.MAIN ref: 10023A10

Strings

[%s @ %p] , xrefs: 10023814, 10023833
[%s] , xrefs: 10023984
%s%s%s%s, xrefs: 100238EF

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_init$mv_bprintf$mv_bprint_finalizemv_vbprintf
String ID: %s%s%s%s$[%s @ %p] $[%s]
API String ID: 2514531573-1798253436
Opcode ID: 73ec329c920999803a4babe89b4941ef9f254048450b1a5a3304028e830a3db2
Instruction ID: 6f949b97a94191d98c9e239c908f2f64f0d76179adbd4d945766b856959e5812
Opcode Fuzzy Hash: 73ec329c920999803a4babe89b4941ef9f254048450b1a5a3304028e830a3db2
Instruction Fuzzy Hash: 5F8106B49097809FD354DF28D08069BBBE5FF89380F95C92EF8C88B315DA749984CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1002D230 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 128stringCOMMON

Download Yara Rule

APIs

mv_get_token.MAIN ref: 1002D267

Part of subcall function 10006940: strlen.MSVCRT ref: 10006950
Part of subcall function 10006940: mv_malloc.MAIN ref: 10006959
Part of subcall function 10006940: strspn.MSVCRT ref: 10006980
Part of subcall function 10006940: strspn.MSVCRT ref: 100069C1

strspn.MSVCRT ref: 1002D292
mv_get_token.MAIN ref: 1002D2B5
mv_log.MAIN ref: 1002D2E5
mv_opt_set.MAIN ref: 1002D302
mv_log.MAIN ref: 1002D379
mv_log.MAIN ref: 1002D3C9
mv_freep.MAIN ref: 1002D3EE

Strings

Missing key or no key/value separator found after key '%s', xrefs: 1002D3B4
Setting entry with key '%s' to value '%s', xrefs: 1002D2CC
Key '%s' not found., xrefs: 1002D364

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_logstrspn$mv_get_token$mv_freepmv_mallocmv_opt_setstrlen
String ID: Key '%s' not found.$Missing key or no key/value separator found after key '%s'$Setting entry with key '%s' to value '%s'
API String ID: 3679258194-2858522012
Opcode ID: 595c6547f65cc4bb8e71bd801e19b34be3a319f29eb8b0681d307362fd9c2fa6
Instruction ID: 7fb14f7b88a9286a04fbc63168e79df0a13211f554c8c21c667f0136fc5f52d7
Opcode Fuzzy Hash: 595c6547f65cc4bb8e71bd801e19b34be3a319f29eb8b0681d307362fd9c2fa6
Instruction Fuzzy Hash: 5B41D2B4A097409FC340EF29E48061EBBE4FF88394F91892EF5C887351EA75D940CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1002D400 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1002D46B
mv_opt_set.MAIN ref: 1002D488
mv_opt_get_key_value.MAIN ref: 1002D4F6

Part of subcall function 1002BF30: strspn.MSVCRT ref: 1002BF4D
Part of subcall function 1002BF30: strspn.MSVCRT ref: 1002BF97
Part of subcall function 1002BF30: strchr.MSVCRT ref: 1002BFB5
Part of subcall function 1002BF30: mv_malloc.MAIN(?,?,?,?,?,?,?,?,?,?,100AEACF,100AEB86,00000000,?,1000DF13), ref: 1002BFCD
Part of subcall function 1002BF30: mv_get_token.MAIN ref: 1002BFFF

mv_strerror.MAIN ref: 1002D5A9
mv_log.MAIN ref: 1002D5D2
mv_log.MAIN ref: 1002D615
mv_log.MAIN ref: 1002D653

Strings

Setting '%s' to value '%s', xrefs: 1002D44C
Unable to parse '%s': %s, xrefs: 1002D5AE
Option '%s' not found, xrefs: 1002D637
No option name near '%s', xrefs: 1002D600

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$strspn$mv_get_tokenmv_mallocmv_opt_get_key_valuemv_opt_setmv_strerrorstrchr
String ID: No option name near '%s'$Option '%s' not found$Setting '%s' to value '%s'$Unable to parse '%s': %s
API String ID: 669169455-2003673103
Opcode ID: 42f4af90029895782656a055397532cb0e26e144a9066ca91bb51c1471e1f9dd
Instruction ID: 701acf41a1ead03db3666d664b3341f8442fad518a1ed00e3a98405c4d1a9712
Opcode Fuzzy Hash: 42f4af90029895782656a055397532cb0e26e144a9066ca91bb51c1471e1f9dd
Instruction Fuzzy Hash: 5C51F575A087509FD760EF29E48075EBBE4EFC4654F91882EE9C9C7341E774E8408B82

Uniqueness

Uniqueness Score: -1.00%

Function 1004C6B7 Relevance: 25.9, APIs: 17, Instructions: 379COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C757
mv_tree_find.MAIN ref: 1004C776
mv_tree_find.MAIN ref: 1004C7EF
mv_tree_find.MAIN ref: 1004C80E
mv_tree_find.MAIN ref: 1004C8CF
mv_tree_find.MAIN ref: 1004C8EE
mv_tree_find.MAIN ref: 1004C958
mv_tree_find.MAIN ref: 1004C973

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: a2a5cd09734139798f1fd845032fbc4d271d5e899faa0ed1a3b262cc80cb7db8
Instruction ID: cce57886af535d8735bdf396c26f78100a8d8e3b141664cbd45599b0a5c3ab2e
Opcode Fuzzy Hash: a2a5cd09734139798f1fd845032fbc4d271d5e899faa0ed1a3b262cc80cb7db8
Instruction Fuzzy Hash: 4FF1AFB490974A9FC344DF2AC18091AFBE5FFC8654F61892EE888D7311E774E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1004C704 Relevance: 25.9, APIs: 17, Instructions: 363COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C757
mv_tree_find.MAIN ref: 1004C776
mv_tree_find.MAIN ref: 1004C7EF
mv_tree_find.MAIN ref: 1004C80E
mv_tree_find.MAIN ref: 1004C8CF
mv_tree_find.MAIN ref: 1004C8EE

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: 2e39002f0947aa2d0dcfdfe7d57795e1a31c696425fd7e0b4506f071d05121fc
Instruction ID: 7ec3c2c7dacb140ed4bfedfc7a75d038d4e13e51791f240047a25a975b8cf788
Opcode Fuzzy Hash: 2e39002f0947aa2d0dcfdfe7d57795e1a31c696425fd7e0b4506f071d05121fc
Instruction Fuzzy Hash: 73F1A0B490974A9FC344DF2AC18081AFBE5FFC8654F61892EE898D7311E774E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1001E0B0 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

mv_frame_unref.MAIN ref: 1001E185
mv_frame_unref.MAIN ref: 1001E240

Strings

Failed to map frame into derived frame context: %d., xrefs: 1001E37D
Invalid mapping found when attempting unmap., xrefs: 1001E295

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_frame_unref
String ID: Failed to map frame into derived frame context: %d.$Invalid mapping found when attempting unmap.
API String ID: 3522828444-968520014
Opcode ID: c51a9e1b472074b834904429bd500262b32e19eb408ec7d04c88999b5f63e95e
Instruction ID: a9b2bb0cb6fdc28be8a2433754fc5c1c364900424f67e1161cdcac98c29180a2
Opcode Fuzzy Hash: c51a9e1b472074b834904429bd500262b32e19eb408ec7d04c88999b5f63e95e
Instruction Fuzzy Hash: 9A91BEB8A097419FC744CF29C58090EBBE0FF88754F16896EE9998B351D730ED81CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1004A330 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 1004A35C
mv_calloc.MAIN ref: 1004A389
AcquireSRWLockExclusive.KERNEL32 ref: 1004A474
_beginthreadex.MSVCRT ref: 1004A4B6
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A4ED
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A52F
mvpriv_slicethread_free.MAIN ref: 1004A53E
mv_cpu_count.MAIN ref: 1004A550
mv_mallocz.MAIN ref: 1004A58A
mv_log.MAIN ref: 1004A5D1
abort.MSVCRT ref: 1004A5D6
mv_freep.MAIN ref: 1004A5E2

Strings

j, xrefs: 1004A5A8

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$Releasemv_mallocz$Acquire_beginthreadexabortmv_callocmv_cpu_countmv_freepmv_logmvpriv_slicethread_free
String ID: j
API String ID: 2987404029-2137352139
Opcode ID: 99bc2fdff7da96867b2e9425b216463629f581a320c99328d2d44c55e57351e6
Instruction ID: aa8bda996068d509f672b83f007ff4c046d751420288b4ab536222a33dc34af4
Opcode Fuzzy Hash: 99bc2fdff7da96867b2e9425b216463629f581a320c99328d2d44c55e57351e6
Instruction Fuzzy Hash: 0481E2B5A087409FD740EF29D48061ABBE0FF89344F118A2EF8998B341E775E945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 1009E7E0 Relevance: 24.5, APIs: 4, Strings: 10, Instructions: 48threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 1009E854
_ultoa.MSVCRT ref: 1009E86D
OutputDebugStringA.KERNEL32 ref: 1009E8AD
abort.MSVCRT ref: 1009E8B6

Strings

thre, xrefs: 1009E832
for , xrefs: 1009E82A
ad , xrefs: 1009E83A
in_k, xrefs: 1009E81A
p sp, xrefs: 1009E812
Erro, xrefs: 1009E87F
eys , xrefs: 1009E822
eani, xrefs: 1009E802
ng u, xrefs: 1009E80A
r cl, xrefs: 1009E7FA

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Erro$ad $eani$eys $for $in_k$ng u$p sp$r cl$thre
API String ID: 4191895893-3726152543
Opcode ID: 32d6918716459faddcb7dc1042b6d8857ba7126cf37684ded785e2cb3a3e0069
Instruction ID: 088c25127c847526b46776e24d12a3bdf4591a2816cfb9b61a0b1617db757378
Opcode Fuzzy Hash: 32d6918716459faddcb7dc1042b6d8857ba7126cf37684ded785e2cb3a3e0069
Instruction Fuzzy Hash: 942117B050C3819FE354EF64C19931FBBE2EB81304F909D2DE4894A3A5CBB9C9498B47

Uniqueness

Uniqueness Score: -1.00%

Function 10010320 Relevance: 22.7, APIs: 15, Instructions: 205COMMON

Download Yara Rule

APIs

mv_sub_q.MAIN ref: 10010376
mv_sub_q.MAIN ref: 1001039F
mv_add_q.MAIN ref: 100103BA
mv_sub_q.MAIN ref: 100103DE
mv_add_q.MAIN ref: 100103F9
mv_sub_q.MAIN ref: 1001041D
mv_add_q.MAIN ref: 10010438
mv_sub_q.MAIN ref: 1001045C
mv_add_q.MAIN ref: 10010477
mv_sub_q.MAIN ref: 1001049B
mv_add_q.MAIN ref: 100104B6

Part of subcall function 10032E70: mv_reduce.MAIN(?,?), ref: 10032EC9

mv_sub_q.MAIN ref: 100104D8

Part of subcall function 10032EF0: mv_reduce.MAIN(?), ref: 10032F61

mv_add_q.MAIN ref: 100104F3
mv_sub_q.MAIN ref: 10010517
mv_add_q.MAIN ref: 10010532

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_sub_q$mv_add_q$mv_reduce
String ID:
API String ID: 416313997-0
Opcode ID: 16bc828a6e54490581e3bca817dbe7aaeb3a5d58f0d8fddf083b3c311aad9c19
Instruction ID: 137885487f331a62fd44dc5ad255b81a0a07b8edcdf78e8c3b60c95945d2ee5e
Opcode Fuzzy Hash: 16bc828a6e54490581e3bca817dbe7aaeb3a5d58f0d8fddf083b3c311aad9c19
Instruction Fuzzy Hash: 9881B2B4A08B06AFC744DF6AC18151AFBE1FF88251F10C92EE98DC7711E670E8519F82

Uniqueness

Uniqueness Score: -1.00%

Function 1001F200 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN ref: 1001F220
mv_image_get_linesize.MAIN ref: 1001F259

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

mv_image_fill_linesizes.MAIN(?), ref: 1001F2F7
mv_image_fill_plane_sizes.MAIN(?), ref: 1001F366
mv_malloc.MAIN(?), ref: 1001F39E
mv_image_fill_pointers.MAIN(?), ref: 1001F3CF

Part of subcall function 1001EFD0: mv_image_fill_plane_sizes.MAIN ref: 1001F040

mvpriv_set_systematic_pal2.MAIN(?), ref: 1001F419

Strings

Picture size %ux%u is invalid, xrefs: 1001F48C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_image_fill_plane_sizesmv_pix_fmt_desc_get$mv_image_fill_linesizesmv_image_fill_pointersmv_image_get_linesizemv_mallocmvpriv_set_systematic_pal2
String ID: Picture size %ux%u is invalid
API String ID: 3240037220-1963597007
Opcode ID: 677e3105d86441c919a6bb07a2d9eb729f5658238c16f65244001bb42f50e7cb
Instruction ID: 41a0369190cf79952ebc4083191ebf048a4207412b4fff0bffc105f261d70811
Opcode Fuzzy Hash: 677e3105d86441c919a6bb07a2d9eb729f5658238c16f65244001bb42f50e7cb
Instruction Fuzzy Hash: 39911576A087418FC350DF28C48572BBBE2FF98354F15892DE9A8CB355EB35D9808B42

Uniqueness

Uniqueness Score: -1.00%

Function 1009026E Relevance: 21.2, APIs: 14, Instructions: 202COMMON

Download Yara Rule

APIs

isspace.MSVCRT ref: 100902E9
isspace.MSVCRT ref: 10090319
free.MSVCRT ref: 10090378
free.MSVCRT ref: 1009039A
free.MSVCRT ref: 100903AF
isspace.MSVCRT ref: 10090406
free.MSVCRT ref: 10090468
free.MSVCRT ref: 10090486
free.MSVCRT ref: 10090494
free.MSVCRT ref: 10090748
free.MSVCRT ref: 10091858

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: free$isspace
String ID:
API String ID: 976929720-0
Opcode ID: b163d4d369103ade2559268b18c1e9f57b898a83c08365d6067c7703f8cff183
Instruction ID: ca441e24884805ae0a01a9b3e4b79260671fbd71cce081429fa1365773641494
Opcode Fuzzy Hash: b163d4d369103ade2559268b18c1e9f57b898a83c08365d6067c7703f8cff183
Instruction Fuzzy Hash: 8A8145746087428FD710DF25C08075ABBE4FF88748F12492DFAA89B261D770E949AB92

Uniqueness

Uniqueness Score: -1.00%

Function 1002E2B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

mv_bprint_init.MAIN ref: 1002E366
mv_opt_is_set_to_default.MAIN ref: 1002E3D0
mv_opt_get.MAIN ref: 1002E3FB
mv_bprint_escape.MAIN ref: 1002E445
mv_bprint_append_data.MAIN ref: 1002E462
mv_bprint_escape.MAIN ref: 1002E48D
mv_freep.MAIN ref: 1002E499
mv_bprint_finalize.MAIN ref: 1002E4F2
mv_log.MAIN ref: 1002E575

Strings

Invalid separator(s) found., xrefs: 1002E560

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_escape$mv_bprint_append_datamv_bprint_finalizemv_bprint_initmv_freepmv_logmv_opt_getmv_opt_is_set_to_default
String ID: Invalid separator(s) found.
API String ID: 350117393-2087347751
Opcode ID: 69ccca22108feb783cd74857b2cac3c0314cb1417c4cb460f6239eef7be459b8
Instruction ID: 035096c34b81a8408bd776f44eb798195d6d7415f3781d3bc3fbbb06a5d0ee26
Opcode Fuzzy Hash: 69ccca22108feb783cd74857b2cac3c0314cb1417c4cb460f6239eef7be459b8
Instruction Fuzzy Hash: 437133B56497818FD750DF29D48069BBBE5FF89384F85892EE998C3301E735ED048B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002F204 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

mv_gettime.MAIN ref: 1002F208
mv_strcasecmp.MAIN ref: 1002F240
mv_small_strptime.MAIN ref: 1002F25D
mv_small_strptime.MAIN ref: 1002F27A
mv_small_strptime.MAIN ref: 1002F2D6
mv_small_strptime.MAIN ref: 1002F2F1
_mktime64.MSVCRT ref: 1002F420

Strings

%Y%m%d, xrefs: 1002F26D
now, xrefs: 1002F233
%H%M%S, xrefs: 1002F2E5
%H:%M:%S, xrefs: 1002F2CA
%Y - %m - %d, xrefs: 1002F251

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_small_strptime$_mktime64mv_gettimemv_strcasecmp
String ID: %H%M%S$%H:%M:%S$%Y - %m - %d$%Y%m%d$now
API String ID: 3102546153-2275413634
Opcode ID: 714232e79b76d34a95a4b2be10d242d26dbfea1d23b5746406886e60186c9d60
Instruction ID: 7f3ee14ce240381be5dd98d6c3d180aec0b6e0ebcf4911cbbe250e8a450d1d0f
Opcode Fuzzy Hash: 714232e79b76d34a95a4b2be10d242d26dbfea1d23b5746406886e60186c9d60
Instruction Fuzzy Hash: F1518F75A083564FC344DF29948032AFBE1EFC8794F92893EE5D8C7391EA34D9458B82

Uniqueness

Uniqueness Score: -1.00%

Function 10031960 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 85stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 10031977
strcmp.MSVCRT ref: 1003198C
strcmp.MSVCRT ref: 100319DC

Strings

bgra, xrefs: 100319F0
rgb32, xrefs: 10031963
yuv420p, xrefs: 100319A0, 10031A24
bgr32, xrefs: 10031983
%s%s, xrefs: 100319FC
rgba, xrefs: 10031993

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp
String ID: %s%s$bgr32$bgra$rgb32$rgba$yuv420p
API String ID: 1004003707-3566121812
Opcode ID: d32a04ad6243debcaeacd2200b49bc79f4e9a670f515df0e03357758963548ad
Instruction ID: f43fe70899dd8ef4f4baf1748d2a43fec607c47801efeecbfc865d4fb8ae2220
Opcode Fuzzy Hash: d32a04ad6243debcaeacd2200b49bc79f4e9a670f515df0e03357758963548ad
Instruction Fuzzy Hash: EA216179A083559BD701DF69899175EB6F4EF88682F41492FE8C8DB301E778C800D742

Uniqueness

Uniqueness Score: -1.00%

Function 1004C82C Relevance: 19.8, APIs: 13, Instructions: 294COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C8CF
mv_tree_find.MAIN ref: 1004C8EE
mv_tree_find.MAIN ref: 1004C958
mv_tree_find.MAIN ref: 1004C973
mv_tree_find.MAIN ref: 1004CA6F
mv_tree_find.MAIN ref: 1004CA8E
mv_tree_find.MAIN ref: 1004CAF8
mv_tree_find.MAIN ref: 1004CB13

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: 95cf165c7df1e3b14e8353417eaf65eff3f766b1f1fabdb0d3657f97e4e1532e
Instruction ID: 92974a57f51364e3157bc9e69e38102b8c966e1fd57831e9c9b5ac2784e8d0df
Opcode Fuzzy Hash: 95cf165c7df1e3b14e8353417eaf65eff3f766b1f1fabdb0d3657f97e4e1532e
Instruction Fuzzy Hash: 1FC1C2B490974A9FC340DF6AC18081AFBE5FFC8654F61892EE898D7311E774E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1004C877 Relevance: 19.8, APIs: 13, Instructions: 279COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C8CF
mv_tree_find.MAIN ref: 1004C8EE
mv_tree_find.MAIN ref: 1004C958
mv_tree_find.MAIN ref: 1004C973
mv_tree_find.MAIN ref: 1004CA6F
mv_tree_find.MAIN ref: 1004CA8E

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: 5ba1de0a2128bb80714fc7f87f514a6120d16dbb4c6ec235376ab0e5548afddf
Instruction ID: 55863b4f0a31e834c219965d94d4823f7879c6ff1bed93916ad31882f3d71024
Opcode Fuzzy Hash: 5ba1de0a2128bb80714fc7f87f514a6120d16dbb4c6ec235376ab0e5548afddf
Instruction Fuzzy Hash: 8AC1D2B4909749AFC340DF6AC18091AFBE5FF88654F61892EE8D8D7311E734E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1001C870 Relevance: 19.7, APIs: 13, Instructions: 169COMMON

Download Yara Rule

APIs

mv_ripemd_init.MAIN ref: 1001C8DE
mv_ripemd_init.MAIN ref: 1001C8F6
mv_ripemd_init.MAIN ref: 1001C90E
mv_ripemd_init.MAIN ref: 1001C926
mv_sha_init.MAIN ref: 1001C93E
mv_sha_init.MAIN ref: 1001C95E
mv_sha_init.MAIN ref: 1001C97E
mv_sha512_init.MAIN ref: 1001C99E
mv_sha512_init.MAIN ref: 1001C9BE
mv_sha512_init.MAIN ref: 1001C9DE
mv_sha512_init.MAIN ref: 1001C9FE
mv_adler32_update.MAIN ref: 1001CA46
mv_crc.MAIN ref: 1001CAD5

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_ripemd_initmv_sha512_init$mv_sha_init$mv_adler32_updatemv_crc
String ID:
API String ID: 2533704273-0
Opcode ID: a5574497256713bb20ba09e0eacec7ebb4491d86d0e4b8baf7000fed20719829
Instruction ID: b4fd7817c68cc5ebcb381f62e52a11943eedc005ab1a14790db74db78419b9e7
Opcode Fuzzy Hash: a5574497256713bb20ba09e0eacec7ebb4491d86d0e4b8baf7000fed20719829
Instruction Fuzzy Hash: 8871AFB4909701DFC754DF68C08091ABBE0FF8D354F5489AEE9898B322E735D980EB56

Uniqueness

Uniqueness Score: -1.00%

Function 1001A460 Relevance: 19.6, APIs: 13, Instructions: 146COMMON

Download Yara Rule

APIs

mv_dict_free.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A49E
mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A4A6
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A496

Part of subcall function 1000A000: mv_freep.MAIN ref: 1000A01E

mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A4D0
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A4E6
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A50D
mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A51D
mv_dict_free.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A52B
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A539
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A547
mv_buffer_unref.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A555
mv_freep.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A565
mv_channel_layout_uninit.MAIN(?,?,?,?,?,?,1001ADCA), ref: 1001A578

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_unref$mv_freep$mv_dict_free$mv_channel_layout_uninit
String ID:
API String ID: 1735483532-0
Opcode ID: 945f5bc7cbde55a6aa345190f856de26ec9369814dab5ad9417d2f0141cb4add
Instruction ID: 3743f490041121a309f73bd17641a77e7b536aba58928b40e76834ce72ff9424
Opcode Fuzzy Hash: 945f5bc7cbde55a6aa345190f856de26ec9369814dab5ad9417d2f0141cb4add
Instruction Fuzzy Hash: 3A516CB19047028BDB10DF24C88178A77E5FF45364F0A45BADC989F38AE775E8C58BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000C640 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 1000C650
memcmp.MSVCRT ref: 1000C6F4

Strings

mono, xrefs: 1000C6B0

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: memcmpstrlen
String ID: mono
API String ID: 3108337309-2381334079
Opcode ID: 05a9566f9cebdc7444aeb341508e8bd87ecfd7e1d953646c9f26566dae47a867
Instruction ID: b6009183c03875402946771f74e016b0be1646e1b5b10329ba9fdfd6138aa893
Opcode Fuzzy Hash: 05a9566f9cebdc7444aeb341508e8bd87ecfd7e1d953646c9f26566dae47a867
Instruction Fuzzy Hash: 4D712874A083598FE314DF25C484A1ABBE2FFC8384F15892EE88997315DB70E8459B86

Uniqueness

Uniqueness Score: -1.00%

Function 1001E450 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

mv_get_pix_fmt_name.MAIN ref: 1001E64E
mv_log.MAIN ref: 1001E675

Strings

The hardware pixel format '%s' is not supported by the device type '%s', xrefs: 1001E663

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_get_pix_fmt_namemv_log
String ID: The hardware pixel format '%s' is not supported by the device type '%s'
API String ID: 3418758923-379977042
Opcode ID: 5dfad572c67db8fa61b7bb2c6cdad9a604c24d0b64868fd794a6f7046a9e5d28
Instruction ID: 93c42ac0cc7c39aee4c6308fb1e9594b2517373d7f7eca67d321c97bd06f55ee
Opcode Fuzzy Hash: 5dfad572c67db8fa61b7bb2c6cdad9a604c24d0b64868fd794a6f7046a9e5d28
Instruction Fuzzy Hash: 4861C274608B818FC750DF29C480A0EB7E5FF88754F568A6DE998DB351E770EC818B42

Uniqueness

Uniqueness Score: -1.00%

Function 1000A1D0 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

mv_realloc.MAIN ref: 1000A231
mv_mallocz.MAIN ref: 1000A24B
mv_mallocz.MAIN ref: 1000A284
mv_freep.MAIN ref: 1000A2DA
mv_realloc.MAIN ref: 1000A344
mv_realloc.MAIN ref: 1000A36B
mv_mallocz.MAIN ref: 1000A385
mv_mallocz.MAIN ref: 1000A3BC

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_realloc$mv_freep
String ID:
API String ID: 3944475926-0
Opcode ID: 21c0e84fb2d2b07cdbd2145871ab2905cba1277f35f8114cc737119d02b58269
Instruction ID: 4ee62d273146a1fe968e339e986c88b207b98d61c88eaf1789f61ff4cee38887
Opcode Fuzzy Hash: 21c0e84fb2d2b07cdbd2145871ab2905cba1277f35f8114cc737119d02b58269
Instruction Fuzzy Hash: BF7115B48087508FD710DF24C48471ABBE0FF8A384F568A6DE9898B369D775E980CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1004C160 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 179COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1004C2A7
mv_log.MAIN ref: 1004C320
mv_log.MAIN ref: 1004C3E1
mv_log.MAIN ref: 1004C413

Strings

Valid timecode frame rate must be specified. Minimum value is 1, xrefs: 1004C3FE
Drop frame is only allowed with multiples of 30000/1001 FPS, xrefs: 1004C30B
Using non-standard frame rate %d/%d, xrefs: 1004C287
gfff, xrefs: 1004C342
%d:%d:%d%c%d, xrefs: 1004C19B
Unable to parse timecode, syntax: hh:mm:ss[:;.]ff, xrefs: 1004C3CA

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: %d:%d:%d%c%d$Drop frame is only allowed with multiples of 30000/1001 FPS$Unable to parse timecode, syntax: hh:mm:ss[:;.]ff$Using non-standard frame rate %d/%d$Valid timecode frame rate must be specified. Minimum value is 1$gfff
API String ID: 2418673259-2042051344
Opcode ID: 176bcdf597b490fee4af283c04cbe13f8de8e079172abadff0e8b3cae13c4abb
Instruction ID: 51795c79a45c6e8ce531692f10421d4895f82dc3b0050cc4962ed38357205801
Opcode Fuzzy Hash: 176bcdf597b490fee4af283c04cbe13f8de8e079172abadff0e8b3cae13c4abb
Instruction Fuzzy Hash: 4561A4719087498BC760CF68C580A4EBBE1FB84350F25893FE999DB351D674ED409B86

Uniqueness

Uniqueness Score: -1.00%

Function 1001E2F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

mv_frame_alloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E32A

Part of subcall function 1001AC40: mv_malloc.MAIN ref: 1001AC56

mv_hwframe_get_buffer.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E34A

Part of subcall function 1001E2F0: mv_hwframe_map.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E36C
Part of subcall function 1001E2F0: mv_log.MAIN ref: 1001E396
Part of subcall function 1001E2F0: mv_frame_free.MAIN ref: 1001E3A2

mv_buffer_ref.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E317

Part of subcall function 10009FC0: mv_mallocz.MAIN ref: 10009FD2

mv_buffer_ref.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E3D3

Strings

Failed to map frame into derived frame context: %d., xrefs: 1001E37D

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_ref$mv_frame_allocmv_frame_freemv_hwframe_get_buffermv_hwframe_mapmv_logmv_mallocmv_mallocz
String ID: Failed to map frame into derived frame context: %d.
API String ID: 2770197599-2491951210
Opcode ID: b982bc6816b3afb20851306c66ddb92193a8adb26d1f7859c5dff6e59dc61fb9
Instruction ID: 9b451d42297ff9da348d1ac60a3a70938ed94ec3f991f54ec8aa55de9da18352
Opcode Fuzzy Hash: b982bc6816b3afb20851306c66ddb92193a8adb26d1f7859c5dff6e59dc61fb9
Instruction Fuzzy Hash: 0041F5B46087418FD740DF29D48055FBBE0FF88350F05892DE9A98B345EB34E9818F82

Uniqueness

Uniqueness Score: -1.00%

Function 1002E7A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1002E7B8
strcmp.MSVCRT ref: 1002E7D0
strcmp.MSVCRT ref: 1002E7E8
strcmp.MSVCRT ref: 1002E800
strcmp.MSVCRT ref: 1002E818
strcmp.MSVCRT ref: 1002E830
strcmp.MSVCRT ref: 1002E848
strcmp.MSVCRT ref: 1002E860
mv_parse_ratio.MAIN(?,?,?,?,?,?,?,?,1002BD7B), ref: 1002E88C

Strings

ntsc, xrefs: 1002E7A5

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_parse_ratio
String ID: ntsc
API String ID: 1661692936-2045543799
Opcode ID: fc802bc66f50ca201fdf2d927c743c47fe42e6573d439dee567ffb06767441b6
Instruction ID: dadf62e05f87e60a70cc0e9807c988b55b66a7878f9bc8684de5bb80b8492f26
Opcode Fuzzy Hash: fc802bc66f50ca201fdf2d927c743c47fe42e6573d439dee567ffb06767441b6
Instruction Fuzzy Hash: 2731E8B89893819AD750EF29A54161EB6E0FF44381F868C2EA9CCC7340DF74DD40AB57

Uniqueness

Uniqueness Score: -1.00%

Function 100099E1 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 59COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009A7B
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009AB9
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009AD5
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009AF1
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009B0D
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009B2C

Strings

&, xrefs: 10009AA7
<, xrefs: 10009ADF
", xrefs: 10009B1A
>, xrefs: 10009AC3
', xrefs: 10009AFB

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: &$'$>$<$"
API String ID: 3083893021-87953025
Opcode ID: a8492cc7d52c020423f32362092ccefd240c7d2216d999baf81aeaf4ef70062f
Instruction ID: 14f95469a8fd426adbc8d3b99f13887d58f0213caa7dd6ac72794508adc3bfbb
Opcode Fuzzy Hash: a8492cc7d52c020423f32362092ccefd240c7d2216d999baf81aeaf4ef70062f
Instruction Fuzzy Hash: BF110D70A08B55DEE710EF69808065EBBD1FB81680F56C81EF5D9CB245E639E9809783

Uniqueness

Uniqueness Score: -1.00%

Function 1004C90C Relevance: 16.7, APIs: 11, Instructions: 244COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004C958
mv_tree_find.MAIN ref: 1004C973
mv_tree_find.MAIN ref: 1004CA6F
mv_tree_find.MAIN ref: 1004CA8E
mv_tree_find.MAIN ref: 1004CAF8
mv_tree_find.MAIN ref: 1004CB13

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: a695cc76ce69234c581bf4b4b735b6e1a38d1706809023f07848c68a58c7e2d7
Instruction ID: d5bf940e379ca4a6bd7046eb797087e303209b84da27322be6da1c3234df6ef9
Opcode Fuzzy Hash: a695cc76ce69234c581bf4b4b735b6e1a38d1706809023f07848c68a58c7e2d7
Instruction Fuzzy Hash: D3A1C3B490974A9FC340DF6AC18081AFBE5FFC8654F61892EE898D7311E774E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1000A720 Relevance: 16.7, APIs: 11, Instructions: 173COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1000A72E
mv_mallocz.MAIN ref: 1000A7D5
ReleaseSRWLockExclusive.KERNEL32 ref: 1000A808
mv_mallocz.MAIN ref: 1000A890
ReleaseSRWLockExclusive.KERNEL32 ref: 1000A8C4

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$Releasemv_mallocz$Acquire
String ID:
API String ID: 2881747546-0
Opcode ID: 0d1f996a099190dbcac24ef498fb0996fadf9c399d392a80c4173242cb49765f
Instruction ID: e8e0c9d1389fe9fc4d2fa8f13575414dd6078b243068f84da3cacd96059e79d8
Opcode Fuzzy Hash: 0d1f996a099190dbcac24ef498fb0996fadf9c399d392a80c4173242cb49765f
Instruction Fuzzy Hash: B36138B49087018FE714DF25C48170BBBE1EF85380F12866DE8998B35ADB74E981CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001D990 Relevance: 16.6, APIs: 11, Instructions: 119COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 1001D9B0
mv_mallocz.MAIN ref: 1001D9CA
mv_buffer_ref.MAIN ref: 1001D9F6

Part of subcall function 10009FC0: mv_mallocz.MAIN ref: 10009FD2

mv_buffer_create.MAIN ref: 1001DA2F

Part of subcall function 10009E60: mv_mallocz.MAIN ref: 10009E86
Part of subcall function 10009E60: mv_mallocz.MAIN ref: 10009EBF

mv_mallocz.MAIN ref: 1001DA73
mv_buffer_unref.MAIN ref: 1001DA99
mv_freep.MAIN ref: 1001DAAF
mv_freep.MAIN ref: 1001DABE
mv_freep.MAIN ref: 1001DACD
mv_freep.MAIN ref: 1001DAD9
mv_mallocz.MAIN ref: 1001DAF7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_freep$mv_buffer_createmv_buffer_refmv_buffer_unref
String ID:
API String ID: 2772056172-0
Opcode ID: f78fb1774a9b6c4d14d1ed364c0b54d703b3fc5897b42f1e152435b2e8f7f7ef
Instruction ID: 961086c667dc9f8e49421d039f7100c0425955bc0778363e0507aedae6c66dfa
Opcode Fuzzy Hash: f78fb1774a9b6c4d14d1ed364c0b54d703b3fc5897b42f1e152435b2e8f7f7ef
Instruction Fuzzy Hash: 1741E9B46087419FD740EF29D48061AFBE4FF88294F85896EF8998B355E735E881CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1008F920 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 209COMMON

Download Yara Rule

APIs

isspace.MSVCRT ref: 1008F95B
isupper.MSVCRT ref: 1008F9AA
islower.MSVCRT ref: 1008F9BA
isupper.MSVCRT ref: 1008FA89
_errno.MSVCRT ref: 1008FAD0

Strings

$, xrefs: 1008F944

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: isupper$_errnoislowerisspace
String ID: $
API String ID: 4095548146-3993045852
Opcode ID: 026cf13eb89308e961753ce655e2892c44d5266a6a8bc87b24ee3076e9ab9950
Instruction ID: 66d36e278e9387c17c28d7139ad898e7a92bf48a2b7880ad50bacd675aa30ae7
Opcode Fuzzy Hash: 026cf13eb89308e961753ce655e2892c44d5266a6a8bc87b24ee3076e9ab9950
Instruction Fuzzy Hash: C3718D70A083468BC704DF68C48062FBBE2FF893A4F25892FE9D997391D774D8458B42

Uniqueness

Uniqueness Score: -1.00%

Function 10023649 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178stringCOMMON

Download Yara Rule

APIs

mv_vbprintf.MAIN ref: 1002328D
strcmp.MSVCRT ref: 10023340
strcpy.MSVCRT ref: 10023399
mv_bprint_finalize.MAIN ref: 100234C8
ReleaseSRWLockExclusive.KERNEL32 ref: 100234D4
mv_bprintf.MAIN ref: 10023681

Strings

[%s] , xrefs: 10023675
%s%s%s%s, xrefs: 100232E8
Last message repeated %d times, xrefs: 10023377

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLockReleasemv_bprint_finalizemv_bprintfmv_vbprintfstrcmpstrcpy
String ID: Last message repeated %d times$%s%s%s%s$[%s]
API String ID: 4275616186-1378087399
Opcode ID: d0df824065387cbc24c48f67f203688572bdbcaedd198ee8c4ff34e36a2db307
Instruction ID: 3a5394bdbcfdd3d39a4a44ba34fc3df736875c3267acf4b9896f0e29f48a5ef2
Opcode Fuzzy Hash: d0df824065387cbc24c48f67f203688572bdbcaedd198ee8c4ff34e36a2db307
Instruction Fuzzy Hash: B161BE749087959FD720DF24D4803AABBE2FF85384F95884EE8C957342C736E985CB42

Uniqueness

Uniqueness Score: -1.00%

Function 10019970 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 100199A3
mv_malloc.MAIN ref: 100199AE
mv_log.MAIN ref: 10019A78

Part of subcall function 1008F820: strlen.MSVCRT ref: 1008F832
Part of subcall function 1008F820: _errno.MSVCRT ref: 1008F850

_errno.MSVCRT ref: 10019A21
mv_log.MAIN ref: 10019A4E
mv_freep.MAIN ref: 10019A56

Strings

/tmp/%sXXXXXX, xrefs: 100199C1
./%sXXXXXX, xrefs: 100199FC
ff_tempfile: Cannot open temporary file %s, xrefs: 10019A45

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _errnomv_logstrlen$mv_freepmv_malloc
String ID: ./%sXXXXXX$/tmp/%sXXXXXX$ff_tempfile: Cannot open temporary file %s
API String ID: 3823847272-2791948529
Opcode ID: 9fcd766a609fa42d1e131dfce7f93293598c381c48a3ec19530fb229cde90f30
Instruction ID: ca396602fb1ee98faa866fa63a7723223a79ba1d365e5aad02c347e39299c69d
Opcode Fuzzy Hash: 9fcd766a609fa42d1e131dfce7f93293598c381c48a3ec19530fb229cde90f30
Instruction Fuzzy Hash: B73179B89087419FC340EF29C18151AFBE0FF88650F91892EF9C99B311E775E9859F82

Uniqueness

Uniqueness Score: -1.00%

Function 10009130 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 272stringCOMMON

Download Yara Rule

APIs

mv_realloc.MAIN ref: 10009182
strlen.MSVCRT ref: 100091B7
strftime.MSVCRT ref: 1000921E

Strings

!!!!, xrefs: 1000941C
[truncated strftime output], xrefs: 10009311

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_reallocstrftimestrlen
String ID: !!!!$[truncated strftime output]
API String ID: 709960874-1743851734
Opcode ID: f29f42bb8ffea11f48ea5e99c1610936806f5c95083409d1b8b746ef61fd5416
Instruction ID: 5e96dacd8902ef441cde7e6f7e331d45904ef3b1d824b749351cd4a48aad1636
Opcode Fuzzy Hash: f29f42bb8ffea11f48ea5e99c1610936806f5c95083409d1b8b746ef61fd5416
Instruction Fuzzy Hash: FFA1BFB1A042429FE710CF28C98579E77E2EF843D0F268529ED898B399E735DD45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 10090874 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 100908A8
malloc.MSVCRT ref: 100908DA
isspace.MSVCRT ref: 1009094F

Strings

d, xrefs: 100908FD

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: malloc$isspace
String ID: d
API String ID: 177827414-2564639436
Opcode ID: 7a5a73d22a611f51a86e873d8a3b0d49793b2c600cde0416c3143a58db11ab05
Instruction ID: 149852ab0a24966de1e470053d148fe3943fffd9ea7aad0997647bcbaf56fcf5
Opcode Fuzzy Hash: 7a5a73d22a611f51a86e873d8a3b0d49793b2c600cde0416c3143a58db11ab05
Instruction Fuzzy Hash: B55121756087018FD320EF29C18065AB7E4EFC9754F118A2EF99897361EB70ED05AB82

Uniqueness

Uniqueness Score: -1.00%

Function 1000C2D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

mv_bprint_init_for_buffer.MAIN ref: 1000C308
mv_bprintf.MAIN ref: 1000C330

Strings

AMBI%d, xrefs: 1000C394
NONE, xrefs: 1000C327
USR%d, xrefs: 1000C37C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_init_for_buffermv_bprintf
String ID: AMBI%d$NONE$USR%d
API String ID: 2490314137-3656852315
Opcode ID: 18c3f00c932525b9a03c6c26bd996f108cdefc78bc7c7bb15c7cae72aa0d9e7e
Instruction ID: 1ef98ca077266c32d1aee9727dfec110bedddac347624ae906d8e5fb6b24c5a3
Opcode Fuzzy Hash: 18c3f00c932525b9a03c6c26bd996f108cdefc78bc7c7bb15c7cae72aa0d9e7e
Instruction Fuzzy Hash: 20114FB4918B55CBE714EF28C480A5EB7E0FF88780F51C92EF68897254D334AE419B97

Uniqueness

Uniqueness Score: -1.00%

Function 1000C470 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

mv_bprint_init_for_buffer.MAIN ref: 1000C4A8
mv_bprintf.MAIN ref: 1000C4D0

Strings

ambisonic ACN %d, xrefs: 1000C534
user %d, xrefs: 1000C51C
none, xrefs: 1000C4C7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_init_for_buffermv_bprintf
String ID: ambisonic ACN %d$none$user %d
API String ID: 2490314137-4180635230
Opcode ID: 6d247fa50da3d5541497e9d82b9e4f8f3eef7e7a432eeee65763f77ec15faa69
Instruction ID: c94b059796d13185444bee4ca381abcd6d61be9244a4282c7920a982e5d4d1e4
Opcode Fuzzy Hash: 6d247fa50da3d5541497e9d82b9e4f8f3eef7e7a432eeee65763f77ec15faa69
Instruction Fuzzy Hash: 51112EB4908B55CBE320DF24D480A6EB7E0FF847C4F51882EF59887289D734A941DB97

Uniqueness

Uniqueness Score: -1.00%

Function 1001B8D0 Relevance: 13.8, APIs: 9, Instructions: 250COMMON

Download Yara Rule

APIs

mv_channel_layout_check.MAIN ref: 1001B920
mv_sample_fmt_is_planar.MAIN ref: 1001B942
mv_channel_layout_check.MAIN ref: 1001B9B7
mv_hwframe_transfer_data.MAIN ref: 1001BAE3

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_layout_check$mv_hwframe_transfer_datamv_sample_fmt_is_planar
String ID:
API String ID: 1553998843-0
Opcode ID: 6cac879977a8b13244bde48582e16f82ac97cff3938bce88e986ecd715483f6d
Instruction ID: 72df875d59b9fd1ba8d0ac85d53e609cc354b7ecb43e3e539226396dea563104
Opcode Fuzzy Hash: 6cac879977a8b13244bde48582e16f82ac97cff3938bce88e986ecd715483f6d
Instruction Fuzzy Hash: 72A11E74604B458BD758DF26C0C162BBBE2FFC4694F158A2DD9998F719E730E882CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1004CA17 Relevance: 13.7, APIs: 9, Instructions: 185COMMON

Download Yara Rule

APIs

mv_tree_find.MAIN ref: 1004CA6F
mv_tree_find.MAIN ref: 1004CA8E
mv_tree_find.MAIN ref: 1004CAF8
mv_tree_find.MAIN ref: 1004CB13
mv_tree_find.MAIN ref: 1004CBB8
mv_tree_find.MAIN ref: 1004CBD3
mv_tree_find.MAIN ref: 1004CC31

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find
String ID:
API String ID: 59044961-0
Opcode ID: c36327b2d25d5fe4884ec1989afda76d5058c06c978ad9fa8712f8f68075efe0
Instruction ID: 53801cd7259bdacf3f476d6e8c3942157b86ee63cd70a90bc861ee9562dfc515
Opcode Fuzzy Hash: c36327b2d25d5fe4884ec1989afda76d5058c06c978ad9fa8712f8f68075efe0
Instruction Fuzzy Hash: EB81DFB490974A9FC340DF6AC18091AFBE5FF88654F61892EE898D7311E734E941CF86

Uniqueness

Uniqueness Score: -1.00%

Function 10023249 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

mv_vbprintf.MAIN ref: 1002328D
strcmp.MSVCRT ref: 10023340
strcpy.MSVCRT ref: 10023399
mv_bprint_finalize.MAIN ref: 100234C8
ReleaseSRWLockExclusive.KERNEL32 ref: 100234D4
mv_bprintf.MAIN ref: 10023681

Strings

%s%s%s%s, xrefs: 100232E8
Last message repeated %d times, xrefs: 10023377

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLockReleasemv_bprint_finalizemv_bprintfmv_vbprintfstrcmpstrcpy
String ID: Last message repeated %d times$%s%s%s%s
API String ID: 4275616186-2673086376
Opcode ID: 42d1c28a59b315c23aa48637e9ae167f894d38651270de1a8a98ee9fcc4ad737
Instruction ID: b81f238ef4300ec1d8f16b3a8da4b914aea516d51c501e69078f494d4313df77
Opcode Fuzzy Hash: 42d1c28a59b315c23aa48637e9ae167f894d38651270de1a8a98ee9fcc4ad737
Instruction Fuzzy Hash: E561E4709087958FD720DF24D4803AABBE2FF85384F95885EE8C957342C776E985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1002C736 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 128stringCOMMON

Download Yara Rule

APIs

mv_expr_parse_and_eval.MAIN ref: 1002C5F5
strcmp.MSVCRT ref: 1002C6CE
mv_log.MAIN ref: 1002C99D

Strings

all, xrefs: 1002C56F
max, xrefs: 1002C505
min, xrefs: 1002C51F
default, xrefs: 1002C4D2
none, xrefs: 1002C54A

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_expr_parse_and_evalmv_logstrcmp
String ID: all$default$max$min$none
API String ID: 638344568-3292705889
Opcode ID: a45776dcf589f155364fd2da9f593db2c86a165bccd51a658e422361a96ac0f8
Instruction ID: 411126b03e5c4c9fee0fee3cc8844fcbddd9a5d1040519b46a4fb5c1d41167ed
Opcode Fuzzy Hash: a45776dcf589f155364fd2da9f593db2c86a165bccd51a658e422361a96ac0f8
Instruction Fuzzy Hash: EC514A7590974A8BC351EF68E04469BF7E5FF89344F518A2EE9C9D7200EB70E9048B82

Uniqueness

Uniqueness Score: -1.00%

Function 10028070 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 10028099
strtol.MSVCRT ref: 10028143
mv_log.MAIN ref: 1002817E

Strings

Unable to parse option value "%s" as %s, xrefs: 10028165
Value %d for parameter '%s' out of %s format range [%d - %d], xrefs: 100281B3
none, xrefs: 1002808E

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_logstrcmpstrtol
String ID: Unable to parse option value "%s" as %s$Value %d for parameter '%s' out of %s format range [%d - %d]$none
API String ID: 3237617949-2908652078
Opcode ID: 691e268f59eefe45aab27bd49c65c0bfe69c5a44b4361b2dd8b56a23eaf8e8d9
Instruction ID: 4bc733314f34f2699ba82556ed72ea64bb9030a0ec2445b5dd4e85adb85467a1
Opcode Fuzzy Hash: 691e268f59eefe45aab27bd49c65c0bfe69c5a44b4361b2dd8b56a23eaf8e8d9
Instruction Fuzzy Hash: AB3137B4A097458FC344DF78948010AFBE1EFC9390F908A2EF9A9D7391E770D9458B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002D660 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

mv_dict_get.MAIN ref: 1002D6AB
mv_opt_set.MAIN ref: 1002D6CF
mv_log.MAIN ref: 1002D70E
mv_dict_free.MAIN ref: 1002D71A
mv_dict_set.MAIN ref: 1002D74F
mv_dict_free.MAIN ref: 1002D763

Strings

Error setting option %s to value %s., xrefs: 1002D6F7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_dict_free$mv_dict_getmv_dict_setmv_logmv_opt_set
String ID: Error setting option %s to value %s.
API String ID: 3258142065-3279051434
Opcode ID: ef5084decda187cd213080217201cfa49cd5edc4dfbb471ff57d75f3a90a4203
Instruction ID: 35dba755cf83891b6b787024823c04eb56a84bd00f467e741874e99c9612048c
Opcode Fuzzy Hash: ef5084decda187cd213080217201cfa49cd5edc4dfbb471ff57d75f3a90a4203
Instruction Fuzzy Hash: F731A3B9A087449FC740DF69D58065ABBE4FF88294F51882EF99CC7310E674E940DF82

Uniqueness

Uniqueness Score: -1.00%

Function 1004A030 Relevance: 12.1, APIs: 8, Instructions: 140COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004A08E
SleepConditionVariableSRW.KERNEL32 ref: 1004A0C6
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A0DC
AcquireSRWLockExclusive.KERNEL32 ref: 1004A123
WakeConditionVariable.KERNEL32 ref: 1004A135
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A141
mv_log.MAIN ref: 1004A1E7
abort.MSVCRT ref: 1004A1EC

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariable$SleepWakeabortmv_log
String ID:
API String ID: 347658250-0
Opcode ID: 5ec2205790857898139d0150919feb44815b91eac6bd09cfc369016d3f6426bb
Instruction ID: 105667d8cc5a2ab336bf2b63828960297e3ed020638f170ef27288a45aaf5278
Opcode Fuzzy Hash: 5ec2205790857898139d0150919feb44815b91eac6bd09cfc369016d3f6426bb
Instruction Fuzzy Hash: 305136B56047058FD710EF29C58060BFBE1FF89354F118A2DE99A97610E774F949CB82

Uniqueness

Uniqueness Score: -1.00%

Function 100907E3 Relevance: 12.1, APIs: 8, Instructions: 119COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 1009039A
free.MSVCRT ref: 100903AF
free.MSVCRT ref: 100906E0
ungetc.MSVCRT ref: 10092261

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: free$ungetc
String ID:
API String ID: 2663370934-0
Opcode ID: 7e5d2668a86438e7c09c7f4b4d73e0480b01a75a41e977086b1adbd88c9befee
Instruction ID: d692218a8b19da4155b2aff489b2430a951df32eb5285c2326706aa3e10a62d2
Opcode Fuzzy Hash: 7e5d2668a86438e7c09c7f4b4d73e0480b01a75a41e977086b1adbd88c9befee
Instruction Fuzzy Hash: 01419D74A087818FE710DF24C08039AB7E5EF85344F51496EF9E9572A2C775ED88EB82

Uniqueness

Uniqueness Score: -1.00%

Function 10002670 Relevance: 12.1, APIs: 8, Instructions: 99COMMON

Download Yara Rule

APIs

mv_samples_get_buffer_size.MAIN ref: 1000269F
mv_mallocz.MAIN ref: 100026B3
mv_sample_fmt_is_planar.MAIN(?), ref: 100026DC
mv_calloc.MAIN(?), ref: 100026F5
mv_fifo_alloc2.MAIN(?), ref: 10002736
mv_fifo_freep2.MAIN(?), ref: 10002761
mv_freep.MAIN(?), ref: 1000276E

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_callocmv_fifo_alloc2mv_fifo_freep2mv_freepmv_malloczmv_sample_fmt_is_planarmv_samples_get_buffer_size
String ID:
API String ID: 3721653357-0
Opcode ID: 42dff5a3eb04adc49f19050df871efb01a7c87c8a448b2921b037ed844c736a9
Instruction ID: bb9eb3e5d0204011adfe0aa4748bc2d8f300a22c96b3cf74cba0d42d24462043
Opcode Fuzzy Hash: 42dff5a3eb04adc49f19050df871efb01a7c87c8a448b2921b037ed844c736a9
Instruction Fuzzy Hash: 273148B8A087068FD700DF69C58061AFBE4FF88384F11892EE99CC7315E774E8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 1001D220 Relevance: 12.1, APIs: 8, Instructions: 71COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 1001D230
mv_sha512_alloc.MAIN ref: 1001D273
mv_sha512_alloc.MAIN ref: 1001D2BB
mv_md5_alloc.MAIN ref: 1001D2EB
mv_sha_alloc.MAIN ref: 1001D31B
mv_sha_alloc.MAIN ref: 1001D34B
mv_sha_alloc.MAIN ref: 1001D37B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_sha_alloc$mv_sha512_alloc$mv_malloczmv_md5_alloc
String ID:
API String ID: 1780169607-0
Opcode ID: 89fe73e6439e83052310f9247eaea9b5c1dd9965fdfc5345831e5e410a5014f8
Instruction ID: 308d306f19edf6ed78ffa685c28ceabba911b28968eaf46d4c5fb4499698521b
Opcode Fuzzy Hash: 89fe73e6439e83052310f9247eaea9b5c1dd9965fdfc5345831e5e410a5014f8
Instruction Fuzzy Hash: 543102B0016390CFD740EF50E549B06BBA0FB00315FA6C9A9C50A1F262D7BED944CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 1001FAF0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN ref: 1001FB71
mv_image_get_linesize.MAIN ref: 1001FD0F
mv_log.MAIN ref: 1001FFA0
abort.MSVCRT ref: 1001FFA5

Strings

Assertion %s failed at %s:%d, xrefs: 1001FF91
av_image_get_linesize failed, xrefs: 1001FEF6

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_image_get_linesizemv_logmv_pix_fmt_desc_get
String ID: Assertion %s failed at %s:%d$av_image_get_linesize failed
API String ID: 1423692287-2525362290
Opcode ID: 19a34fa3045bd52ddc904fabf5880a30275453ed701ec10dc373799bbca6dd21
Instruction ID: eedc48b82a1fb41b1fbcfd9c24b211374ee1d321ec6a1758f6a6c150146530bc
Opcode Fuzzy Hash: 19a34fa3045bd52ddc904fabf5880a30275453ed701ec10dc373799bbca6dd21
Instruction Fuzzy Hash: CDD17C75A08351CFC350CF28C18062AFBE1FF99344F55896DE9898B362D775E982DB82

Uniqueness

Uniqueness Score: -1.00%

Function 10097460 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

0, xrefs: 100977C6
@, xrefs: 1009772A

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: 0$@
API String ID: 0-1545510068
Opcode ID: 13a05ddf3fa1ef3e6f83545d4c8c7334279129876b143e9975e0b6c0a575227c
Instruction ID: 042a0d87ccfab50b6cd798803ce937aa9cfec6d564815ef75f931cd5060123e9
Opcode Fuzzy Hash: 13a05ddf3fa1ef3e6f83545d4c8c7334279129876b143e9975e0b6c0a575227c
Instruction Fuzzy Hash: 14C12772E046168BDB05CF68C88478DBBF2FF88354F258269E85CAB395D374E841DB90

Uniqueness

Uniqueness Score: -1.00%

Function 1004E8A7 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

mv_gcd.MAIN ref: 1004E8FC
mv_malloc.MAIN(?), ref: 1004E9C1
mv_log.MAIN ref: 1004EC52
abort.MSVCRT ref: 1004EC57

Strings

libavutil/tx.c, xrefs: 1004EC33
Assertion %s failed at %s:%d, xrefs: 1004EC45

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_gcdmv_logmv_malloc
String ID: Assertion %s failed at %s:%d$libavutil/tx.c
API String ID: 4069727316-3214517670
Opcode ID: 3a86cab36d8e530dac25bcc30bd8bbdd95ef25ef144ed0f4418dff830d47f98c
Instruction ID: 97686d52ff029028b5cb48a31492680369d7a5b0c0d5c016aae493d3c13362a3
Opcode Fuzzy Hash: 3a86cab36d8e530dac25bcc30bd8bbdd95ef25ef144ed0f4418dff830d47f98c
Instruction Fuzzy Hash: E8B1E375A083818FC764CF29C58065AFBE2FF88314F158A2EE999D7311E730AD45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 100909DB Relevance: 10.7, APIs: 7, Instructions: 223COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 10090A20
malloc.MSVCRT ref: 10090A52
realloc.MSVCRT ref: 10090B19

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: malloc$realloc
String ID:
API String ID: 4146991691-0
Opcode ID: a4f104c4048a5f8dccd610beb3d4c19a87cfe24ad6d50ab1b5bfdd7435f784a0
Instruction ID: f586937920a4f822164f33dd0f291a3d66e9c0cb58edef8f4ec06fb8e085db03
Opcode Fuzzy Hash: a4f104c4048a5f8dccd610beb3d4c19a87cfe24ad6d50ab1b5bfdd7435f784a0
Instruction Fuzzy Hash: 25A1FD746083018FC720CF29C580A5AB7E1EFC9754F118A2EF9999B361E771ED05EB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001CA10 Relevance: 10.7, APIs: 7, Instructions: 222COMMON

Download Yara Rule

APIs

mv_adler32_update.MAIN ref: 1001CA46
mv_crc.MAIN ref: 1001CAD5
mv_sha512_final.MAIN ref: 1001CC05
mv_ripemd_final.MAIN ref: 1001CC4D
mv_sha_final.MAIN ref: 1001CCAD
mv_md5_final.MAIN ref: 1001CCFD
mv_murmur3_final.MAIN ref: 1001CD1D

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_adler32_updatemv_crcmv_md5_finalmv_murmur3_finalmv_ripemd_finalmv_sha512_finalmv_sha_final
String ID:
API String ID: 1982440126-0
Opcode ID: df96e90217d37244b0dca780f4c69ede17494fb52ea6fc2b56b595ac0794c65b
Instruction ID: 046ab84a8c44898d371c363dc14f1fdf4a4b70b6c38c2771c8d012733aa29193
Opcode Fuzzy Hash: df96e90217d37244b0dca780f4c69ede17494fb52ea6fc2b56b595ac0794c65b
Instruction Fuzzy Hash: E29108B5909746CFC710CF28D18060ABBE0FF89350F65896EE98D9B321D334E985DB96

Uniqueness

Uniqueness Score: -1.00%

Function 1002D910 Relevance: 10.7, APIs: 7, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22194f63cd8b3d32d12af993c9b419f9564881632f182a2152fe54f23c7911b
Instruction ID: 16f5bf25af95bab1faddb375712d4b7f53b5ab5cb691f7174e3ff760a2b83ddc
Opcode Fuzzy Hash: e22194f63cd8b3d32d12af993c9b419f9564881632f182a2152fe54f23c7911b
Instruction Fuzzy Hash: 9B717E75608342CBC755EF28E490A1AB7E1EF94780FA1892EE8D98B355D731DC85CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1002C140 Relevance: 10.7, APIs: 7, Instructions: 171stringCOMMON

Download Yara Rule

APIs

mv_opt_find2.MAIN ref: 1002C1BA
strcmp.MSVCRT ref: 1002C201
strcmp.MSVCRT ref: 1002C21F
strcmp.MSVCRT ref: 1002C249
strcmp.MSVCRT ref: 1002C299
strcmp.MSVCRT ref: 1002C2C1
mv_opt_find2.MAIN ref: 1002C323

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_opt_find2
String ID:
API String ID: 3181049271-0
Opcode ID: dd01def158e708a67ffa8e9ac78e78581eb1c099993243723df33eb0ce15e060
Instruction ID: e6022f51a5e1b9dd3d0d9e8f4efd117a22464f7803f398aa773214262c2afff6
Opcode Fuzzy Hash: dd01def158e708a67ffa8e9ac78e78581eb1c099993243723df33eb0ce15e060
Instruction Fuzzy Hash: D651E87460834ACBCB40DFE5E580A1BB7E4EF85784F85882DEC98C7210EB74D948DB82

Uniqueness

Uniqueness Score: -1.00%

Function 1004CAA8 Relevance: 10.7, APIs: 7, Instructions: 151COMMON

Download Yara Rule

APIs

mv_tree_insert.MAIN ref: 1004C57E
mv_tree_find.MAIN ref: 1004CAF8
mv_tree_find.MAIN ref: 1004CB13
mv_tree_find.MAIN ref: 1004CBB8
mv_tree_find.MAIN ref: 1004CBD3
mv_tree_find.MAIN ref: 1004CC31
mv_tree_find.MAIN ref: 1004CC48

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_tree_find$mv_tree_insert
String ID:
API String ID: 3047205218-0
Opcode ID: 748b1c967ae3881e327b4b3e75e89f36747101333f41ba75464ed4008a113ba7
Instruction ID: 11e2b96d07c673488f848e46a8f9316f5266a218077dcf01b0671550c3d31cb7
Opcode Fuzzy Hash: 748b1c967ae3881e327b4b3e75e89f36747101333f41ba75464ed4008a113ba7
Instruction Fuzzy Hash: 5A51DFB590974A9FC340DF6AC18091AFBE1FF88650F61892EE898C7301E734E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 10020660 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN ref: 1002067F
mv_image_get_linesize.MAIN ref: 100206B4

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

mv_image_fill_linesizes.MAIN(?), ref: 10020748
mv_image_fill_plane_sizes.MAIN(?), ref: 100207AB

Strings

Picture size %ux%u is invalid, xrefs: 100207FF

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_pix_fmt_desc_get$mv_image_fill_linesizesmv_image_fill_plane_sizesmv_image_get_linesize
String ID: Picture size %ux%u is invalid
API String ID: 3680373976-1963597007
Opcode ID: 363d7f5b0f2576a8b82a55742b866563a56274ce2c15312feba007e7f86faec8
Instruction ID: 2314817fb5d2ccefc3c8ff58fcc714fc26626ca1613a84a068ef5f43893ec408
Opcode Fuzzy Hash: 363d7f5b0f2576a8b82a55742b866563a56274ce2c15312feba007e7f86faec8
Instruction Fuzzy Hash: C4512576A083418FC354CF69D88564FBBE6EFC8350F558A2EF598C7351EA74E8448B42

Uniqueness

Uniqueness Score: -1.00%

Function 100121A0 Relevance: 10.6, APIs: 7, Instructions: 119COMMON

Download Yara Rule

APIs

mv_strdup.MAIN ref: 1001221F
mv_bprint_init.MAIN ref: 1001225D
mv_bprint_escape.MAIN ref: 100122B3
mv_bprint_append_data.MAIN ref: 100122CC
mv_bprint_escape.MAIN ref: 100122EE
mv_bprint_finalize.MAIN ref: 1001231B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_escape$mv_bprint_append_datamv_bprint_finalizemv_bprint_initmv_strdup
String ID:
API String ID: 806756221-0
Opcode ID: bd899ef9b0dbaba746c8b6d0da506afdd114f8397f9f9c4fb8b0c4949863bb04
Instruction ID: 7187b0243939ecc75a9d4dff51427cd59bf1c299843c139242dac8f39c04a417
Opcode Fuzzy Hash: bd899ef9b0dbaba746c8b6d0da506afdd114f8397f9f9c4fb8b0c4949863bb04
Instruction Fuzzy Hash: 134114B55093449FC360CF28C08029BFBE5FF86354F55892EE9988B341E736EA95CB46

Uniqueness

Uniqueness Score: -1.00%

Function 1000E950 Relevance: 10.6, APIs: 7, Instructions: 113stringCOMMON

Download Yara Rule

APIs

mv_channel_from_string.MAIN ref: 1000E993
strchr.MSVCRT ref: 1000E9C4
mv_strlcpy.MAIN ref: 1000E9EF
mv_channel_from_string.MAIN ref: 1000EA01
strcmp.MSVCRT ref: 1000EA3D

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_from_string$mv_strlcpystrchrstrcmp
String ID:
API String ID: 1821482347-0
Opcode ID: da3edf490d4416a14b75eaa0f87995938fed091b4a310eb1baaf614b82469ff7
Instruction ID: b36a671443ebfd3664ebfe81d2672e3825410638c3dff80f38bd050e3f4a86e6
Opcode Fuzzy Hash: da3edf490d4416a14b75eaa0f87995938fed091b4a310eb1baaf614b82469ff7
Instruction Fuzzy Hash: DF418075A087868BEB10DF28C48054EBBE4FF88794F114D2DE8D8A7255D370ED45CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001A8BC Relevance: 10.6, APIs: 7, Instructions: 112COMMON

Download Yara Rule

APIs

mv_buffer_alloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A8CA

Part of subcall function 10009DC0: mv_malloc.MAIN ref: 10009DDC
Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009DF2
Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009E25

mv_realloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A902

Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB

mv_mallocz.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001A91C
mv_dict_copy.MAIN ref: 1001A996
mv_buffer_ref.MAIN ref: 1001A9EC
mv_realloc.MAIN ref: 1001AA26
mv_mallocz.MAIN ref: 1001AA40
mv_buffer_unref.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AA87
mv_buffer_unref.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AAAD
mv_dict_free.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AAB5
mv_freep.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AABD
mv_freep.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1001AADB

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_buffer_unrefmv_freepmv_realloc$_aligned_reallocmv_buffer_allocmv_buffer_refmv_dict_copymv_dict_freemv_malloc
String ID:
API String ID: 3654835198-0
Opcode ID: 70dec7b0525f92eea09a52100746da8d68807f2b7a8b1601fe4d47d21b59e6f4
Instruction ID: 2b85b05f5678c247458617f8db437906648f713ae92fec64b70ab4220dcfa18e
Opcode Fuzzy Hash: 70dec7b0525f92eea09a52100746da8d68807f2b7a8b1601fe4d47d21b59e6f4
Instruction Fuzzy Hash: 8F51E674904381CFCB14CF19C58069ABBE1FF89390F46896EE98A9B351E770E981CF91

Uniqueness

Uniqueness Score: -1.00%

Function 10006940 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10006950
mv_malloc.MAIN ref: 10006959
strspn.MSVCRT ref: 10006980
strspn.MSVCRT ref: 100069C1

Strings

, xrefs: 10006973, 10006A73

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strspn$mv_mallocstrlen
String ID:
API String ID: 1916163187-596783616
Opcode ID: c1cd0ea710ee61caf6f581c2a68d6a1753dc280333e09f0715da0c84ddb40841
Instruction ID: 4177569fa848450c707169e52794d897aa5a5a3714551b1bd9b9763f873ecb90
Opcode Fuzzy Hash: c1cd0ea710ee61caf6f581c2a68d6a1753dc280333e09f0715da0c84ddb40841
Instruction Fuzzy Hash: E341847460C3958FDB11DF25888025ABBE7EF8B6C0F55885DE8C56B306C235EA48CB93

Uniqueness

Uniqueness Score: -1.00%

Function 1002C706 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 100COMMON

Download Yara Rule

APIs

mv_expr_parse_and_eval.MAIN ref: 1002C5F5

Strings

all, xrefs: 1002C56F
max, xrefs: 1002C505
min, xrefs: 1002C51F
default, xrefs: 1002C4D2
none, xrefs: 1002C54A

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_expr_parse_and_eval
String ID: all$default$max$min$none
API String ID: 2217327432-3292705889
Opcode ID: 322fc08208eac5c62e149815230ed5bfbdbf25e373bcd5dd5b57cac02c8132ab
Instruction ID: 83d07ffb6d8c6cfe48df1192a88470446e278d9b2bcb376e76410f15be41486f
Opcode Fuzzy Hash: 322fc08208eac5c62e149815230ed5bfbdbf25e373bcd5dd5b57cac02c8132ab
Instruction Fuzzy Hash: A6410475A097458BC395EF28E04038BBBE5FFC9314F618A2EE9C9D7200EB71D9448B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002931B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 100292C3
mv_log.MAIN ref: 100292ED
mv_log.MAIN ref: 10029355
mv_log.MAIN ref: 10029373
mv_log.MAIN ref: 10029391

Strings

%-15s , xrefs: 100292D4

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$strcmp
String ID: %-15s
API String ID: 1163046698-755444208
Opcode ID: fe091ff9f6901946a166bc3df3bd508716d3bd7d362f07d782aa9c38da8257b7
Instruction ID: c2e3231857e14b6d66286021a66802d314ea6e9fac30e20b35dba61e0b599c78
Opcode Fuzzy Hash: fe091ff9f6901946a166bc3df3bd508716d3bd7d362f07d782aa9c38da8257b7
Instruction Fuzzy Hash: 39319E78A093459FC750DF28E19065EBBE1EF88B80F91C82EF89987351E774E9409B42

Uniqueness

Uniqueness Score: -1.00%

Function 1008F820 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 1008F832
_errno.MSVCRT ref: 1008F850
rand.MSVCRT ref: 1008F8B0
_sopen.MSVCRT ref: 1008F8F6
_errno.MSVCRT ref: 1008F904

Strings

XXXX, xrefs: 1008F848

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _errno$_sopenrandstrlen
String ID: XXXX
API String ID: 1081397658-1518373315
Opcode ID: 41818ad3e72adebc80571ed86afad46c9302ef0646f7f912c4873975d3c77747
Instruction ID: 44b3c0712c4d6cf3a6541ef21b7e2c07706476ce399c25bdb07493ab5c095def
Opcode Fuzzy Hash: 41818ad3e72adebc80571ed86afad46c9302ef0646f7f912c4873975d3c77747
Instruction Fuzzy Hash: CA21F571D0834ACFC318EF35889416A7BE0FF8A354F12892FE6548B291DF319949CB81

Uniqueness

Uniqueness Score: -1.00%

Function 1000F8F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 1000F8F7
GetProcessAffinityMask.KERNEL32 ref: 1000F910
mv_log.MAIN ref: 1000F99A

Strings

overriding to %d logical cores, xrefs: 1000F981
detected %d logical cores, xrefs: 1000F9B4

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Process$AffinityCurrentMaskmv_log
String ID: detected %d logical cores$overriding to %d logical cores
API String ID: 4261380130-3421371979
Opcode ID: c659c9415a9862b172ccff880677a34c8f56de918c1cf1742d91ff05b19fa797
Instruction ID: 58e6b2fe0b08649328af5215a9cec38f6754a0f8dc443d6bf54cb1b14bc42e03
Opcode Fuzzy Hash: c659c9415a9862b172ccff880677a34c8f56de918c1cf1742d91ff05b19fa797
Instruction Fuzzy Hash: E82130B5A197019BD304DF29C48131ABBE2EBC8350F48C93DF989C7759E638D9458B43

Uniqueness

Uniqueness Score: -1.00%

Function 1001D7A0 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

mv_buffer_pool_uninit.MAIN ref: 1001D7BB

Part of subcall function 1000A650: AcquireSRWLockExclusive.KERNEL32 ref: 1000A66C
Part of subcall function 1000A650: mv_freep.MAIN ref: 1000A69C
Part of subcall function 1000A650: ReleaseSRWLockExclusive.KERNEL32 ref: 1000A6AB

mv_buffer_unref.MAIN ref: 1001D7F2
mv_buffer_unref.MAIN ref: 1001D801
mv_freep.MAIN ref: 1001D810
mv_freep.MAIN ref: 1001D822
mv_freep.MAIN ref: 1001D831
mv_freep.MAIN ref: 1001D83D

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$ExclusiveLockmv_buffer_unref$AcquireReleasemv_buffer_pool_uninit
String ID:
API String ID: 3286761627-0
Opcode ID: c6c09d7d300876a1707853c3afdde09c35c9359a08c94a7bfa9ac57c73ae979d
Instruction ID: d019eb9eba46684987302df58934bd10d6a5c0a39701eb176e19b0f551cd46b2
Opcode Fuzzy Hash: c6c09d7d300876a1707853c3afdde09c35c9359a08c94a7bfa9ac57c73ae979d
Instruction Fuzzy Hash: FE1198B86087018FDB04EF69D485A1EFBE1FF84204F46895DE4948B306E735E889CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1000C220 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000C27B
mv_bprintf.MAIN ref: 1000C298
mv_bprintf.MAIN ref: 1000C2B8

Strings

AMBI%d, xrefs: 1000C2AC
NONE, xrefs: 1000C247
USR%d, xrefs: 1000C28C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: AMBI%d$NONE$USR%d
API String ID: 3083893021-3656852315
Opcode ID: 6cd4f19d3d74ee3d12c501f26348e63cdefaf32e071506f7e6661ce223037e5e
Instruction ID: 7fcf34f7b534e12bd35e409064aa58f3f25e521088902b3bc772a385e2e8df73
Opcode Fuzzy Hash: 6cd4f19d3d74ee3d12c501f26348e63cdefaf32e071506f7e6661ce223037e5e
Instruction Fuzzy Hash: FA0121B4909B85CBD344EF68848052DB6E1FB94384F948A6DE4CC87755E639DE409B83

Uniqueness

Uniqueness Score: -1.00%

Function 1000C3C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000C41B
mv_bprintf.MAIN ref: 1000C438
mv_bprintf.MAIN ref: 1000C458

Strings

ambisonic ACN %d, xrefs: 1000C44C
user %d, xrefs: 1000C42C
none, xrefs: 1000C3E7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: ambisonic ACN %d$none$user %d
API String ID: 3083893021-4180635230
Opcode ID: 223aa0a192477accd332f19378ca7d36c64ee90d24a02cbd76f3be9b95891286
Instruction ID: dcc63c4345791cf420d4df1e5b10cc0e469fa513568dbd2a0042959f5c7c7fdf
Opcode Fuzzy Hash: 223aa0a192477accd332f19378ca7d36c64ee90d24a02cbd76f3be9b95891286
Instruction Fuzzy Hash: D7011EB4908B81CBD314EF28908152DBAE1FBD4284F94896DE4CC87355E639DA408B53

Uniqueness

Uniqueness Score: -1.00%

Function 1001B039 Relevance: 9.2, APIs: 6, Instructions: 164COMMON

Download Yara Rule

APIs

mv_pix_fmt_desc_get.MAIN ref: 1001B043
mv_image_check_size.MAIN ref: 1001B069

Part of subcall function 1001F6A0: mv_image_get_linesize.MAIN ref: 1001F6E3

mv_image_fill_linesizes.MAIN ref: 1001B0C8

Part of subcall function 1001EAB0: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,1001B0CD), ref: 1001EAC6

mv_image_fill_plane_sizes.MAIN ref: 1001B15D
mv_buffer_alloc.MAIN ref: 1001B1CD
mv_image_fill_pointers.MAIN ref: 1001B1FC

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_pix_fmt_desc_get$mv_buffer_allocmv_image_check_sizemv_image_fill_linesizesmv_image_fill_plane_sizesmv_image_fill_pointersmv_image_get_linesize
String ID:
API String ID: 566543421-0
Opcode ID: f91591d019d291e180dcf44e96ce89918f7d927db6cfc3ba89d5ff0d6a58ef0d
Instruction ID: a5d1a7900a1a2f35fa09734171263621add282bd6d5ab2c0dd3880a3946380f0
Opcode Fuzzy Hash: f91591d019d291e180dcf44e96ce89918f7d927db6cfc3ba89d5ff0d6a58ef0d
Instruction Fuzzy Hash: 8A61F7B5A08B018FCB44DF69C59065ABBE1FF88240F16897DE949CB319E735E884CF41

Uniqueness

Uniqueness Score: -1.00%

Function 1003A4F0 Relevance: 9.2, APIs: 6, Instructions: 164COMMON

Download Yara Rule

APIs

mv_calloc.MAIN ref: 1003A52A
mv_samples_get_buffer_size.MAIN ref: 1003A55E
mv_malloc.MAIN ref: 1003A572
mv_samples_fill_arrays.MAIN ref: 1003A5A8

Part of subcall function 1003A1B0: mv_samples_get_buffer_size.MAIN ref: 1003A201

mv_freep.MAIN ref: 1003A697

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_samples_get_buffer_size$mv_callocmv_freepmv_mallocmv_samples_fill_arrays
String ID:
API String ID: 3785048109-0
Opcode ID: 5ae1779f3f7e2cdb2b331e1be93d4aeac89c33ba1fb156b6b974ba19d1fc6e91
Instruction ID: bcd7097c64c988b962d1b439634854989dd960b0eefa7e233943bcd087631235
Opcode Fuzzy Hash: 5ae1779f3f7e2cdb2b331e1be93d4aeac89c33ba1fb156b6b974ba19d1fc6e91
Instruction Fuzzy Hash: E3518E75E087418FC701CF69D4C160AFBE4EF86395F56492EE8848B360E375E985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001C210 Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

mv_buffer_is_writable.MAIN ref: 1001C24C
mv_buffer_is_writable.MAIN ref: 1001C27C
mv_channel_layout_copy.MAIN ref: 1001C30C
mv_hwframe_get_buffer.MAIN ref: 1001C336
mv_frame_copy.MAIN ref: 1001C348

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_is_writable$mv_channel_layout_copymv_frame_copymv_hwframe_get_buffer
String ID:
API String ID: 1431812533-0
Opcode ID: 364bd59554279b40aee4642812e1f726182608b2a75209079b3376af4345f371
Instruction ID: eaf454bc14f92c14001bd62492fec0c564a2a00f258074e35efd3c86292710f4
Opcode Fuzzy Hash: 364bd59554279b40aee4642812e1f726182608b2a75209079b3376af4345f371
Instruction Fuzzy Hash: 46514B75A047168BD354CF79C880B9AF7E4FF88350F018A2AE999CB301E734E8948B91

Uniqueness

Uniqueness Score: -1.00%

Function 1008E250 Relevance: 9.1, APIs: 6, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 1008E27F
vfprintf.MSVCRT ref: 1008E29F
abort.MSVCRT ref: 1008E2A4
VirtualQuery.KERNEL32 ref: 1008E33B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID:
API String ID: 2513968241-0
Opcode ID: 77f9c74a023bead4244158e4538434e8ac340feeaea4348980fb076ccdbc421e
Instruction ID: 54ad2b6e83e5b16b79a45a6593ed35e006b5b48100f64ca54a0057f1c503df76
Opcode Fuzzy Hash: 77f9c74a023bead4244158e4538434e8ac340feeaea4348980fb076ccdbc421e
Instruction Fuzzy Hash: E0514BB59053519FC700EF68C98965AFBE4FF84354F42C92EE8988B226D734E944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10001020 Relevance: 9.1, APIs: 6, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,10001281,?,?,?,?,?,?,100013AE), ref: 10001057
_amsg_exit.MSVCRT ref: 10001086

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: d59ae3628b0237ba56fdd7c9d317007903976593300e79648f20ecf33c672c95
Instruction ID: dd64dd1eda1eb68cef0d792f916db726e673d7e5cc478cdb0012762ac5c84acb
Opcode Fuzzy Hash: d59ae3628b0237ba56fdd7c9d317007903976593300e79648f20ecf33c672c95
Instruction Fuzzy Hash: 1A31A374609651CBE310EF54C9C438A7BE1FB483C0F52482DE9848B76DD7B9D884DB82

Uniqueness

Uniqueness Score: -1.00%

Function 1004A200 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004A262
WakeConditionVariable.KERNEL32 ref: 1004A274
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A280
WaitForSingleObjectEx.KERNEL32 ref: 1004A2C8
CloseHandle.KERNEL32 ref: 1004A2D8
mv_freep.MAIN ref: 1004A2F3

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireCloseConditionHandleObjectReleaseSingleVariableWaitWakemv_freep
String ID:
API String ID: 1841216690-0
Opcode ID: 18bc572b1c8a2e61cb34bfd6f4b1ef9c865d202ec6cb55ee2b061ed66f55e34f
Instruction ID: 3180a2c82765ffdb0d0e9836089f8425691ac15bb4143a1306c626e3471b16ad
Opcode Fuzzy Hash: 18bc572b1c8a2e61cb34bfd6f4b1ef9c865d202ec6cb55ee2b061ed66f55e34f
Instruction Fuzzy Hash: 34317EB26047058FD304EF68D98420BBBE1FF85290F61853DE85987205E331E999CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 1000E173 Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1000DF70
mv_channel_layout_from_mask.MAIN ref: 1000E046
mv_freep.MAIN ref: 1000E17B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_layout_from_maskmv_freepstrcmp
String ID:
API String ID: 3576703362-0
Opcode ID: 2b02768f874b8c8628ca8c24d3a244cf9eff547c0ef362d73473bb9b13f20ec1
Instruction ID: 3232a43fc97f47c23ab915f7ee9f6b07ea90700946469634bd9b1ff3e7b05c00
Opcode Fuzzy Hash: 2b02768f874b8c8628ca8c24d3a244cf9eff547c0ef362d73473bb9b13f20ec1
Instruction Fuzzy Hash: 9C313871A087819FE340DF25D48061EBBE1EF88394F52982EF98997318DB71EC44CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1004A30C Relevance: 9.1, APIs: 6, Instructions: 69COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004A262
WakeConditionVariable.KERNEL32 ref: 1004A274
ReleaseSRWLockExclusive.KERNEL32 ref: 1004A280
WaitForSingleObjectEx.KERNEL32 ref: 1004A2C8
CloseHandle.KERNEL32 ref: 1004A2D8
mv_freep.MAIN ref: 1004A2F3

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireCloseConditionHandleObjectReleaseSingleVariableWaitWakemv_freep
String ID:
API String ID: 1841216690-0
Opcode ID: a14856d7447140d92799d6568a2db05317804891632b94121e1a719d57eb44ae
Instruction ID: bc251ce03876973850fb77e440ae180f66f2e7fe9fc8712012c25621f5453433
Opcode Fuzzy Hash: a14856d7447140d92799d6568a2db05317804891632b94121e1a719d57eb44ae
Instruction Fuzzy Hash: BF214CB15087158FC700EF68D98420EBBE0FF94340F61853DE89997215D331E599CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 1001DA67 Relevance: 9.0, APIs: 6, Instructions: 40COMMON

Download Yara Rule

APIs

mv_buffer_ref.MAIN ref: 1001D9F6
mv_buffer_create.MAIN ref: 1001DA2F
mv_mallocz.MAIN ref: 1001DA73
mv_buffer_unref.MAIN ref: 1001DA99

Part of subcall function 1000A000: mv_freep.MAIN ref: 1000A01E

mv_freep.MAIN ref: 1001DAAF
mv_freep.MAIN ref: 1001DABE
mv_freep.MAIN ref: 1001DACD
mv_freep.MAIN ref: 1001DAD9

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_buffer_createmv_buffer_refmv_buffer_unrefmv_mallocz
String ID:
API String ID: 3470597486-0
Opcode ID: 82d4d6f48f5693230cace15fd24bc2228de7c8f31a461438f864d3093ed9a926
Instruction ID: 5b75efe8a7b385c844e612e13115847a546b552e435f503cc794a769bad89dbf
Opcode Fuzzy Hash: 82d4d6f48f5693230cace15fd24bc2228de7c8f31a461438f864d3093ed9a926
Instruction Fuzzy Hash: 4101A8756097909FDB40EF74D88161EBBE4EF44294F811C2EF985CB316E735E4848B42

Uniqueness

Uniqueness Score: -1.00%

Function 10011B29 Relevance: 9.0, APIs: 6, Instructions: 27COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 10011AE6
mv_freep.MAIN ref: 10011AF2
mv_freep.MAIN ref: 10011B36
mv_freep.MAIN ref: 10011B42

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep
String ID:
API String ID: 2373662943-0
Opcode ID: 040eb387164af77af1c63a09622b6d2a53c8259c3461063de0c689219d215f94
Instruction ID: 1079961fa057578bb5c831cca7ccaeae819dd5d2bf26a49409838597a67f0fd3
Opcode Fuzzy Hash: 040eb387164af77af1c63a09622b6d2a53c8259c3461063de0c689219d215f94
Instruction Fuzzy Hash: ABF0F879509B548BCB00EFB4E88559DBBE4FF48214F810C2EF8C487305F635E5448B42

Uniqueness

Uniqueness Score: -1.00%

Function 100304E8 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 276COMMON

Download Yara Rule

APIs

mv_strstart.MAIN ref: 1002FCB5
mv_strstart.MAIN ref: 1002FCDE

Strings

xyz, xrefs: 1002FCD5
, xrefs: 10030012
yuvj, xrefs: 1002FCA4

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strstart
String ID: $xyz$yuvj
API String ID: 2201124280-2071466796
Opcode ID: bd39db4a194a366d109f30458d461c2df5a62078d964f913814af86215653bba
Instruction ID: fae87543b31ee3dab4fff42b62755004a6e6770c78894ec516081f8316d78002
Opcode Fuzzy Hash: bd39db4a194a366d109f30458d461c2df5a62078d964f913814af86215653bba
Instruction Fuzzy Hash: 28C1F3355083948FD342CF28D8D47AABBE2EFC6388F85496CF4D187266D275DA58CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1003028C Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 275COMMON

Download Yara Rule

APIs

mv_strstart.MAIN ref: 1002FCB5
mv_strstart.MAIN ref: 1002FCDE

Strings

xyz, xrefs: 1002FCD5
, xrefs: 10030012
yuvj, xrefs: 1002FCA4

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strstart
String ID: $xyz$yuvj
API String ID: 2201124280-2071466796
Opcode ID: 81723ec4f1f1f9ea585c3b123fc44b8cc6761d75b4754926e1d488a3831eaf29
Instruction ID: bfc651eaba2522c4d235aec60645e24123cb0f9c5bb9b4cc4e7f011c1b04411b
Opcode Fuzzy Hash: 81723ec4f1f1f9ea585c3b123fc44b8cc6761d75b4754926e1d488a3831eaf29
Instruction Fuzzy Hash: 02C103355083948FD342CF28D8D47AABBE2EFC5388F85496CF4D187266D275EA58CB42

Uniqueness

Uniqueness Score: -1.00%

Function 100281D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 100284FD

Strings

Value %f for parameter '%s' out of range [%g - %g], xrefs: 100284E1
Value %f for parameter '%s' is not a valid set of 32bit integer flags, xrefs: 10028528

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: Value %f for parameter '%s' is not a valid set of 32bit integer flags$Value %f for parameter '%s' out of range [%g - %g]
API String ID: 2418673259-116802341
Opcode ID: b91d7ced30b6434288ab1907ca3d90c93a663e42af0a09cf66cc9c9b5210601c
Instruction ID: 931f173b8bdea695e87718931e4fd3664ef7a6003200403b2d75d7b454637e3a
Opcode Fuzzy Hash: b91d7ced30b6434288ab1907ca3d90c93a663e42af0a09cf66cc9c9b5210601c
Instruction Fuzzy Hash: 6B81AB3982AF918BC342DF38948111BF7E5FFDA780F919B5EF8966A251CB3096418742

Uniqueness

Uniqueness Score: -1.00%

Function 1008A280 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 158stringCOMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1008A39A
abort.MSVCRT ref: 1008A39F
strchr.MSVCRT ref: 1008A3FF

Strings

[%d], xrefs: 1008A3E5, 1008A408
D, xrefs: 1008A371

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_logstrchr
String ID: D$[%d]
API String ID: 3894635902-663482207
Opcode ID: edaa72c25f19791f7b0e2c498262eef7d1e3daae0752c7ed1855659ef121fb98
Instruction ID: d504e214a0ac69bf47af384dd0df17c231b8338c86ebac8fad4f33609c477930
Opcode Fuzzy Hash: edaa72c25f19791f7b0e2c498262eef7d1e3daae0752c7ed1855659ef121fb98
Instruction Fuzzy Hash: CA51C271E057528FE764DF29858022BB7E0FB8B354F15482AFA96D3A02D335ACC5DB81

Uniqueness

Uniqueness Score: -1.00%

Function 1001F550 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

mv_image_get_linesize.MAIN ref: 1001F5A7

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

mv_log.MAIN ref: 1001F651
mv_log.MAIN(?), ref: 1001F68E

Strings

Picture size %ux%u exceeds specified max pixel count %lld, see the documentation if you wish to increase it, xrefs: 1001F67E
Picture size %ux%u is invalid, xrefs: 1001F634

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$mv_image_get_linesizemv_pix_fmt_desc_get
String ID: Picture size %ux%u exceeds specified max pixel count %lld, see the documentation if you wish to increase it$Picture size %ux%u is invalid
API String ID: 1737039923-91635712
Opcode ID: b713d412f0b4c193ddf67d660aae77bfb9a187d1b155d626092247ac1b9e9bef
Instruction ID: b6506859fe761d8d1ebdf93eb357839b8b21828a19d49b356052a9795fea712b
Opcode Fuzzy Hash: b713d412f0b4c193ddf67d660aae77bfb9a187d1b155d626092247ac1b9e9bef
Instruction Fuzzy Hash: FA41DFB5A083449FC350CF29C08020EFBE1FBD8750F558A2EF9A8D7360E674E9458B86

Uniqueness

Uniqueness Score: -1.00%

Function 10097289 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 10097197
fputc.MSVCRT ref: 10097207
memset.MSVCRT ref: 100972C2

Strings

0, xrefs: 100972B7
o, xrefs: 100972CA

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: fputc$memset
String ID: 0$o
API String ID: 2944404495-4157579757
Opcode ID: 53fe556841918975cc31bb2d763770b8d6595e2fb305a3f12117177a263cadf8
Instruction ID: aa4496313d88015306b34c3d7fa9de5912afecbe9c57c6fd191b73af4879bf6f
Opcode Fuzzy Hash: 53fe556841918975cc31bb2d763770b8d6595e2fb305a3f12117177a263cadf8
Instruction Fuzzy Hash: 35310876A08206CBCB15CF68C48479EBBF1FF48350F15862AD99DAB351E738E900EB54

Uniqueness

Uniqueness Score: -1.00%

Function 1000C560 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 1000C582
strcmp.MSVCRT ref: 1000C5B0
strtol.MSVCRT ref: 1000C5DA

Strings

AMBI, xrefs: 1000C561

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmpstrncmpstrtol
String ID: AMBI
API String ID: 155133989-3084986980
Opcode ID: c65f3f7975b7823a73d044f094c93d5fd796e748c7aa11a49156733d133437d6
Instruction ID: 96a3e84c180ec1e05a7f5708790a2991e0ec9e313a24bbe51d35f59fb7ac403f
Opcode Fuzzy Hash: c65f3f7975b7823a73d044f094c93d5fd796e748c7aa11a49156733d133437d6
Instruction Fuzzy Hash: B6217FB590C7864FE750DF249CC060BBAD0EF492D1F11893EE98993255E275DC85C782

Uniqueness

Uniqueness Score: -1.00%

Function 1002C02C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

strspn.MSVCRT ref: 1002BF97
strchr.MSVCRT ref: 1002BFB5
mv_malloc.MAIN(?,?,?,?,?,?,?,?,?,?,100AEACF,100AEB86,00000000,?,1000DF13), ref: 1002BFCD
mv_get_token.MAIN ref: 1002BFFF

Strings

, xrefs: 1002BF8E

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_get_tokenmv_mallocstrchrstrspn
String ID:
API String ID: 476366593-596783616
Opcode ID: 29e496927f1da63fb82fa8c860c72426edcc2de4f9f69176329bf0e8f31cb9b9
Instruction ID: dc3b06df85388a75f907743202ecfe3307d48378777e578708470cdae6669aaf
Opcode Fuzzy Hash: 29e496927f1da63fb82fa8c860c72426edcc2de4f9f69176329bf0e8f31cb9b9
Instruction Fuzzy Hash: 89215E745087458FCB00DFB8D5C095ABBE5FF89284F80896ED998C7301E675E84ADB42

Uniqueness

Uniqueness Score: -1.00%

Function 10012370 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strftime.MSVCRT ref: 100123EF
mv_strlcatf.MAIN ref: 10012429
mv_dict_set.MAIN ref: 1001244D

Strings

%Y-%m-%dT%H:%M:%S, xrefs: 100123D6
.%06dZ, xrefs: 10012419

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_dict_setmv_strlcatfstrftime
String ID: %Y-%m-%dT%H:%M:%S$.%06dZ
API String ID: 3046200060-930656424
Opcode ID: 728a3bd6f1d20a34548cbc8e6d3f3df844403d6c227aa6eea2e28321bcd2af87
Instruction ID: 1402893b187d2e51f9b144a86c1e9403a14236be66f1ea1af33c468999098a96
Opcode Fuzzy Hash: 728a3bd6f1d20a34548cbc8e6d3f3df844403d6c227aa6eea2e28321bcd2af87
Instruction Fuzzy Hash: 982190B59093419FD350DF29E58065BBBE0FB88354F51C92EF89CC7305E639D8948B82

Uniqueness

Uniqueness Score: -1.00%

Function 1000D5CB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000D617
mv_bprintf.MAIN ref: 1000D64E
mv_bprintf.MAIN ref: 1000D678
mv_bprintf.MAIN ref: 1000D715
mv_bprintf.MAIN ref: 1000D7EB
mv_bprintf.MAIN ref: 1000D814
mv_bprintf.MAIN ref: 1000D84A
mv_bprintf.MAIN ref: 1000D86F
mv_bprintf.MAIN ref: 1000D8CE

Strings

NONE, xrefs: 1000D60B
@%s, xrefs: 1000D642

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: @%s$NONE
API String ID: 3083893021-9228147
Opcode ID: 79dbcbfc88ece960a6534e3f0ca092c78e639d7c6172cd214de36e0c89aebf28
Instruction ID: 70331aafde610822ed2af80890897691dd53c5944589bad81a8dad7e52305c51
Opcode Fuzzy Hash: 79dbcbfc88ece960a6534e3f0ca092c78e639d7c6172cd214de36e0c89aebf28
Instruction Fuzzy Hash: 65114C71909B5A8BE720EF18C58016EF7E1FB443D4F55881EE889A7219D731EC94CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 100199F4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 1008F820: strlen.MSVCRT ref: 1008F832
Part of subcall function 1008F820: _errno.MSVCRT ref: 1008F850

_errno.MSVCRT ref: 10019A21
mv_log.MAIN ref: 10019A4E
mv_freep.MAIN ref: 10019A56

Strings

./%sXXXXXX, xrefs: 100199FC
ff_tempfile: Cannot open temporary file %s, xrefs: 10019A45

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _errno$mv_freepmv_logstrlen
String ID: ./%sXXXXXX$ff_tempfile: Cannot open temporary file %s
API String ID: 3408331932-3725816632
Opcode ID: a3950751fee6fd876fd9b19f7d0582473770252bb0b6f1313e2b3e67b8d33bc2
Instruction ID: 705c49607cd9e09248a5fe22d2e6320ca494c65325cbcc3e842bccd471215b3e
Opcode Fuzzy Hash: a3950751fee6fd876fd9b19f7d0582473770252bb0b6f1313e2b3e67b8d33bc2
Instruction Fuzzy Hash: 0E0168B89087519FC340DF29C18151ABBE1FF88600F91882EE9C99B311E739E9859F82

Uniqueness

Uniqueness Score: -1.00%

Function 100194D1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 100194D8
mv_strerror.MAIN ref: 100194FE

Part of subcall function 10013B30: mv_strlcpy.MAIN ref: 10013B71

mv_log.MAIN ref: 1001951B
_close.MSVCRT ref: 10019523

Strings

Error occurred in fstat(): %s, xrefs: 1001950B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _close_errnomv_logmv_strerrormv_strlcpy
String ID: Error occurred in fstat(): %s
API String ID: 1199337903-68092211
Opcode ID: fe60c93a3a69f3fb052d7518d5be4b5d53371f27e76a69ea24f993d483ec9b6c
Instruction ID: 16cc7446d487878674d3b6b426b97f2481dfa04c85c7ba054179e642ea7d2528
Opcode Fuzzy Hash: fe60c93a3a69f3fb052d7518d5be4b5d53371f27e76a69ea24f993d483ec9b6c
Instruction Fuzzy Hash: D5F092B48097159FC310EF14C48425AFBE4FF84700F41C82EE5D99B361DBB4A9859B82

Uniqueness

Uniqueness Score: -1.00%

Function 100261E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 15COMMON

Download Yara Rule

APIs

mv_log.MAIN(?,?,?,?,?,?,?,?,?,?,100272BA), ref: 10026214
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,100272BA), ref: 10026219

Strings

Assertion %s failed at %s:%d, xrefs: 100261EC
libavutil/mem.c, xrefs: 100261F1
val || !min_size, xrefs: 100261FA

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_log
String ID: Assertion %s failed at %s:%d$libavutil/mem.c$val || !min_size
API String ID: 2075109169-2043513658
Opcode ID: e7e30a6a0de43b51050d007a56aa4d2eb09a9faf66d078cd7bb3a4404be27e90
Instruction ID: 7b7f116074881568e08956f9dc360710bb9d07d4c08e9fc45df01861e4a7bb4b
Opcode Fuzzy Hash: e7e30a6a0de43b51050d007a56aa4d2eb09a9faf66d078cd7bb3a4404be27e90
Instruction Fuzzy Hash: 07E04C745493459FC344DF69911160EBBE1EB88700F51C82DE59CC7349D778D4449B57

Uniqueness

Uniqueness Score: -1.00%

Function 10007100 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 114stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10007126
strchr.MSVCRT ref: 1000715B
strncmp.MSVCRT ref: 10007200
strlen.MSVCRT ref: 1000724B

Strings

-, xrefs: 10007232

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strlen$strchrstrncmp
String ID: -
API String ID: 2264528763-2547889144
Opcode ID: 48f7d506b45c4cfb1b097bd66a56f7f6b4d5827668b9fbc93cb44df58068eac6
Instruction ID: 2e89a320e1afa525ac89b1a85f99ca85d7156f5341a68399cbbe94f8cfb36377
Opcode Fuzzy Hash: 48f7d506b45c4cfb1b097bd66a56f7f6b4d5827668b9fbc93cb44df58068eac6
Instruction Fuzzy Hash: 8C318F75A083918FEB10DA78949025EBBE1FF89284F05492EE9C8D7249E278D906D792

Uniqueness

Uniqueness Score: -1.00%

Function 1001E48C Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

mv_image_check_size.MAIN ref: 1001E4BA
mv_calloc.MAIN ref: 1001E519
mv_frame_alloc.MAIN ref: 1001E584
mv_frame_free.MAIN ref: 1001E5CB
mv_freep.MAIN ref: 1001E5DC
mv_get_pix_fmt_name.MAIN ref: 1001E64E
mv_log.MAIN ref: 1001E675

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_callocmv_frame_allocmv_frame_freemv_freepmv_get_pix_fmt_namemv_image_check_sizemv_log
String ID:
API String ID: 473889652-0
Opcode ID: 9fa864ee1928c6bd1dd4db397f2e61f531e39c49d346cdfc62535eb3725c1c8c
Instruction ID: f0d2ef2185eafc4a44fc2f14c59591e06059a7926607cfdcd1216548b2331345
Opcode Fuzzy Hash: 9fa864ee1928c6bd1dd4db397f2e61f531e39c49d346cdfc62535eb3725c1c8c
Instruction Fuzzy Hash: C841E274604B828FD750DF69C480A0AF7E5FF88754F56892DE999DB321E770EC818B81

Uniqueness

Uniqueness Score: -1.00%

Function 1001E690 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

mv_hwframe_ctx_alloc.MAIN ref: 1001E6D0
mv_buffer_ref.MAIN ref: 1001E703
mv_buffer_ref.MAIN ref: 1001E77B
mv_buffer_unref.MAIN ref: 1001E79C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_ref$mv_buffer_unrefmv_hwframe_ctx_alloc
String ID:
API String ID: 2050485749-0
Opcode ID: d3ad7b980c272c66dfc6251d2f9a7c7bfdd2a05f411efaddebb324c9794b0f7c
Instruction ID: b949cf843239185fdb129f7a391c6e35efcc54fa384153f32d0a78a94b68c8eb
Opcode Fuzzy Hash: d3ad7b980c272c66dfc6251d2f9a7c7bfdd2a05f411efaddebb324c9794b0f7c
Instruction Fuzzy Hash: E0417078A087518FD744DF29C18091AFBE1FF89350F568A6DE8989B395D730EC81CB82

Uniqueness

Uniqueness Score: -1.00%

Function 100A1540 Relevance: 7.6, APIs: 5, Instructions: 102threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,00000000,00000004,?,00000000,1009EC6A,000003E8,?,?,100A014E), ref: 100A1580

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: aad5760cf48bfe59ace8456a0545fe3771cbea0c5a493778d31e095d93af85e1
Instruction ID: a603e3a71963cb926592ecdf01b935e1f93b8b32596d5f9433372c4bec14c4a6
Opcode Fuzzy Hash: aad5760cf48bfe59ace8456a0545fe3771cbea0c5a493778d31e095d93af85e1
Instruction Fuzzy Hash: AD31AE75B04612CBDB00EFA8C98439A77E5EBC03E0F598579E8598F249EA75CC40CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 1000A480 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 1000A4BA
mv_freep.MAIN ref: 1000A4E8
mv_freep.MAIN ref: 1000A541

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_mallocz
String ID:
API String ID: 2455733640-0
Opcode ID: 9f74527f40638788ac7371101fbd516078908c2a159fba3966d1ad274412a250
Instruction ID: 7473898efd5c84ff4cba6f3e963b26fd6c8cdcec3b0c7db7706523d113c4544c
Opcode Fuzzy Hash: 9f74527f40638788ac7371101fbd516078908c2a159fba3966d1ad274412a250
Instruction Fuzzy Hash: 2B31D074904B11CFD760DF25C88191AB7E0FF89391B168A5DEC999B719E730E880CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10012049 Relevance: 7.6, APIs: 5, Instructions: 79stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 1001205B
strlen.MSVCRT ref: 10012069
mv_realloc.MAIN ref: 1001207F

Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB

mv_freep.MAIN ref: 100120D0

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strlen$_aligned_reallocmv_freepmv_realloc
String ID:
API String ID: 895301365-0
Opcode ID: 0c29223b98c086e2b46ad98e7ce3030191046c0ef949241b854c2fd3e23e1c87
Instruction ID: 2d1e53f319068be23ad8f88d31967b5a2669bada8836d01dcbd6984a06f05035
Opcode Fuzzy Hash: 0c29223b98c086e2b46ad98e7ce3030191046c0ef949241b854c2fd3e23e1c87
Instruction Fuzzy Hash: 6131BDB99087018FC744CF29C18045AFBE1FF88718F158A6EE889AB311E731E945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 1000A650 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1000A66C
mv_freep.MAIN ref: 1000A69C
ReleaseSRWLockExclusive.KERNEL32 ref: 1000A6AB

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireReleasemv_freep
String ID:
API String ID: 2444013405-0
Opcode ID: 69b2e29afcab2b062c2147764c90657bebc76e2e75c4088fc9dd16b63d4a40d8
Instruction ID: 7158096d1edc9a63a07daa50029a30cfeb496985ca544081e00db1e7d26d72ff
Opcode Fuzzy Hash: 69b2e29afcab2b062c2147764c90657bebc76e2e75c4088fc9dd16b63d4a40d8
Instruction Fuzzy Hash: 3421DBB5604701CFD704EF25D5C591ABBF4FF89280F06C969E8898B31AE731E985CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10012239 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

mv_bprint_init.MAIN ref: 1001225D
mv_bprint_escape.MAIN ref: 100122B3
mv_bprint_append_data.MAIN ref: 100122CC
mv_bprint_escape.MAIN ref: 100122EE
mv_bprint_finalize.MAIN ref: 1001231B
mv_bprint_append_data.MAIN ref: 1001234B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_append_datamv_bprint_escape$mv_bprint_finalizemv_bprint_init
String ID:
API String ID: 3283265872-0
Opcode ID: 40e4fae6fe95c9ae0cafae5e4cfbe44df76d706b7c6edfb7b55f5239210fc438
Instruction ID: 90910876c942d1fbafe524e13dc9732c176e9ecd8d18a9c8de127334b5e1fd1f
Opcode Fuzzy Hash: 40e4fae6fe95c9ae0cafae5e4cfbe44df76d706b7c6edfb7b55f5239210fc438
Instruction Fuzzy Hash: 6121DDB59197059FC350DF28C18025AFBE1FF88354F51892EE99D87351E736E982CB82

Uniqueness

Uniqueness Score: -1.00%

Function 10011483 Relevance: 7.6, APIs: 5, Instructions: 61stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10011491
strlen.MSVCRT ref: 1001149F
mv_realloc.MAIN ref: 100114B5

Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB

mv_freep.MAIN ref: 100114E2

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strlen$_aligned_reallocmv_freepmv_realloc
String ID:
API String ID: 895301365-0
Opcode ID: 04da3bf766d47488039e948dce66939b5b65f249d2add762eec63dcc3e51c44d
Instruction ID: 51621a72b6bbd22e45abe63bff26c18dabce81ca6188ceac0dc85253792fa2d5
Opcode Fuzzy Hash: 04da3bf766d47488039e948dce66939b5b65f249d2add762eec63dcc3e51c44d
Instruction Fuzzy Hash: F121B3B8908712CFCB14DF24C48055AB7E5FF89344F458A5EE9999B305E731EA46CF82

Uniqueness

Uniqueness Score: -1.00%

Function 1009D6A0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 1009D6B9
_unlock.MSVCRT ref: 1009D6E1
calloc.MSVCRT ref: 1009D72F

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _lock_unlockcalloc
String ID:
API String ID: 3876498383-0
Opcode ID: 357fb2442f9bcdd85ef6b46d033be08ae312da071a22b7525909557a6230c189
Instruction ID: 6cddb97a3fd8d0d05461b53b71359434b8c1691dc6b4f2f6cc4d1d10a1eaf7a4
Opcode Fuzzy Hash: 357fb2442f9bcdd85ef6b46d033be08ae312da071a22b7525909557a6230c189
Instruction Fuzzy Hash: BF115E75544201CFDB40EF78C59071ABBE4FF84250F16896AD98CCF249EB74D840EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1001232B Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

mv_bprint_escape.MAIN ref: 100122B3

Part of subcall function 10009730: mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB

mv_bprint_append_data.MAIN ref: 100122CC
mv_bprint_escape.MAIN ref: 100122EE
mv_bprint_finalize.MAIN ref: 1001231B
mv_bprint_append_data.MAIN ref: 1001234B

Part of subcall function 10008F30: mv_realloc.MAIN ref: 10008F73

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_append_datamv_bprint_escape$mv_bprint_finalizemv_bprintfmv_realloc
String ID:
API String ID: 1942445456-0
Opcode ID: 5e9e0b7bf5f3d5346bbbc040ec1caf168d6988dfb1b18155a4329e28a55b4eeb
Instruction ID: 403ebcfaa7f6bf6d2df9c5cc3f9910434a712b72dc8362acc2447b37bc06364c
Opcode Fuzzy Hash: 5e9e0b7bf5f3d5346bbbc040ec1caf168d6988dfb1b18155a4329e28a55b4eeb
Instruction Fuzzy Hash: 752199B59183019FD360DF29C08069AFBE1FB89348F50892EE58CC7301E736E981CB46

Uniqueness

Uniqueness Score: -1.00%

Function 1008A9E0 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

mv_mallocz.MAIN ref: 1008AA02
mv_buffer_create.MAIN ref: 1008AA43

Part of subcall function 10009E60: mv_mallocz.MAIN ref: 10009E86
Part of subcall function 10009E60: mv_mallocz.MAIN ref: 10009EBF

mv_frame_new_side_data_from_buf.MAIN ref: 1008AA64

Part of subcall function 1001B750: mv_realloc.MAIN(?,?,?,00000000,10011000), ref: 1001B782
Part of subcall function 1001B750: mv_mallocz.MAIN(?,?,?,00000000,10011000), ref: 1001B798

mv_freep.MAIN ref: 1008AA87
mv_buffer_unref.MAIN ref: 1008AA9F

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$mv_buffer_createmv_buffer_unrefmv_frame_new_side_data_from_bufmv_freepmv_realloc
String ID:
API String ID: 4079258015-0
Opcode ID: db8889515c7f553bd07aa0679fa2a6a29804f1dbc555ffa5fdf3cb394941dbce
Instruction ID: b48374cefd5705bd05e398ce965887d68948386aeb5666d67e45d6dee8b3c328
Opcode Fuzzy Hash: db8889515c7f553bd07aa0679fa2a6a29804f1dbc555ffa5fdf3cb394941dbce
Instruction Fuzzy Hash: 3C1116B09087018FD744DF29C58460BBBE4FF89380F45882EE999CB621E734E985CF52

Uniqueness

Uniqueness Score: -1.00%

Function 10011A87 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 10011A5F
mv_freep.MAIN ref: 10011A6B
mv_mallocz.MAIN ref: 10011A97
mv_freep.MAIN ref: 10011AE6
mv_freep.MAIN ref: 10011AF2
mv_freep.MAIN ref: 10011B36
mv_freep.MAIN ref: 10011B42

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_mallocz
String ID:
API String ID: 2455733640-0
Opcode ID: d5c1c30fc960bf7640f1f1bb9a1ad17a8736e34e7bb0e74a488f3468996d7490
Instruction ID: e27aaf6f2fbb493ff670743c398b5037914b47ddc08bede214f16f72f1dc21d1
Opcode Fuzzy Hash: d5c1c30fc960bf7640f1f1bb9a1ad17a8736e34e7bb0e74a488f3468996d7490
Instruction Fuzzy Hash: E50119756097548FC740EFB8D88175AB7E4FF48290F81582DF894C7200EB31E8448B82

Uniqueness

Uniqueness Score: -1.00%

Function 1001DAE8 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

mv_buffer_ref.MAIN ref: 1001D9F6
mv_buffer_create.MAIN ref: 1001DA2F
mv_buffer_unref.MAIN ref: 1001DA99
mv_freep.MAIN ref: 1001DAAF
mv_freep.MAIN ref: 1001DABE
mv_freep.MAIN ref: 1001DACD
mv_freep.MAIN ref: 1001DAD9
mv_mallocz.MAIN ref: 1001DAF7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_buffer_createmv_buffer_refmv_buffer_unrefmv_mallocz
String ID:
API String ID: 3470597486-0
Opcode ID: 3a33ffab89d5aed0bf03c31c6abfb545fd4a93970b8c716d4a66c5e27936259d
Instruction ID: ec82959c7a140a0cfaaa292ac1a12e2931abf6bf560108a204ed996edac76e07
Opcode Fuzzy Hash: 3a33ffab89d5aed0bf03c31c6abfb545fd4a93970b8c716d4a66c5e27936259d
Instruction Fuzzy Hash: D5011D796087808FD740EF34D88161ABBE0FF88248F858D2EE4898B306E631E444CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1000C7D9 Relevance: 7.5, APIs: 5, Instructions: 36stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 1000C7E0
strtol.MSVCRT ref: 1000C804
_errno.MSVCRT ref: 1000C80B
_errno.MSVCRT ref: 1000C822
_errno.MSVCRT ref: 1000C848

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _errno$strtol
String ID:
API String ID: 3596500743-0
Opcode ID: 94420cbffd51064d18b4594c717699c8f84a31741584a0f27c6857c5b8a8326f
Instruction ID: e5a68f2e7340340f2a0c1abd8e62d28df7ecd48bc61271be75172e8c5bb86d30
Opcode Fuzzy Hash: 94420cbffd51064d18b4594c717699c8f84a31741584a0f27c6857c5b8a8326f
Instruction Fuzzy Hash: CD01E474A0931A9FD744EF65C88871ABBE2FF85740F55C86DE88987724EB74E8408B42

Uniqueness

Uniqueness Score: -1.00%

Function 1004B020 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 1004B02F
mv_fifo_can_read.MAIN ref: 1004B03C
mv_fifo_read_to_cb.MAIN ref: 1004B066
WakeAllConditionVariable.KERNEL32 ref: 1004B071
ReleaseSRWLockExclusive.KERNEL32 ref: 1004B07D

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWakemv_fifo_can_readmv_fifo_read_to_cb
String ID:
API String ID: 93134951-0
Opcode ID: b04aa90755bf11445e363e889d079bebaf352ae153b96380cc2547109b9fea1a
Instruction ID: f622ea8ca44b4a077811579624edcdfc0bd4128ea1142ae48ea321c74ce907da
Opcode Fuzzy Hash: b04aa90755bf11445e363e889d079bebaf352ae153b96380cc2547109b9fea1a
Instruction Fuzzy Hash: D5F0B6F5908A109FCB40FF39E5C550ABBE0EF45644F41892DF8898B209E634E595CB93

Uniqueness

Uniqueness Score: -1.00%

Function 1002A1A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_log.MAIN ref: 1002A471

Strings

Value %f for parameter '%s' out of range [%g - %g], xrefs: 1002A44E
Value %f for parameter '%s' is not a valid set of 32bit integer flags, xrefs: 1002A41D

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_log
String ID: Value %f for parameter '%s' is not a valid set of 32bit integer flags$Value %f for parameter '%s' out of range [%g - %g]
API String ID: 2835281190-116802341
Opcode ID: 0c2f96b72357f92c4ca18961a8f2628428f56dc49a738391d3e7b851953e97bc
Instruction ID: 1f9a3ae519994aab547ffbe7134408521fdf083e78839cfb6fd5b55b8ae9f8c9
Opcode Fuzzy Hash: 0c2f96b72357f92c4ca18961a8f2628428f56dc49a738391d3e7b851953e97bc
Instruction Fuzzy Hash: C3619B35919B45CBC382DF38E48111AFBA6FFDB2E0F91975AF8966A250DB30C4C19742

Uniqueness

Uniqueness Score: -1.00%

Function 100204C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

mv_image_get_linesize.MAIN ref: 10020524

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

mv_image_fill_linesizes.MAIN(?), ref: 100205B2

Strings

Picture size %ux%u is invalid, xrefs: 10020635

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_image_fill_linesizesmv_image_get_linesizemv_pix_fmt_desc_get
String ID: Picture size %ux%u is invalid
API String ID: 547003755-1963597007
Opcode ID: 55cc673a7fd8fa65950412ae644b1255500889416eca15a6256c6aad94377d03
Instruction ID: 76d0c1c0ea3a07b63bf36c4eb498433e90d4a1915968e7ac4ed20e6f6339bb64
Opcode Fuzzy Hash: 55cc673a7fd8fa65950412ae644b1255500889416eca15a6256c6aad94377d03
Instruction Fuzzy Hash: 73412576A097508FC350CF29D88074ABBE2FFC8610F558A2EF9A8CB351E634D8418F42

Uniqueness

Uniqueness Score: -1.00%

Function 1000D684 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN ref: 1000D64E
mv_bprintf.MAIN ref: 1000D678
mv_bprintf.MAIN ref: 1000D715

Strings

@%s, xrefs: 1000D642

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: @%s
API String ID: 3083893021-2921637043
Opcode ID: 3226884ed7a48c89542cb2da4cd6bdc3bde8d4d284e963f694dc1568948eeeaa
Instruction ID: 3992f4aefadd0f47064a5f8236616475ea9e2f99c0eaa1b511875076a351044c
Opcode Fuzzy Hash: 3226884ed7a48c89542cb2da4cd6bdc3bde8d4d284e963f694dc1568948eeeaa
Instruction Fuzzy Hash: F32128719087168BE350EF59C48022EF7E1FB98394F12892EE89897315E731ED55CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 10029794 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 100292C3
mv_log.MAIN ref: 100292ED
mv_log.MAIN ref: 10029391
mv_log.MAIN ref: 1002977B

Strings

%-15s , xrefs: 100292D4

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log$strcmp
String ID: %-15s
API String ID: 1163046698-755444208
Opcode ID: b29ba3bba20739d572f02bb09815cded5aef70f9b82e404a867a14a708790a90
Instruction ID: ce635d268765be07717733ae1f701fccf88d57a4aae717667b6e3b1a655ee8de
Opcode Fuzzy Hash: b29ba3bba20739d572f02bb09815cded5aef70f9b82e404a867a14a708790a90
Instruction Fuzzy Hash: 8B21B278A093459FCB50DF28E09069EB7E1EF88B80F92C82DE89997351D374E940DB42

Uniqueness

Uniqueness Score: -1.00%

Function 1002EABC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

strtoul.MSVCRT ref: 1002EA06
strspn.MSVCRT ref: 1002EAD4
bsearch.MSVCRT ref: 1002EB0A
strtoul.MSVCRT ref: 1002EB74
mv_log.MAIN ref: 1002EC38

Strings

0123456789ABCDEFabcdef, xrefs: 1002EACB

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strtoul$bsearchmv_logstrspn
String ID: 0123456789ABCDEFabcdef
API String ID: 1580567553-1534423534
Opcode ID: abb7986011698c1c1e265c16a005ff9de3de25baebe5d04ef4ccaa8955e208e0
Instruction ID: 1049657c988276e6ddf893df4eb424eafbb891710bb151af54785349b2433993
Opcode Fuzzy Hash: abb7986011698c1c1e265c16a005ff9de3de25baebe5d04ef4ccaa8955e208e0
Instruction Fuzzy Hash: 1E21AF719487C59ED752CF34909171ABBE4EF81380F85CA6FE4899B241E738CD80C712

Uniqueness

Uniqueness Score: -1.00%

Function 1002E6E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1002E70F

Strings

ntsc, xrefs: 1002E6E1

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp
String ID: ntsc
API String ID: 1004003707-2045543799
Opcode ID: 45332122925daee58b0ca36453adb93a54a139fa692ca5e16f6db20bb7fad8e3
Instruction ID: a92f6e95659317827b4528b13064fbf16e1d4fcf51acc17d8aa5f4157741274d
Opcode Fuzzy Hash: 45332122925daee58b0ca36453adb93a54a139fa692ca5e16f6db20bb7fad8e3
Instruction Fuzzy Hash: A5111CB4A483829FE300DF69E4C065ABBE5EF85340F95896AF49897361D370EC81DB42

Uniqueness

Uniqueness Score: -1.00%

Function 1002F736 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

mv_small_strptime.MAIN ref: 1002F750
_errno.MSVCRT ref: 1002F76D

Part of subcall function 1008F920: _errno.MSVCRT ref: 1008FAD0

_errno.MSVCRT ref: 1002F7A6

Strings

%M:%S, xrefs: 1002F744

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _errno$mv_small_strptime
String ID: %M:%S
API String ID: 1751681387-2500880230
Opcode ID: 0f4dc0b8a2eab276dcd261725bdbf527f7e350a116602d16b17de4fd457b750a
Instruction ID: 08dd91ef31b92b14981fe1afeff638f908fd3777591abbf69ec9e5e015226bf1
Opcode Fuzzy Hash: 0f4dc0b8a2eab276dcd261725bdbf527f7e350a116602d16b17de4fd457b750a
Instruction Fuzzy Hash: 10010C75A05305DFD764DF29D45076EBBE0FB84280F51883EE899C3250EA3098458F92

Uniqueness

Uniqueness Score: -1.00%

Function 1002D72B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

mv_dict_get.MAIN ref: 1002D6AB
mv_opt_set.MAIN ref: 1002D6CF
mv_log.MAIN ref: 1002D70E
mv_dict_free.MAIN ref: 1002D71A
mv_dict_set.MAIN ref: 1002D74F

Strings

Error setting option %s to value %s., xrefs: 1002D6F7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_dict_freemv_dict_getmv_dict_setmv_logmv_opt_set
String ID: Error setting option %s to value %s.
API String ID: 1354616078-3279051434
Opcode ID: be12c7fe19db5ab61db51b4a1bede206e01a94ada12606f0a4e7e7a9321a0867
Instruction ID: 6b9ea6aabfc4124447e1f2434b6fc2a42ecd06c72756f075168a49251e9f20a7
Opcode Fuzzy Hash: be12c7fe19db5ab61db51b4a1bede206e01a94ada12606f0a4e7e7a9321a0867
Instruction Fuzzy Hash: B6017AB9A08304AFC744DF28D48059ABBE0FB88354F10892EF99CD7310E634EA409F86

Uniqueness

Uniqueness Score: -1.00%

Function 10009784 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097AD
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C05
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C65

Strings

&, xrefs: 1000979B
>, xrefs: 100097E9

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: &$>
API String ID: 3083893021-624094588
Opcode ID: 3a0184e92dcb7e1e473096fa467e9c05a6d80c2d3150c9be7b04146b26d57726
Instruction ID: 4c5438aa6a129c9ce896481cefdf623b6b0dbe5659d14e32da422b5388819884
Opcode Fuzzy Hash: 3a0184e92dcb7e1e473096fa467e9c05a6d80c2d3150c9be7b04146b26d57726
Instruction Fuzzy Hash: 0EF03071C08B59CADB50EF68855079AB7E5EB853D0F86480EE4DA9B209C734FC86C782

Uniqueness

Uniqueness Score: -1.00%

Function 10009A08 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009A35
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009A7B
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C25
mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 10009C45

Strings

>, xrefs: 10009A69
', xrefs: 10009A23

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprintf
String ID: '$>
API String ID: 3083893021-1996891769
Opcode ID: 42ebd6a35695f5f76d849163282aa4592941da0a2ecac70b33ec663c14a5c16d
Instruction ID: 833e2b3188953a1b3be8fb8ff8af71bd57aa8e074cd88eba3086a03673e998a7
Opcode Fuzzy Hash: 42ebd6a35695f5f76d849163282aa4592941da0a2ecac70b33ec663c14a5c16d
Instruction Fuzzy Hash: 8CF05430C18B59CAD710EF64805076AB7D1EB463C0F868C0EE5D55B209C734B8C2C797

Uniqueness

Uniqueness Score: -1.00%

Function 1008A8C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

mv_stristr.MAIN ref: 1008A8D5
strlen.MSVCRT ref: 1008A8E6
mv_uuid_parse_range.MAIN ref: 1008A902

Strings

urn:uuid:, xrefs: 1008A8C1

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_stristrmv_uuid_parse_rangestrlen
String ID: urn:uuid:
API String ID: 1905088648-560508677
Opcode ID: c0996147e5801d84dfc9fd88d759a400d8d0d672de9e6cdb5cd08c5e74220e47
Instruction ID: 77bc98d95f22fff805a02dd3f8ff758dfa51e570d0101063bf40377ba5083ad9
Opcode Fuzzy Hash: c0996147e5801d84dfc9fd88d759a400d8d0d672de9e6cdb5cd08c5e74220e47
Instruction Fuzzy Hash: 34F01CB49087518BDA10EF28998100EB6E4FB4A654F17499FF4C9A7302D279D9809B93

Uniqueness

Uniqueness Score: -1.00%

Function 1000F9A9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1000F99A
mv_log.MAIN ref: 1000F9D1

Strings

overriding to %d logical cores, xrefs: 1000F981
detected %d logical cores, xrefs: 1000F9B4

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: detected %d logical cores$overriding to %d logical cores
API String ID: 2418673259-3421371979
Opcode ID: 0759295ed6044173e9392d2661279fec986e6af074d162e95bf04f3e6d97d716
Instruction ID: 4351d7ad1e4b7553753ed5daeab53ed97445378c9d31bf055318a612fe487827
Opcode Fuzzy Hash: 0759295ed6044173e9392d2661279fec986e6af074d162e95bf04f3e6d97d716
Instruction Fuzzy Hash: A4F06CB0A08341AFD340DF59C09171ABBE0EB88740F90C82EE6D987361D679A9459F87

Uniqueness

Uniqueness Score: -1.00%

Function 1002D35B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1002D379

Strings

Key '%s' not found., xrefs: 1002D364

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_log
String ID: Key '%s' not found.
API String ID: 2418673259-2052305073
Opcode ID: b6e5dbdcddb3e8e537d9606f4ee5ef41b23fddcb67c58fcbb9e80a7253b86ab3
Instruction ID: 2935cc58392a1398e58e060f8426a77ac91e2dc20dd80442988a03116b7c0377
Opcode Fuzzy Hash: b6e5dbdcddb3e8e537d9606f4ee5ef41b23fddcb67c58fcbb9e80a7253b86ab3
Instruction Fuzzy Hash: CBE075755087509FC304DF28E48111EFBE0EF88354F41C82EE5CD97315DA75E4418B82

Uniqueness

Uniqueness Score: -1.00%

Function 100252F0 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

mv_mul_q.MAIN ref: 10025352

Part of subcall function 10032DA0: mv_reduce.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,10025357), ref: 10032DE1

mv_rescale_rnd.MAIN ref: 100253F3
mv_rescale_rnd.MAIN ref: 10025420

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_rescale_rnd$mv_mul_qmv_reduce
String ID:
API String ID: 3269292098-0
Opcode ID: b50e5d1874e335783e8f5a6a831900d86d3a57486d0b88453f95c6126a562e0d
Instruction ID: 7a4d74e7e2a0161bf1f379c5bd56ad13f195e656a433c0a89533b9deccd96d44
Opcode Fuzzy Hash: b50e5d1874e335783e8f5a6a831900d86d3a57486d0b88453f95c6126a562e0d
Instruction Fuzzy Hash: 8A61B074A097409FC344CF29D48060AFBE1BFC8764F548A2EF8A993360D771E9418F86

Uniqueness

Uniqueness Score: -1.00%

Function 1003A320 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

mv_samples_get_buffer_size.MAIN ref: 1003A34E
mv_malloc.MAIN ref: 1003A360
mv_samples_fill_arrays.MAIN ref: 1003A396

Part of subcall function 1003A1B0: mv_samples_get_buffer_size.MAIN ref: 1003A201

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_samples_get_buffer_size$mv_mallocmv_samples_fill_arrays
String ID:
API String ID: 3894167361-0
Opcode ID: 8d336f63005a17f0ce2746193248b8f2ccff729fc354cbe18226dd819581e305
Instruction ID: 29f813314073505780b3b6a0bf21f4ec65a179872cc3375d0f3d993001abd10e
Opcode Fuzzy Hash: 8d336f63005a17f0ce2746193248b8f2ccff729fc354cbe18226dd819581e305
Instruction Fuzzy Hash: 0A419D75E083018FD705CF29C58460EFBE6EFCA355F55892EE8888B350E7B5E9858B42

Uniqueness

Uniqueness Score: -1.00%

Function 1001B0A4 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

mv_image_fill_linesizes.MAIN ref: 1001B0C8

Part of subcall function 1001EAB0: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,1001B0CD), ref: 1001EAC6

mv_image_fill_plane_sizes.MAIN ref: 1001B15D
mv_buffer_alloc.MAIN ref: 1001B1CD
mv_image_fill_pointers.MAIN ref: 1001B1FC

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_buffer_allocmv_image_fill_linesizesmv_image_fill_plane_sizesmv_image_fill_pointersmv_pix_fmt_desc_get
String ID:
API String ID: 2879504290-0
Opcode ID: 7341e7224c3c084a21f5b683c78ee4c84bc759b0f2a3afcbc0be0c244e6f78e6
Instruction ID: 8f506c5f79b5a5d03f9a5ada546bbcf13e993700c3781cdda1da6b75d303e5b0
Opcode Fuzzy Hash: 7341e7224c3c084a21f5b683c78ee4c84bc759b0f2a3afcbc0be0c244e6f78e6
Instruction Fuzzy Hash: 4151F9B5608B018FCB48DF69D5D066ABBE1FF88240F15897DE949CB359E731E884CB41

Uniqueness

Uniqueness Score: -1.00%

Function 100290D0 Relevance: 6.1, APIs: 4, Instructions: 102stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 10029155
mv_strlcatf.MAIN ref: 1002919C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strlcatfstrcmp
String ID:
API String ID: 3138383634-0
Opcode ID: e6d04f5b88f278462d021f45b59cfba453c363faba32e7f9e0e655f4c856f37f
Instruction ID: 4e00ca5e32ba23cd1f0d150041dade036c75141da2ff9e4549c40cdffe91d108
Opcode Fuzzy Hash: e6d04f5b88f278462d021f45b59cfba453c363faba32e7f9e0e655f4c856f37f
Instruction Fuzzy Hash: 3C316B75A083968FDB10DF6AE48475BBBE4EF84384F55486EEC9897201D334ED18CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1009D7D0 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 1009D822
MultiByteToWideChar.KERNEL32 ref: 1009D865

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: e06c874c7b0f77f595b58fe30017b44e27d557a91db68f2b64ff68b0ac9c3ef2
Instruction ID: b6030a99734b0483f6aa4200c2ea406aadadd20ec724542bcc610d09dc4c1d1f
Opcode Fuzzy Hash: e06c874c7b0f77f595b58fe30017b44e27d557a91db68f2b64ff68b0ac9c3ef2
Instruction Fuzzy Hash: 8431E2B45093918FD700EF68D58424BBBF0FF85354F00895EE8988B252D7BAD849DB92

Uniqueness

Uniqueness Score: -1.00%

Function 1004D990 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004D9EA
mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004D9F5
mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004DA00
mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004DA0B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep
String ID:
API String ID: 2373662943-0
Opcode ID: 7dfa075bf1bdc506961d276955aafd077213c814744881a5db9aafc42121e5d5
Instruction ID: 0cb0491cf1fe648b7da9de51e1deb3b3891b8e5c0bd1407a825c4066b1865736
Opcode Fuzzy Hash: 7dfa075bf1bdc506961d276955aafd077213c814744881a5db9aafc42121e5d5
Instruction Fuzzy Hash: B1219CB5A087618ADB10EF24E8C175A37E5EF40340F6A45BBDC89CB24AE634D950C796

Uniqueness

Uniqueness Score: -1.00%

Function 10032734 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

clock.MSVCRT ref: 10032773
mv_sha_init.MAIN ref: 1003280D
mv_sha_update.MAIN ref: 10032827
mv_sha_final.MAIN ref: 10032837

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: clockmv_sha_finalmv_sha_initmv_sha_update
String ID:
API String ID: 679641161-0
Opcode ID: 6f861df05181ea4ff24294a19bc8cb2a57f6845d629d0ae6cd75aa9bb61d67ba
Instruction ID: 2963d4e084b8430f89c99bd8ea125613e8711b22e7604053a18660b36ac50186
Opcode Fuzzy Hash: 6f861df05181ea4ff24294a19bc8cb2a57f6845d629d0ae6cd75aa9bb61d67ba
Instruction Fuzzy Hash: 63218D76A043108FE308EF38CAC424AB7E2EBC8316F95C93DDD889B355DA75D9058B91

Uniqueness

Uniqueness Score: -1.00%

Function 100904CB Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 1009039A
free.MSVCRT ref: 100903AF
free.MSVCRT ref: 10091748

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c948fa845793077111497f2527960b47adc091a50e119db403586e5582924b95
Instruction ID: a65262f2a8dc64e3d2e8f10df8af347bd004f4dc4fa9b202cb7ff24efa69f101
Opcode Fuzzy Hash: c948fa845793077111497f2527960b47adc091a50e119db403586e5582924b95
Instruction Fuzzy Hash: 923149746087428FD710DF65C08469EB7E4FF88348F11496DFAAC97251D730E949DB52

Uniqueness

Uniqueness Score: -1.00%

Function 100903C3 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

isspace.MSVCRT ref: 100902E9
isspace.MSVCRT ref: 10090319
free.MSVCRT ref: 10090378
free.MSVCRT ref: 1009039A
free.MSVCRT ref: 100903AF
isspace.MSVCRT ref: 10090406
free.MSVCRT ref: 10090468
free.MSVCRT ref: 10090486
free.MSVCRT ref: 10090494

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: free$isspace
String ID:
API String ID: 976929720-0
Opcode ID: fe24054ec7115680a7aba0907deca4313fe60f6a3821cc51ca110f7dcd4ad952
Instruction ID: 9a66b9782b17951ee1e90e07e3e5ef4e575e26772417cf8a5ace86cc60e39293
Opcode Fuzzy Hash: fe24054ec7115680a7aba0907deca4313fe60f6a3821cc51ca110f7dcd4ad952
Instruction Fuzzy Hash: 42211675608B528FD710DF24C08079AB7E0FF84758F16491DEAE8A7221D374F98A9B92

Uniqueness

Uniqueness Score: -1.00%

Function 10090509 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

isspace.MSVCRT ref: 100902E9
isspace.MSVCRT ref: 10090319
free.MSVCRT ref: 10090378
free.MSVCRT ref: 1009039A
free.MSVCRT ref: 100903AF
isspace.MSVCRT ref: 10090406
free.MSVCRT ref: 10090468
free.MSVCRT ref: 10090486
free.MSVCRT ref: 10090494

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: free$isspace
String ID:
API String ID: 976929720-0
Opcode ID: dac273ccd9a5951a7db9dff5896ff6531715d0d8e536adad97fba163b5a1a0c2
Instruction ID: f581656372f63a1c8f88fd144b7300c4eda009a61946b385c261621a1e34703c
Opcode Fuzzy Hash: dac273ccd9a5951a7db9dff5896ff6531715d0d8e536adad97fba163b5a1a0c2
Instruction Fuzzy Hash: 96211675608B528FD710DF24C08079AB7E0FF84754F16491DFAECA7221D374B94AAB92

Uniqueness

Uniqueness Score: -1.00%

Function 1001E54B Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

mv_hwframe_get_buffer.MAIN ref: 1001E561

Part of subcall function 1001E2F0: mv_buffer_ref.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E317
Part of subcall function 1001E2F0: mv_frame_alloc.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E32A
Part of subcall function 1001E2F0: mv_hwframe_map.MAIN(?,?,?,?,?,?,?,?,?,?,?,00000000,1001C33B), ref: 1001E36C
Part of subcall function 1001E2F0: mv_log.MAIN ref: 1001E396
Part of subcall function 1001E2F0: mv_frame_free.MAIN ref: 1001E3A2

mv_frame_alloc.MAIN ref: 1001E584

Part of subcall function 1001AC40: mv_malloc.MAIN ref: 1001AC56

mv_frame_free.MAIN ref: 1001E5CB
mv_freep.MAIN ref: 1001E5DC
mv_freep.MAIN ref: 1001E61B
mv_freep.MAIN ref: 1001E63A

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep$mv_frame_allocmv_frame_free$mv_buffer_refmv_hwframe_get_buffermv_hwframe_mapmv_logmv_malloc
String ID:
API String ID: 2206481229-0
Opcode ID: 25283562a18f3cc925092daff3d8813b508f0ce4e67f46393089d96786ff75ef
Instruction ID: ca945ac18ed839ac5bf74ac2fa747fd2f81b9f58e27d0342db77472b587ece54
Opcode Fuzzy Hash: 25283562a18f3cc925092daff3d8813b508f0ce4e67f46393089d96786ff75ef
Instruction Fuzzy Hash: F42126756087518FD340DF29C880A4EF3E5FF89354F468869E988DB321E770EC858B41

Uniqueness

Uniqueness Score: -1.00%

Function 100027B0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

mv_fifo_can_read.MAIN ref: 100027C7
mv_fifo_can_write.MAIN ref: 100027D6
mv_samples_get_buffer_size.MAIN ref: 100027FF
mv_fifo_grow2.MAIN ref: 10002833

Part of subcall function 10017F70: mv_realloc_array.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,?,10002838), ref: 10017FAE

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_fifo_can_readmv_fifo_can_writemv_fifo_grow2mv_realloc_arraymv_samples_get_buffer_size
String ID:
API String ID: 78108474-0
Opcode ID: 0ae8dcb50c524f4d83e5332cc30a05b3d9202b551eefed4852725224eaea7f23
Instruction ID: aca124555f9e986d8ecf7dcc78e3baf80687684f5b36e82da0df567b59823915
Opcode Fuzzy Hash: 0ae8dcb50c524f4d83e5332cc30a05b3d9202b551eefed4852725224eaea7f23
Instruction Fuzzy Hash: 8611E378A093559FD700DF69C58094ABBE4FF88394F01892DFD88CB314E774E9458B92

Uniqueness

Uniqueness Score: -1.00%

Function 100A1390 Relevance: 6.1, APIs: 4, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 100A13AD
GetTickCount64.KERNEL32 ref: 100A13C0
WaitForSingleObject.KERNEL32 ref: 100A13D7
WaitForSingleObject.KERNEL32 ref: 100A1403

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Count64ObjectSingleTickWait
String ID:
API String ID: 3187275320-0
Opcode ID: 1cfadcc898e6b36cfd1a4f7bf5837ebdbe6212e429eb6220fca006c3ac279431
Instruction ID: 1bf18b280d2744a8743e55954746d7a5a9d8936b65fabab63a36412c31ae482f
Opcode Fuzzy Hash: 1cfadcc898e6b36cfd1a4f7bf5837ebdbe6212e429eb6220fca006c3ac279431
Instruction Fuzzy Hash: 1201BC32B092548BC700BEBD9CC845EBBE5FBC41A4F808A3DE988C7705E63098088792

Uniqueness

Uniqueness Score: -1.00%

Function 1001B7E0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

mv_buffer_alloc.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B7F0

Part of subcall function 10009DC0: mv_malloc.MAIN ref: 10009DDC
Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009DF2
Part of subcall function 10009DC0: mv_mallocz.MAIN ref: 10009E25

mv_realloc.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B820

Part of subcall function 10026280: _aligned_realloc.MSVCRT ref: 100262AB

mv_mallocz.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B836
mv_buffer_unref.MAIN(?,?,?,?,?,?,?,?,1001284A), ref: 1001B87F

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_mallocz$_aligned_reallocmv_buffer_allocmv_buffer_unrefmv_mallocmv_realloc
String ID:
API String ID: 547404713-0
Opcode ID: f53c243b31966ade95df7518ce4c0598c2817321e792378a526fbf3cdf0bd58c
Instruction ID: e87e4f9eabebad2ec55774af977a150987189923fc92643a84a7bc33fe8d3c27
Opcode Fuzzy Hash: f53c243b31966ade95df7518ce4c0598c2817321e792378a526fbf3cdf0bd58c
Instruction Fuzzy Hash: 0011F8B4908B418FD750DF25D48068AFBE4FF48290F55896EE99A9B315EB30E881CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1004D9C8 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004D9EA
mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004D9F5
mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004DA00
mv_freep.MAIN(?,?,?,?,100A614A), ref: 1004DA0B

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep
String ID:
API String ID: 2373662943-0
Opcode ID: 883756fb135680f02b9e7241d4b82a69b6f557dd1b3e18bc2a7579ac156dc7e8
Instruction ID: a4ea76907e77a494ff592404b92edb11bbb38d68de6f5075056f11605139768e
Opcode Fuzzy Hash: 883756fb135680f02b9e7241d4b82a69b6f557dd1b3e18bc2a7579ac156dc7e8
Instruction Fuzzy Hash: FF1157B5D04B608ADB40EF64E8C135977E4EF05310F5A48BADC85CB38AE739D884C756

Uniqueness

Uniqueness Score: -1.00%

Function 1000E9B1 Relevance: 6.0, APIs: 4, Instructions: 49stringCOMMON

Download Yara Rule

APIs

mv_channel_from_string.MAIN ref: 1000E993
strchr.MSVCRT ref: 1000E9C4
mv_strlcpy.MAIN ref: 1000E9EF

Part of subcall function 100066E0: strlen.MSVCRT ref: 10006726

mv_channel_from_string.MAIN ref: 1000EA01

Part of subcall function 1000C560: strncmp.MSVCRT ref: 1000C582
Part of subcall function 1000C560: strcmp.MSVCRT ref: 1000C5B0

strcmp.MSVCRT ref: 1000EA3D
mv_channel_from_string.MAIN ref: 1000EA58
strcmp.MSVCRT ref: 1000EAA6

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_channel_from_stringstrcmp$mv_strlcpystrchrstrlenstrncmp
String ID:
API String ID: 886603963-0
Opcode ID: 8616275c2150e7efb85d131667853066869ad1c5313a7f24b712379ae3ad5ca6
Instruction ID: 573cd39c050991141a6e921ab4fbfb848e83e1f3f19c3e4a32285acdb0885ff6
Opcode Fuzzy Hash: 8616275c2150e7efb85d131667853066869ad1c5313a7f24b712379ae3ad5ca6
Instruction Fuzzy Hash: AF1136B46087428FDB00DF28C58065ABBE5FF88780F118D2DE5C8EB265E270ED44DB92

Uniqueness

Uniqueness Score: -1.00%

Function 100906F6 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 10090378
free.MSVCRT ref: 1009039A
free.MSVCRT ref: 100903AF
isspace.MSVCRT ref: 10090703
free.MSVCRT ref: 10090748

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: free$isspace
String ID:
API String ID: 976929720-0
Opcode ID: 37b137bf86c7b9fd5c083fa930197be3b6f87acadb63fa94fcfc321b8d9dfeb5
Instruction ID: 7cf0f320011b5f61f1ef3f0d1d252dbc84d66aace04f87b5de561192c6a65056
Opcode Fuzzy Hash: 37b137bf86c7b9fd5c083fa930197be3b6f87acadb63fa94fcfc321b8d9dfeb5
Instruction Fuzzy Hash: BD011779A087018FD710EF75D48035AB3E4FF88764F124A2CFAACA7201D730EA049B91

Uniqueness

Uniqueness Score: -1.00%

Function 10007050 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

mv_bprint_init.MAIN ref: 10007076
mv_bprint_escape.MAIN ref: 100070AA

Part of subcall function 10009730: mv_bprintf.MAIN(?,?,?,?,?,?,?,?,?,?,100070AF), ref: 100097FB

mv_bprint_finalize.MAIN ref: 100070C7

Part of subcall function 10009690: mv_realloc.MAIN(?,?,?,?,?,?,10006D57), ref: 100096C9

mv_bprint_finalize.MAIN ref: 100070F1

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_finalize$mv_bprint_escapemv_bprint_initmv_bprintfmv_realloc
String ID:
API String ID: 2707718180-0
Opcode ID: 8fcf3987ad7d05698dc9ea44ca5edbe39d28e2b760c260b832d1773102fd6b80
Instruction ID: 7786e306f37471b19b8e033861bf3e046f7241f8be26b7eb16500715b45264db
Opcode Fuzzy Hash: 8fcf3987ad7d05698dc9ea44ca5edbe39d28e2b760c260b832d1773102fd6b80
Instruction Fuzzy Hash: 9F116DB4A093408BD360DF28C18065EBBE0BF88254F908E2DBA9C87345E635A944CB06

Uniqueness

Uniqueness Score: -1.00%

Function 1001140B Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

mv_freep.MAIN ref: 10011416
mv_freep.MAIN ref: 10011422

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_freep
String ID:
API String ID: 2373662943-0
Opcode ID: 7d849d430b18bd63c2ffebc00fb6b84f710c2797a3bf5240d0040ef1fb02228c
Instruction ID: e6160234d2b5473e354702e54758fc74ece171a8690405ef2f617578e500f202
Opcode Fuzzy Hash: 7d849d430b18bd63c2ffebc00fb6b84f710c2797a3bf5240d0040ef1fb02228c
Instruction Fuzzy Hash: B3E0AE79508B608BC700EF28D88141EB7F0FF89208F854C1DFAC4A7306E635F9448B82

Uniqueness

Uniqueness Score: -1.00%

Function 10012B04 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5d3dc0fd0cb3ef6d04f562988a8f745905f1efb17a15ffeb54e2807adc24af
Instruction ID: 8863fbba633440d1c9bb7560d783c2b2fa1c445144d5959f5dcc9319c98cded4
Opcode Fuzzy Hash: ad5d3dc0fd0cb3ef6d04f562988a8f745905f1efb17a15ffeb54e2807adc24af
Instruction Fuzzy Hash: A7E075B9508B508FC744EF64D9C101AB7E0FF8C218F86486CEEC46730AE638F9558B92

Uniqueness

Uniqueness Score: -1.00%

Function 10098654 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 10098678
localeconv.MSVCRT ref: 100989B5

Strings

@, xrefs: 10098947

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: _errnolocaleconv
String ID: @
API String ID: 890718178-2766056989
Opcode ID: 87f31d4bc7428a5e780d7db96b519d0f88b83d4e61296ca7e5b1cf395b6e1900
Instruction ID: 1adff65aeb5dec3d05c04cddd2872ed229e66694363a5810d246a0a24491e72e
Opcode Fuzzy Hash: 87f31d4bc7428a5e780d7db96b519d0f88b83d4e61296ca7e5b1cf395b6e1900
Instruction Fuzzy Hash: 87A16874508392CBD760CF24C09079BBBE1EB85754F218A1EE9DC97391D7359A05EB82

Uniqueness

Uniqueness Score: -1.00%

Function 1001F870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

Assertion %s failed at %s:%d, xrefs: 1001F99A

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_get_cpu_flags
String ID: Assertion %s failed at %s:%d
API String ID: 185405932-2766368343
Opcode ID: 7551bec9f1eeb9b50cbb3d7bd5363e3c1abd8a109e782f2c9d38e8ffc4970d7f
Instruction ID: 4f99d49389e0e95857478378ad07d1c4ddbe0ca0cbe19b611fff2a9fa084b9f8
Opcode Fuzzy Hash: 7551bec9f1eeb9b50cbb3d7bd5363e3c1abd8a109e782f2c9d38e8ffc4970d7f
Instruction Fuzzy Hash: 27410575A083419FC700DF58C18162EFBF1FF95740F91892DE9895B311D7B6EA858B42

Uniqueness

Uniqueness Score: -1.00%

Function 1001F9D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1001FAC1
abort.MSVCRT ref: 1001FAC6

Strings

Assertion %s failed at %s:%d, xrefs: 1001FAB0

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_log
String ID: Assertion %s failed at %s:%d
API String ID: 2075109169-2766368343
Opcode ID: 99925a3dfaecbcafd95e37379194f54048025d468bd88c2924350edf8c5203d4
Instruction ID: 863fd428840cd462da4e804408d77d29575e174ab1a66922a4b6ae8ce10ff121
Opcode Fuzzy Hash: 99925a3dfaecbcafd95e37379194f54048025d468bd88c2924350edf8c5203d4
Instruction Fuzzy Hash: 3D317CB5A083418BC714CF10C58112EFBE2FFE1650F96895DE98E4B241D7BAE984DB43

Uniqueness

Uniqueness Score: -1.00%

Function 10097246 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 10097197
fputc.MSVCRT ref: 10097207
memset.MSVCRT ref: 100972C2

Strings

o, xrefs: 1009725E

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: fputc$memset
String ID: o
API String ID: 2944404495-252678980
Opcode ID: 1373d73b05fdf106881186494202064314183d0cc506e90ee32ecc42dbec3c5f
Instruction ID: ad139c84ee4032cb0745c75e293c42ec59ceabe6979b451a5be0c6555295671d
Opcode Fuzzy Hash: 1373d73b05fdf106881186494202064314183d0cc506e90ee32ecc42dbec3c5f
Instruction Fuzzy Hash: B1311876A04206CFCB15CF68C58479ABBF2FF88380F168659D98DAB351E734E940EB40

Uniqueness

Uniqueness Score: -1.00%

Function 1001F6A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

mv_image_get_linesize.MAIN ref: 1001F6E3

Part of subcall function 1001E960: mv_pix_fmt_desc_get.MAIN(?,?,?,?,?,?,?,?,?,?,00000000,?,100B3560,00000000,1001F6E8), ref: 1001E976

Strings

Picture size %ux%u is invalid, xrefs: 1001F76D

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_image_get_linesizemv_pix_fmt_desc_get
String ID: Picture size %ux%u is invalid
API String ID: 645864070-1963597007
Opcode ID: bffdba0522676a7119fbd8fb8b2c8a2483aa10af2a0b965411779b3daaf4d02a
Instruction ID: 48c45da9e3d96b5e90a1d1455c756ac50fe1bc564d21c4e887ebdd33d9096bef
Opcode Fuzzy Hash: bffdba0522676a7119fbd8fb8b2c8a2483aa10af2a0b965411779b3daaf4d02a
Instruction Fuzzy Hash: 51213D75A083558FC304CF69C08021EFBE1FBC8710F658A2EF99897390EBB1E9458B46

Uniqueness

Uniqueness Score: -1.00%

Function 10097724 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 1009768F
fputc.MSVCRT ref: 100976F1

Strings

@, xrefs: 1009772A

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: fputc
String ID: @
API String ID: 1992160199-2766056989
Opcode ID: ddbe921fc933a0b388eeef67dc39fb76b3fd1d74e2a72d8bf4d74865a2920ba7
Instruction ID: cf90b192445e0a6cb44dcd0b4b3e915d1c15c70e7e6222fd19e49ba899a06b57
Opcode Fuzzy Hash: ddbe921fc933a0b388eeef67dc39fb76b3fd1d74e2a72d8bf4d74865a2920ba7
Instruction Fuzzy Hash: CA11F6B2905A058BCB05CF28C184789BBE2FB89744F268259ED8D9F34AD334EC00EB54

Uniqueness

Uniqueness Score: -1.00%

Function 1002E160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 1002E173
mv_parse_video_size.MAIN ref: 1002E203

Strings

none, xrefs: 1002E16A

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_parse_video_sizestrcmp
String ID: none
API String ID: 3218284479-2140143823
Opcode ID: 84f624393dde609fecd91fcb81b813e84baa12488068a8de4cf90aaac65596b6
Instruction ID: 729e6b95738b9364faedc3518f6085fbd91f0b578ed6da749226210f4fcd2ad2
Opcode Fuzzy Hash: 84f624393dde609fecd91fcb81b813e84baa12488068a8de4cf90aaac65596b6
Instruction Fuzzy Hash: C501AF756493819BC780DF28E58141ABBE0EF88780FD58C3EB999C7611E734ED50DB52

Uniqueness

Uniqueness Score: -1.00%

Function 1002B8A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_log.MAIN ref: 1002B909

Strings

The value for option '%s' is not a %s format., xrefs: 1002B8E3
pixel, xrefs: 1002B8F9

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_log
String ID: The value for option '%s' is not a %s format.$pixel
API String ID: 2835281190-1801304947
Opcode ID: e11b65e06b6ff3f522415558f7f655b812ad7cc3f6f8f44e6a5f87898257d26e
Instruction ID: 81a977f13b7eab3a7f73a45e2267e6bafa0d1da5cfeb87ddfd4a13f4960ac526
Opcode Fuzzy Hash: e11b65e06b6ff3f522415558f7f655b812ad7cc3f6f8f44e6a5f87898257d26e
Instruction Fuzzy Hash: 0B01A2786087418FC340CF29D08091AB7F1FBC9250F91892EE99887351D735DD859B42

Uniqueness

Uniqueness Score: -1.00%

Function 1002B920 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_log.MAIN ref: 1002B989

Strings

sample, xrefs: 1002B979
The value for option '%s' is not a %s format., xrefs: 1002B963

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_log
String ID: The value for option '%s' is not a %s format.$sample
API String ID: 2835281190-3983800382
Opcode ID: ec28a4045ceb146e725bc9fee1ba0b9711b2358affd951b1a63fd3584c48ff2b
Instruction ID: 165b06202dc9305b22196fa44e07fb86eddec9d76e15cbfd607819d9a995c42f
Opcode Fuzzy Hash: ec28a4045ceb146e725bc9fee1ba0b9711b2358affd951b1a63fd3584c48ff2b
Instruction Fuzzy Hash: FD01C078608B418FC350CF29D080A1AB7F2FBCA350F91892DFA988B351D735DD859B42

Uniqueness

Uniqueness Score: -1.00%

Function 1000C461 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

mv_bprint_init_for_buffer.MAIN ref: 1000C4A8
mv_bprintf.MAIN ref: 1000C4D0

Strings

none, xrefs: 1000C4C7

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_bprint_init_for_buffermv_bprintf
String ID: none
API String ID: 2490314137-2140143823
Opcode ID: 44bfa67158831aa083f8cc1da789653ca32cdf6bd98319aefa498c906f6f28ff
Instruction ID: ef26fa46dfb025d24f9aeb391b3245028a50c27fa559dbd60d9f836e91f94d6c
Opcode Fuzzy Hash: 44bfa67158831aa083f8cc1da789653ca32cdf6bd98319aefa498c906f6f28ff
Instruction Fuzzy Hash: E60136B5904B568BD720DF24D880B9BB3E4FFC4394F52492DEA9853245D330BD858B97

Uniqueness

Uniqueness Score: -1.00%

Function 1002BA30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DC8
Part of subcall function 10028D90: strcmp.MSVCRT ref: 10028DE8

mv_channel_layout_copy.MAIN ref: 1002BA6D
mv_log.MAIN ref: 1002BAA1

Strings

The value for option '%s' is not a channel layout., xrefs: 1002BA88

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: strcmp$mv_channel_layout_copymv_log
String ID: The value for option '%s' is not a channel layout.
API String ID: 3662905369-3477801521
Opcode ID: 471cd88609156a8107d00b70eb431ac1533a30dc763dbf71cc828c1ee9b289ce
Instruction ID: a4738fb313bc9bb28b9f10f0556689a5b5dd38b8270a41f3b8276b00c034be88
Opcode Fuzzy Hash: 471cd88609156a8107d00b70eb431ac1533a30dc763dbf71cc828c1ee9b289ce
Instruction Fuzzy Hash: 74019D78A097019FC784DF29E081A1EB7E1EFC8750F81892DF8D987355EA74E9849B43

Uniqueness

Uniqueness Score: -1.00%

Function 1002B099 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

mv_strdup.MAIN ref: 1002AE5C

Part of subcall function 100267C0: strlen.MSVCRT ref: 100267DE
Part of subcall function 100267C0: _aligned_realloc.MSVCRT ref: 10026805

mv_strdup.MAIN ref: 1002AE9D
mv_get_pix_fmt_name.MAIN ref: 1002B0A5

Strings

none, xrefs: 1002B08C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strdup$_aligned_reallocmv_get_pix_fmt_namestrlen
String ID: none
API String ID: 1590616525-2140143823
Opcode ID: b294c5a8c65fd7395aa3be69607baeaa27a66f6b1d0d3b6513df14421a8e1872
Instruction ID: 0d6bc99ecbd7f612be6a0bf6eac545e310f060afd60664256324de9b27112373
Opcode Fuzzy Hash: b294c5a8c65fd7395aa3be69607baeaa27a66f6b1d0d3b6513df14421a8e1872
Instruction Fuzzy Hash: 9EF0B6785087518FD760DB64945075EB7E0FF88300FA1882AED98A7301E634E9559B92

Uniqueness

Uniqueness Score: -1.00%

Function 1002B079 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mv_strdup.MAIN ref: 1002AE5C

Part of subcall function 100267C0: strlen.MSVCRT ref: 100267DE
Part of subcall function 100267C0: _aligned_realloc.MSVCRT ref: 10026805

mv_strdup.MAIN ref: 1002AE9D
mv_get_sample_fmt_name.MAIN ref: 1002B085

Strings

none, xrefs: 1002B08C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_strdup$_aligned_reallocmv_get_sample_fmt_namestrlen
String ID: none
API String ID: 2342221411-2140143823
Opcode ID: 0b516a2da8f1af9e55d9d15c0199d5e67172dab74c125b6f9c68ae81825cd705
Instruction ID: 5fee32d5547f3127f63c377983f0a0c76c391dad5c7b300539e2ac3540c0e873
Opcode Fuzzy Hash: 0b516a2da8f1af9e55d9d15c0199d5e67172dab74c125b6f9c68ae81825cd705
Instruction Fuzzy Hash: 0DF0B2785087518FD760DB24E84075EB7E0EB88200FA1882AE9C8A7301EA34E9558B92

Uniqueness

Uniqueness Score: -1.00%

Function 1008A480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

mv_log.MAIN ref: 1008A4C1
abort.MSVCRT ref: 1008A4C6

Strings

n, xrefs: 1008A498

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: abortmv_log
String ID: n
API String ID: 2075109169-2013832146
Opcode ID: 305f50042675133581abc84f0ac8aeb4db4ebd802b12af6a6ddaca597f7b3ecb
Instruction ID: 9cd627dcd14046b22d08c3e5956b6159e380adc9b031ccf81193a127ca12455e
Opcode Fuzzy Hash: 305f50042675133581abc84f0ac8aeb4db4ebd802b12af6a6ddaca597f7b3ecb
Instruction Fuzzy Hash: A8E012B88093818AC340EF28C64220FBBE0EB85640F848D5DF499C7200EBB98A948B53

Uniqueness

Uniqueness Score: -1.00%

Function 10012408 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

mv_strlcatf.MAIN ref: 10012429

Part of subcall function 100067F0: strlen.MSVCRT ref: 1000680A

mv_dict_set.MAIN ref: 1001244D

Strings

.%06dZ, xrefs: 10012419

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_dict_setmv_strlcatfstrlen
String ID: .%06dZ
API String ID: 1014950348-3752268379
Opcode ID: 0fcd152bd701cbbf5cc4896f3278894f4415348b4f9091eae84d680c15830739
Instruction ID: 22fa46e81f10ce603b991d120468da5a27ef3793c7905e7972ce2945146385a5
Opcode Fuzzy Hash: 0fcd152bd701cbbf5cc4896f3278894f4415348b4f9091eae84d680c15830739
Instruction Fuzzy Hash: 4BE04EB5908740AFD714DF29E48175ABBE0FB88354F51C82EA49CD7306D63898518B46

Uniqueness

Uniqueness Score: -1.00%

Function 1001E474 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

mv_image_check_size.MAIN ref: 1001E4BA
mv_calloc.MAIN ref: 1001E519
mv_frame_alloc.MAIN ref: 1001E584
mv_frame_free.MAIN ref: 1001E5CB
mv_freep.MAIN ref: 1001E5DC
mv_get_pix_fmt_name.MAIN ref: 1001E64E
mv_log.MAIN ref: 1001E675

Strings

The hardware pixel format '%s' is not supported by the device type '%s', xrefs: 1001E663

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_callocmv_frame_allocmv_frame_freemv_freepmv_get_pix_fmt_namemv_image_check_sizemv_log
String ID: The hardware pixel format '%s' is not supported by the device type '%s'
API String ID: 473889652-379977042
Opcode ID: f3e8bdb9d7c170bdc459c1ee668fdc6473492807cb8fec2a19448897106cc44b
Instruction ID: 2c6a83db8df34ec64cc29cb3759a8fadaa61080bb751505f1c4c7e836789d21e
Opcode Fuzzy Hash: f3e8bdb9d7c170bdc459c1ee668fdc6473492807cb8fec2a19448897106cc44b
Instruction Fuzzy Hash: A2F022786047418FC710DF29C08051EBBE0EB4D760F558A5DEAE99B391D774EC809B92

Uniqueness

Uniqueness Score: -1.00%

Function 1001E644 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

mv_get_pix_fmt_name.MAIN ref: 1001E64E
mv_log.MAIN ref: 1001E675

Strings

The hardware pixel format '%s' is not supported by the device type '%s', xrefs: 1001E663

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: mv_get_pix_fmt_namemv_log
String ID: The hardware pixel format '%s' is not supported by the device type '%s'
API String ID: 3418758923-379977042
Opcode ID: 29ee3040ede78108e4cc3fd02deb21ab80279a55efe4e481cb1b1b588cc07577
Instruction ID: 525b23ace38b9bb6834e06c5e8b4b181dd8ba8557f5f50a91c42102dc809ce23
Opcode Fuzzy Hash: 29ee3040ede78108e4cc3fd02deb21ab80279a55efe4e481cb1b1b588cc07577
Instruction Fuzzy Hash: 36E02DB89187409FC710DF29808121EBBE0FB49710F51CD2EA9E89B341D774E8809B82

Uniqueness

Uniqueness Score: -1.00%

Function 1008E710 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 1008E71E
TlsGetValue.KERNEL32 ref: 1008E745
GetLastError.KERNEL32 ref: 1008E74C
LeaveCriticalSection.KERNEL32 ref: 1008E76C

Memory Dump Source

Source File: 00000007.00000002.1048964773.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.1048960700.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049106617.00000000100AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049111602.00000000100AB000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049132457.00000000101D8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049138940.00000000101DD000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101DE000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049143860.00000000101E1000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000007.00000002.1049162652.00000000101FC000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 08e83d7a8b309bb27f33bcb565ca26a80b3f8e398a714c744f86402301243d9a
Instruction ID: 75efdd3623e0d03d8c836b031dcd533682d24787f7fc8771eedf31777a92f740
Opcode Fuzzy Hash: 08e83d7a8b309bb27f33bcb565ca26a80b3f8e398a714c744f86402301243d9a
Instruction Fuzzy Hash: BCF0AFB69053619FC700BF78C9C890A7BA8FB44740B460578DD8847719E734EC45CBA3

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5q4psw.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Qbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\66172c.rbs

C:\System Volume Information\SPP\OnlineMetadataCache\{95bd4ba6-e44e-4e3d-aced-35775530fd8d}_OnDiskSnapshotProp

C:\System Volume Information\SPP\metadata-2

C:\System Volume Information\SPP\snapshot-2

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

C:\Users\user\AppData\Local\Temp\~DF081EC1EE06C4DD73.TMP

C:\Users\user\AppData\Local\Temp\~DF26027B870D05A567.TMP

C:\Users\user\AppData\Local\Temp\~DFD45D14352E4E4A80.TMP

C:\Windows\Installer\66172a.msi

C:\Windows\Installer\66172b.ipi

C:\Windows\Installer\66172d.msi

C:\Windows\Installer\MSIABDA.tmp

C:\Windows\Installer\SourceHash{2DB09FCD-7D8E-4C24-BF5D-FB5BD25D67B7}

Static File Info

Windows Analysis Report
5q4psw.msi

Function 1002A53A Relevance: 1.3, APIs: 1, Instructions: 69
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre